Privacy Policy
Flooring Rugs & More is committed to the responsible collection, use, and protection of your personal information in accordance with Australian law. This policy explains what we collect, why we collect it, and how we safeguard it.
At Flooring Rugs & More (“we”, “our”, “us”), your privacy is a responsibility we take seriously. We collect only the personal information that is reasonably necessary for our business operations and handle it in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). We do not sell your personal information to third parties. We do not use it for purposes you would not reasonably expect. And we give you genuine control over the information we hold about you.
This policy applies to all personal information collected through our website at flooringrugsandmore.com.au, by email, by phone, or through any other interaction with our business.
- 01Information We Collect
- 02How We Collect Information
- 03How We Use Your Information
- 04Marketing Communications
- 05Payment Information
- 06Cookies & Website Analytics
- 07Disclosure to Third Parties
- 08Overseas Data Transfers
- 09Data Security
- 10Your Rights — Access & Correction
- 11Data Retention
- 12Children’s Privacy
- 13Third-Party Links
- 14Complaints
- 15Changes to This Policy
- 16Contact Us
Information We Collect
We collect personal information that is reasonably necessary to operate our online store, process your orders, provide customer support, and improve our services. We will not collect more information than is necessary for those purposes.
| Category | Information Collected | Purpose |
|---|---|---|
| Identity Information | Full name, account username | Order processing, account management, customer verification |
| Contact Information | Email address, phone number, billing address, delivery address | Order fulfilment, delivery coordination, customer communications |
| Transaction Information | Items purchased, order value, order history, purchase frequency | Order processing, refunds, returns management, dispute resolution |
| Payment Information | Payment method type, last four digits of card (if applicable), billing details | Fraud prevention and payment verification — we do not store full card numbers |
| Technical Information | IP address, device type, browser type and version, operating system | Security, fraud detection, website performance |
| Usage Information | Pages visited, products viewed, search queries, time spent on site, click behaviour | Website improvement, product recommendations, analytics |
| Communications | Emails, live chat transcripts, phone call records (where applicable) | Customer support, quality assurance, dispute resolution |
| Marketing Preferences | Newsletter subscription status, email preference settings, promotional opt-ins | Targeted and general marketing communications where consent is given |
Where we request sensitive information — which the Privacy Act defines to include health information, racial or ethnic origin, religious beliefs, or similar categories — we will explain why it is needed and obtain your explicit consent before collection. We do not routinely request or store sensitive information in connection with rug purchases.
How We Collect Information
We collect personal information through a variety of direct and indirect channels. In all cases, we aim to collect information directly from you wherever it is reasonable and practicable to do so, in accordance with APP 3.
Direct Collection
We collect information directly from you when you:
- Place an order through our website, including entering billing and delivery details at checkout
- Create a customer account on our website
- Subscribe to our email newsletter or marketing communications
- Contact our customer support team by email, phone, or live chat
- Submit a product review, rating, or testimonial
- Participate in a competition, promotion, survey, or giveaway we run
- Submit an enquiry through our website contact form
- Interact with us through our social media channels
Indirect Collection — Automatic Data
We also collect certain technical and usage information automatically when you visit our website. This includes data gathered through cookies, web beacons, pixels, and similar technologies embedded in our Shopify store platform. This automatic data collection is described in detail in Section 6 of this policy.
Collection from Third Parties
In limited circumstances, we may receive information about you from third parties — for example, from our payment processor when verifying a transaction, from a shipping carrier updating your delivery status, or from a social media platform if you engage with our advertising. We handle all such information in accordance with this policy.
Where it is lawful and practicable to do so, you have the option of interacting with us anonymously or using a pseudonym. For example, you may browse our website, read our guides, and contact us with a general enquiry without providing identifying information. However, completing a purchase requires accurate identity and delivery information to fulfil your order and comply with our legal obligations.
How We Use Your Information
We use your personal information only for the purposes for which it was collected or for directly related purposes that you would reasonably expect, or where you have given consent, or where we are required or authorised to do so by law.
