Privacy policy

Last Updated: 22/10/25

1. Introduction

Milk & Stone (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal information in a safe and transparent manner. This policy sets out how we collect, use, disclose and store your personal information when you interact with our website, purchase products, or otherwise engage our services, including for customers worldwide.
We comply with the Australian Privacy Principles (APPs) under the Office of the Australian Information Commissioner (OAIC) and apply relevant provisions of the General Data Protection Regulation (GDPR) for international users.
This policy also complements other policies on our website (for example, cookie policy or data-sharing opt-out).

2. What Personal Information We Collect

We collect personal information that is reasonably necessary for our business activities, including:

• Contact details (name, email address, phone number, shipping and billing address)

• Order information and purchase history (including inclusions you send us, customization preferences)

• Payment and transaction information (entered via third-party payment processors; we do not store full card details)

• Website usage, device and browser data (e.g., IP address, browser type, click-stream, referring URL, device identifiers) gathered via cookies and similar technologies

• Marketing preferences and consent status

• Any other information you choose to provide (e.g., photos for custom keepsakes, feedback, postcards)

3. How We Use Your Information

We use your personal information for the following purposes:

• To process, customise and fulfil your order for keepsakes

• To communicate with you (order status updates, customer service enquiries, warranties)

• To send marketing communications where you have given consent

• To administer our website, evaluate and improve our services, monitor usage and performance

• To comply with legal and regulatory obligations (for example under Australian consumer law)

• To protect our business, our customers and our rights (fraud prevention, dispute resolution)

• To provide targeted advertising and remarketing, in accordance with your opt-out rights.

4. Disclosure & Sharing of Personal Information

We do not sell your personal information. However we may share your data with external service providers and partners for business operations, including:

• Payment processors and financial service providers

• Shipping, fulfilment and logistics services

• Website hosting, email and marketing services

• Advertising networks for targeted ads (with opt-out options)

• Legal, regulatory or law enforcement bodies where required by law or to protect our rights
  We ensure our service providers are bound to protect your information consistent with this policy and applicable law.

5. Cookies, Tracking & Advertising

Our website uses cookies and similar tracking technologies to enhance your experience and analyse usage. We also engage in targeted advertising and remarketing. You may opt out of certain data-sharing for advertising purposes.
You can also configure your browser or device to refuse cookies — although certain website functionality may be affected.

6. International Transfers & Storage

As a global business, your personal information may be transferred to, processed or stored in locations outside your country of residence, including Australia and other jurisdictions. When we do so, we implement appropriate safeguards to protect your information in accordance with this policy and legal requirements (including GDPR where applicable). Your privacy choices.

7. Retention of Personal Information

We retain your personal information only as long as necessary to fulfil the purposes outlined — including legal, tax or warranty obligations — and thereafter securely de-identify or delete it.

8. Your Rights

Depending on your jurisdiction, you may have rights including:

• Access your personal data held by us

• Request correction of inaccurate or incomplete information

• Request deletion or restriction of processing under certain circumstances

• Withdraw your consent for marketing at any time

• Object to processing for direct marketing or targeted advertising

• Lodge a complaint with your relevant supervisory authority (for example the OAIC in Australia)
  For global users, these rights reflect the protections under GDPR for EU/UK residents.

9. Security

We implement appropriate technical and organisational measures (secure servers, encryption, access controls) to protect your personal information from unauthorised access, alteration or disclosure. While we strive to protect your data, no transmission over the internet is fully secure — you transmit data at your own risk.

10. Children’s Data

Our website and services are not intended for children under 16 years old. We do not knowingly collect personal information from children without verifiable parental consent.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on our site with the “Last Updated” date. We encourage you to review the policy periodically.

12. Contact Us

If you have any questions, requests or concerns relating to this policy or your personal information, please contact us at:
Milk & Stone
PO Box 32, North Richmond NSW 2754, Australia
Email: hello@milkandstone.com.au