GDPR Privacy Rights — EU & UK Customers
1. Who This Policy Applies To
This page explains your privacy rights under the General Data Protection Regulation (GDPR) if you are a resident of:
- Any member state of the European Union (EU) or European Economic Area (EEA)
- The United Kingdom (post-Brexit, the UK GDPR applies)
If you reside in one of these regions and interact with Olive et Oriel — whether browsing our website, creating an account, or placing an order — this policy applies to you.
2. Data Controller Identity
The data controller responsible for your personal data is:
Bonheur Creatives Pty Limited
ABN: 63 618 780 573 | ACN: 618 780 573
Trading as: Olive et Oriel, SIRUNE, Canvas Art Print Co
Address: Unit 3, 18 Nells Road, NSW 2250, Australia
Privacy Contact: help@oliveetoriel.com
As an Australian company that offers goods to EU and UK residents, we comply with GDPR obligations under the extraterritorial scope provisions of Article 3(2) of the GDPR.
3. Legal Bases for Processing Your Data
Under Article 6 of the GDPR, we process your personal data based on the following lawful bases:
Contract Performance (Article 6(1)(b))
Processing necessary to fulfil our contract with you, including:
- Processing and shipping your orders
- Providing customer service and support
- Managing returns and refunds
- Sending transactional communications (order confirmations, shipping updates)
Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate business interests, balanced against your rights:
- Fraud prevention and security measures
- Improving our website and services
- Analysing website usage to enhance user experience
Consent (Article 6(1)(a))
Processing based on your explicit consent:
- Marketing emails and newsletters
- Non-essential cookies and tracking technologies
- Personalised advertising
You may withdraw consent at any time by clicking unsubscribe in any email, updating your cookie preferences, or contacting us directly.
Legal Obligation (Article 6(1)(c))
Processing required to comply with legal requirements:
- Tax record-keeping (7-year retention as required by Australian law)
- Fraud prevention reporting
- Compliance with court orders or regulatory requests
4. Your Rights Under GDPR
As an EU/EEA or UK resident, you have the following rights regarding your personal data:
Right of Access (Article 15)
You can request a copy of all personal data we hold about you, including how it is processed and with whom it is shared.
Right to Rectification (Article 16)
You can request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure (Article 17)
Also known as the "right to be forgotten" — you can request deletion of your personal data in certain circumstances.
Right to Restriction (Article 18)
You can request that we limit how we process your data while we verify accuracy or assess a legitimate interests objection.
Right to Data Portability (Article 20)
You can request your data in a structured, commonly used, machine-readable format to transfer to another service.
Right to Object (Article 21)
You can object to processing based on legitimate interests or for direct marketing purposes. Marketing objections are actioned immediately.
Automated Decision-Making (Article 22)
You have rights related to automated processing that significantly affects you. We do not currently make solely automated decisions with legal effects.
Withdraw Consent
Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
5. How to Exercise Your Rights
Submit a GDPR Data Request
To exercise any of your rights, email us at:
Use subject line: "GDPR Data Request"
Please include:
- Your full name
- The email address associated with your account or orders
- The specific right you wish to exercise
Response time: We will respond within 30 days of receiving your verified request. In complex cases, we may extend this by up to 60 additional days with notice.
Identity verification: To protect your data, we may require verification of your identity before processing requests.
6. Data Retention Periods
We retain your personal data only as long as necessary for the purposes described, or as required by law:
- Order and transaction data: 7 years (required for tax and legal compliance under Australian law)
- Customer account data: Retained until you request account deletion
- Marketing preferences: Until you unsubscribe or request removal
- Analytics data: 26 months (Google Analytics default retention)
- Cookie data: Varies by cookie — see our Cookie Policy
- Customer service correspondence: 3 years from last contact
7. International Data Transfers
Your personal data is primarily processed in Australia. To operate our business, we also transfer data to service providers in other countries, including the United States.
These international transfers are protected by:
- Standard Contractual Clauses (SCCs): Approved by the European Commission for data transfers outside the EU/EEA
- Data Processing Agreements: With all third-party processors, including Shopify's comprehensive DPA
- Adequacy decisions: Where applicable, transfers to countries recognised by the EU as providing adequate protection
You may request a copy of the safeguards in place by contacting us.
8. Third-Party Processors
We share your data with the following third-party processors who help us operate our business:
9. Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your national supervisory authority:
We encourage you to contact us first so we can address your concerns directly.
10. Cookie Consent
For information about how we use cookies and tracking technologies, and to manage your cookie preferences, please see our Cookie Policy.
11. Updates to This Policy
Last updated: 31 March 2026
We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or website notice.
For questions about this policy or your privacy rights, contact help@oliveetoriel.com