Primary Purposes
- Order processing and fulfilment — processing your payment, picking, packing, and dispatching your order, and communicating order status updates with you throughout the delivery process
- Account management — creating and maintaining your customer account, authenticating your identity when you log in, and managing your stored preferences
- Customer support — responding to enquiries, processing returns and exchanges, managing warranty and faulty product claims, and resolving disputes
- Fraud prevention and security — detecting and preventing fraudulent transactions, unauthorised account access, and other prohibited or illegal activities on our platform
- Legal compliance — meeting our obligations under Australian law, including taxation and consumer law requirements, and responding to valid legal requests from authorities
Secondary Purposes
- Service improvement — analysing usage patterns, customer feedback, and purchase data to improve our website, product range, and overall customer experience
- Personalisation — tailoring your browsing experience, providing product recommendations relevant to your purchase history and preferences, and surfacing content relevant to your location
- Marketing communications — sending promotional emails, product updates, and special offers where you have consented to receive them (see Section 4)
- Research and analytics — conducting internal research and analysis to understand our customer base and improve our business operations, in de-identified or aggregated form where possible
We will not use your personal information for a secondary purpose unless you have consented, the secondary purpose is directly related to the primary purpose for which it was collected, or we are required to do so by law. We do not use your personal information to make automated decisions about you that have a legal or significant effect without human oversight.
Marketing Communications
We take our obligations under both the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth) seriously. We will only send you direct marketing communications where we have your consent or where we are otherwise permitted to do so under applicable law.
Consent and Opt-In
When you create an account or place an order, you may be given the option to subscribe to our marketing emails. This opt-in is voluntary and clearly separated from the order completion process — subscribing to marketing communications is not a condition of purchase. Where you have subscribed, we may contact you with:
- New product launches, collections, and restocks
- Promotional offers, sale events, and discount codes
- Interior styling tips, guides, and educational content related to rugs and flooring
- Business news and updates relevant to your customer relationship with us
Existing Customer Communications
Where you have previously purchased from us, we may, in accordance with the Spam Act 2003 (Cth), contact you about products or services similar to those you have purchased previously. This is a limited form of marketing directed at an existing customer relationship and is distinct from general promotional marketing requiring express consent.
Opting Out
You may withdraw your consent and unsubscribe from marketing communications at any time, at no cost, by any of the following methods:
- Clicking the “Unsubscribe” link included in the footer of every marketing email we send
- Logging into your customer account and updating your email preference settings
- Contacting us directly at info@flooringrugsandmore.com.au with your unsubscribe request
We will action all unsubscribe requests within 5 business days. Unsubscribing from marketing communications will not affect our ability to send you transactional communications directly related to an order you have placed — order confirmations, shipping updates, and support responses are not marketing communications and cannot be disabled.
Payment Information
The security of your payment information is a priority. All payment transactions on our website are processed by third-party payment providers who operate under their own security standards and privacy policies.
Our Shopify store uses industry-standard encrypted payment processing. When you enter your payment details at checkout, that information is transmitted directly to our payment processor using Transport Layer Security (TLS) encryption. We do not receive, store, or have access to your full credit or debit card number at any time.
We may retain limited payment-related information — such as the last four digits of your card number, payment method type, and transaction reference numbers — for the purposes of fraud prevention, dispute resolution, and compliance with our financial record-keeping obligations under Australian law.
Our payment processing infrastructure is compliant with PCI DSS (Payment Card Industry Data Security Standard), the global standard for the secure handling of cardholder data. This compliance is managed through our Shopify platform and payment gateway partners. For details on how your payment data is handled by these providers, please refer to their respective privacy policies.
Cookies & Website Analytics
Our website uses cookies, pixels, and similar tracking technologies. A cookie is a small text file placed on your device by a website to remember information about your visit. Cookies are widely used by websites to make them function efficiently and to provide information to the website operator.
| Cookie Type | Purpose | Examples | Can Be Disabled? |
|---|---|---|---|
| Strictly Necessary | Enable core website functionality — shopping cart, checkout, login sessions | Shopify session cookies, cart ID | No — disabling will prevent checkout |
| Performance & Analytics | Collect anonymised data about how visitors use the site — pages visited, traffic sources, time on site | Google Analytics, Shopify Analytics | Yes — via browser settings or opt-out tools |
| Functional | Remember your preferences and improve your experience — language, currency, recently viewed products | Preference cookies | Yes — may affect personalisation |
| Marketing & Advertising | Track your browsing across sites to deliver relevant advertising and measure campaign effectiveness | Meta Pixel, Google Ads tag | Yes — via browser settings or platform opt-outs |
Managing Cookies
You can control and manage cookies through your browser settings. Most browsers allow you to view, block, or delete cookies at any time. Please note that disabling strictly necessary cookies will prevent you from completing a purchase on our website, as they are essential to the checkout process.
