Privacy Policy

This Privacy Policy explains how Comet Lore collects, uses, stores, discloses and protects personal information when you visit cometlore.com, place an order, communicate with us, use our returns process, subscribe to marketing, or otherwise interact with Comet Lore.

Comet Lore is a trading brand operated by MIRAD Commerce & Operations Michał Radziński (“Comet Lore”, “we”, “us” or “our”). NIP: 9731124879. Address: ul. Marcina Kasprzaka 31/119, 01-234 Warszawa, Poland. For the purposes of the General Data Protection Regulation (“GDPR”), we are the controller of personal data processed in connection with our business, except where another party acts as an independent controller. Where the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) apply to our activities, we handle personal information in accordance with those requirements.

Privacy contact: support.au@cometlore.com

In this Policy, “Personal Information” includes “personal information” under Australian law and “personal data” under the GDPR.

Quick links

1. Scope · 2. Information we collect · 3. How we collect it · 4. How we use it · 5. Legal bases · 6. Cookies & advertising · 7. Marketing · 8. Sharing information · 9. Shopify & payments · 10. International transfers · 11. Automated tools · 12. Retention · 13. Security · 14. Your rights · 15. Australian privacy rights · 16. Sensitive information & photos · 17. Children · 18. Business transfers · 19. Third-party links · 20. Changes · 21. Contact & complaints

1. Scope of this Privacy Policy

This Policy applies to Personal Information handled by Comet Lore through our online store, checkout, customer support, returns and refund processes, marketing communications, social media interactions and other services that link to or refer to this Policy.

It does not replace the privacy policies of third parties that independently determine how they use Personal Information, including payment providers, delivery carriers, social networks and certain Shopify consumer services. Where you interact directly with such a third party, its own privacy notice may also apply.

You can generally browse our store without creating a customer account. However, we need certain identifying and contact information to process an order, arrange delivery, investigate a payment or fraud issue, provide a refund or replacement, process a return, or respond to a rights request. If required information is not provided, we may be unable to provide the relevant service.

2. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of Personal Information:

  • Identity and contact information: name, email address, telephone number, billing address, shipping address and other contact details you provide.
  • Order and transaction information: products ordered, variants, quantities, prices, discounts, order value, order number, order status, delivery information, returns, refunds, replacements, store credit, disputes and purchase history.
  • Payment-related information: payment method, transaction status, payment-provider references, billing details and limited payment information made available to us by payment providers. Full payment card details are generally collected and processed by payment providers rather than stored directly by Comet Lore.
  • Delivery and fulfilment information: recipient details, shipping address, telephone number where required for delivery, carrier information, tracking information, customs-related information and delivery status.
  • Customer service information: messages, emails, support requests, return requests, complaints, product-issue descriptions and other information you choose to provide when communicating with us.
  • Returns information: information submitted through our Returns Form, which may include your name, email, telephone number, order number, delivery date, return reason, product details, quantity, price paid and comments.
  • Product-issue evidence: where reasonably necessary to assess a faulty, damaged, incorrect or materially not-as-described product, we may receive photographs or videos of the product, packaging, label or defect.
  • Device and technical information: IP address, browser type, device type, operating system, language, approximate location derived from IP address, identifiers, cookie IDs, session information and technical logs.
  • Website and shopping activity: pages viewed, products viewed, searches, clicks, cart activity, checkout activity, referral source, time spent on pages and interactions with our store or marketing.
  • Marketing and preference information: marketing subscriptions, consent records, communication preferences, product interests and interactions with marketing communications.
  • Fraud, risk and security information: signals used to identify suspicious transactions, account misuse, payment risk, chargebacks, automated traffic or other security threats.
  • User-generated content: reviews, feedback, survey responses, competition entries or other content you voluntarily submit to us, if those features are offered.
  • Other information you voluntarily provide: for example, sizing or fit information provided when asking us for product assistance. We ask that you provide only information reasonably necessary for us to assist you.

We do not intentionally request health information, biometric information, information about sexual life, or other special-category or sensitive information unless there is a genuine and lawful need to do so. Please see section 16 below before sending photographs or other potentially sensitive material.