You may also opt out of Google Analytics data collection by installing the Google Analytics Opt-out Browser Add-on. For advertising cookies, you can manage your preferences through the Digital Advertising Alliance’s opt-out tool at youronlinechoices.com.au.
Do Not Track
Some browsers support a “Do Not Track” (DNT) feature that sends a signal to websites requesting that your browsing activity not be tracked. Our website does not currently respond to DNT signals, as there is no consistent industry standard for how DNT requests should be interpreted and implemented.
Disclosure to Third Parties
We do not sell, rent, or trade your personal information to third parties for their own commercial purposes. We may share your information with trusted third-party service providers who assist us in operating our business, but only to the extent necessary for them to provide those services and subject to appropriate confidentiality obligations.
Legal Disclosures
We may also disclose your personal information where we are required or authorised to do so by law — including to government agencies, law enforcement, courts, and regulatory bodies (including the ACCC or OAIC) in response to a valid legal request, subpoena, court order, or regulatory requirement. We will only disclose the minimum information necessary to satisfy such requests.
In the event of a merger, acquisition, sale of assets, or change of business ownership, your personal information may be transferred to the acquiring entity as part of that transaction. If such a transfer occurs, we will ensure the acquiring entity is bound to handle your information in a manner consistent with this policy, and we will notify you before your information is subject to a different privacy policy.
Overseas Data Transfers
Some of the third-party service providers we use store or process personal information outside of Australia. For example, Shopify’s servers are located in the United States and Canada. Google’s analytics infrastructure spans multiple global data centres. These overseas transfers are a standard feature of modern ecommerce operations.
Under APP 8 of the Australian Privacy Principles, before disclosing personal information to an overseas recipient, we must take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to that information. We satisfy this requirement by:
- Contracting with overseas service providers who maintain privacy and security standards consistent with or equivalent to the APPs
- Using platforms (such as Shopify) that are subject to certified compliance frameworks including GDPR, PCI DSS, and SOC 2
- Reviewing the privacy policies of our key service providers to confirm their data handling practices
By using our website and placing an order, you acknowledge that your personal information may be transferred to and stored by service providers located outside Australia. In some cases, the privacy laws of those countries may not provide protections equivalent to Australian law. Where this is the case, we will take all reasonable contractual steps to protect your information.
Data Security
We take reasonable steps to protect the personal information we hold from misuse, interference, loss, unauthorised access, modification, and disclosure, in accordance with APP 11.
Our security measures include, but are not limited to:
- Encryption in transit — all data transmitted between your browser and our website is encrypted using HTTPS with TLS (Transport Layer Security) protocols
- Access controls — access to personal information held in our systems is restricted to authorised personnel on a need-to-know basis and protected by strong authentication requirements
- Platform security — our website is hosted on Shopify, which maintains enterprise-grade security infrastructure including regular security audits, penetration testing, and compliance certifications
- Payment security — payment data is handled by PCI DSS-compliant payment processors and is not stored on our own servers
- Monitoring and review — we periodically review our security practices and update them in response to new risks and evolving industry standards
No method of data transmission over the internet or electronic storage is completely secure. While we implement commercially reasonable security measures, we cannot guarantee the absolute security of personal information transmitted to our website. You transmit information to us at your own risk. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.
Data Breach Response
In the event of an eligible data breach as defined under the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), we will act in accordance with our obligations — including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required. We maintain an internal data breach response plan and will act promptly to contain, assess, and notify in the event of a serious breach.
Your Rights — Access & Correction
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have meaningful rights over the personal information we hold about you. We are committed to facilitating the exercise of these rights promptly and without unnecessary barriers.
Right to Access (APP 12)
You may request access to the personal information we hold about you at any time. We will respond to access requests within 30 days. In most cases we will provide access free of charge, though we may charge a reasonable fee for requests that require significant retrieval effort.
Right to Correction (APP 13)
If you believe personal information we hold about you is inaccurate, out of date, incomplete, or misleading, you may request that we correct it. We will take reasonable steps to correct the information within 30 days of your request.
Right to Opt Out of Marketing
You may withdraw your consent to receive direct marketing communications at any time. We will action all opt-out requests within 5 business days. See Section 4 for detailed opt-out instructions.
Right to Know What We Hold
You may ask us to confirm whether we hold personal information about you, what that information is, and for what purposes we use and disclose it. We will respond honestly and completely to such enquiries.
How to Make an Access or Correction Request
To submit a request to access or correct personal information we hold about you, please contact us in writing at info@flooringrugsandmore.com.au. Include your full name, the email address associated with your account, and a description of the information you are seeking to access or correct. We may need to verify your identity before processing your request to protect the privacy of your information.
We may refuse or limit access to personal information in certain circumstances permitted by the Privacy Act — for example, where providing access would pose a serious threat to the life, health, or safety of any person, where access would have an unreasonable impact on the privacy of other individuals, or where the request is frivolous or vexatious. Where we refuse or limit access, we will provide written reasons for doing so and advise you of the complaint mechanisms available to you.
Data Retention
We retain personal information only for as long as it is necessary for the purposes for which it was collected, or as required by Australian law. We do not retain information indefinitely — when the purpose for which it was collected has been fulfilled and legal retention obligations have been met, we take reasonable steps to destroy or de-identify the information.
| Data Type | Retention Period | Reason |
|---|---|---|
| Order and transaction records | 7 years | Australian taxation law requires financial records to be retained for 5 years; we retain for 7 as standard commercial practice |
| Customer account information | Duration of account plus 2 years after last activity | Customer service continuity and fraud prevention |
| Email marketing data | Until unsubscribe plus 12 months | Sufficient to process unsubscribe requests and resolve any related disputes |
| Customer support communications | 3 years | Dispute resolution and service improvement |
| Website analytics (anonymised) | 26 months (Google Analytics default) | Website performance benchmarking and trend analysis |
| Fraud and security logs | 2 years | Fraud detection pattern analysis and security incident response |
At the end of the applicable retention period, personal information is either securely deleted from our systems, anonymised so it can no longer be linked to an identifiable individual, or both. Backups containing personal information are subject to the same retention schedule as primary data.
Children’s Privacy
Our website is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 18. Our products and services — rugs, flooring, and related home furnishing products — are directed at adult consumers making household purchasing decisions.
If you are under 18 years of age, please do not provide any personal information to us through our website. If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate parental consent, we will take reasonable steps to delete that information as soon as practicable.
If you are a parent or guardian and believe your child has provided personal information to us without your consent, please contact us immediately at info@flooringrugsandmore.com.au and we will take prompt action.
Third-Party Links
Our website may contain links to third-party websites, social media platforms, or external services — including our social media profiles on platforms such as Instagram, Facebook, and Pinterest, links to delivery tracking portals operated by our shipping carriers, or links to manufacturer or supplier websites for product information.
These external sites are not operated or controlled by Flooring Rugs & More. We are not responsible for the privacy practices, content, security standards, or data handling of any third-party website. Once you leave our website by clicking an external link, this Privacy Policy no longer applies.
We encourage you to read the privacy policy of every website you visit. The presence of a link to an external website on our platform does not constitute an endorsement of that website’s privacy practices or content.
Complaints
If you believe we have handled your personal information in a manner that does not comply with the Privacy Act 1988 (Cth) or the Australian Privacy Principles, we encourage you to contact us in the first instance so we can attempt to resolve your concern directly and promptly.
Please send your complaint in writing to info@flooringrugsandmore.com.au, with the subject line “Privacy Complaint”. Include your name, contact details, and a description of your concern. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response to your complaint, or if you would prefer to escalate your concern directly, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC is the independent regulator responsible for privacy law in Australia.
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our business practices, changes in the law, feedback from the regulator, or improvements in our privacy practices. We reserve the right to update this policy at any time without prior notice.
When we make material changes to this policy — changes that are likely to have a significant impact on how we handle your personal information — we will take reasonable steps to bring those changes to your attention. This may include posting a notice on our website, sending an email notification to registered customers, or both.
All changes take effect from the date the updated policy is published on this page. The date of the most recent update is displayed at the top of this page. We encourage you to review this policy periodically to remain informed about how we protect your information.
Your continued use of our website after any update to this policy constitutes your acceptance of the revised terms.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise any of your rights under the Privacy Act, would like to access or correct your personal information, or want to make a privacy-related complaint, please contact us using the details below.