3. How We Collect Personal Information

We may collect Personal Information:

  • directly from you, including when you place an order, complete checkout, contact support, submit a return request, subscribe to marketing, complete a form or otherwise communicate with us;
  • automatically when you browse or interact with our website, through cookies, pixels, tags, log files and similar technologies, subject to applicable consent requirements;
  • from Shopify and other service providers that help us operate our store, process transactions, prevent fraud, deliver orders, provide analytics, communicate with customers or provide technical services;
  • from payment providers and financial institutions in connection with payments, transaction verification, chargebacks, refunds and fraud prevention;
  • from shipping, fulfilment and logistics partners in connection with fulfilment, tracking, delivery, returns and delivery problems; and
  • from advertising, analytics, referral or social-media partners where permitted by law and consistent with your privacy choices.

If we receive Personal Information about you from another person, we expect that person to have authority to provide it. If you place an order for delivery to another person, you are responsible for ensuring that you are permitted to provide their delivery and contact information to us for that purpose.

4. How We Use Personal Information

We may collect, hold, use and disclose Personal Information for the following purposes:

  • to provide, operate and maintain the Comet Lore store and services;
  • to process, verify and fulfil orders;
  • to arrange international and domestic shipping, fulfilment, customs processing and delivery;
  • to communicate order confirmations, shipping updates and other service messages;
  • to provide customer support and respond to enquiries;
  • to administer returns, refunds, replacements, store credit, cancellations and product claims;
  • to verify transactions and prevent, detect, investigate and respond to fraud, abuse, security incidents, chargebacks and other unlawful or harmful activity;
  • to enforce our Terms & Conditions and establish, exercise or defend legal claims;
  • to maintain business, accounting, tax, transaction and compliance records;
  • to comply with applicable laws, lawful requests, court orders and regulatory obligations;
  • to analyse store performance, customer journeys and product demand;
  • to improve our website, products, customer experience, operations and marketing;
  • to personalise content, product recommendations and advertising where permitted;
  • to measure the effectiveness of advertising and marketing campaigns;
  • to send promotional communications where you have consented or where otherwise permitted by applicable law;
  • to manage privacy preferences, opt-outs and suppression lists;
  • to perform internal business administration, reporting, forecasting and risk management; and
  • to support a financing, investment, sale, transfer, incorporation, merger, restructuring or other legitimate corporate transaction involving all or part of the Comet Lore business, subject to applicable law.

We may also use information that has been aggregated or de-identified so that it no longer identifies or can reasonably be linked to an individual. We may use such information for analytics, forecasting, reporting and business improvement, subject to applicable law.

Because Comet Lore is operated from Poland, the GDPR applies to processing carried out in the context of our establishment in the European Union. Where the GDPR applies, we rely on one or more of the following legal bases:

  • Performance of a contract or steps requested before entering into a contract: for example, processing an order, arranging delivery, providing customer service, administering a return or issuing a refund.
  • Legal obligation: where processing is necessary to comply with tax, accounting, consumer-protection, regulatory or other legal obligations.
  • Legitimate interests: where necessary for legitimate business purposes and those interests are not overridden by your rights and freedoms. These interests may include preventing fraud and chargebacks, securing our systems, managing disputes, improving our services, understanding business performance, maintaining appropriate records, enforcing our terms and protecting our legal rights.
  • Consent: where we ask for your consent, including for certain marketing communications, advertising technologies or non-essential cookies where consent is required by law.
  • Establishment, exercise or defence of legal claims and other legal grounds available under applicable data protection law where relevant.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. Where processing is based on legitimate interests, you may have a right to object as described below.

6. Cookies, Analytics and Advertising Technologies

Our website and service providers may use cookies, pixels, tags, local storage, software development tools and similar technologies to operate the store, remember preferences, keep the checkout secure, understand how visitors use the website, measure performance and support advertising.

These technologies may collect or generate device identifiers, IP address, browser information, website activity, referral information, shopping interactions and advertising identifiers.

We generally use these technologies for the following categories of purposes:

  • Strictly necessary: store functionality, security, checkout, fraud prevention, network management and privacy preferences.
  • Functional: remembering choices and improving website functionality.
  • Analytics: understanding traffic, website performance, customer journeys and product interest.
  • Advertising and measurement: measuring campaigns, limiting or personalising advertisements and understanding whether advertising led to visits or purchases.

Where applicable law requires consent for non-essential cookies or similar technologies, we will seek that consent through the privacy controls made available on our store. You can also use browser settings and available store privacy controls to manage certain technologies. Disabling some technologies may affect store functionality.

We do not sell Personal Information for monetary consideration. However, some privacy laws use broader definitions of “sale”, “sharing” or targeted advertising. To the extent any advertising or platform activity falls within such a definition, we will provide any legally required notice or choice.

7. Marketing Communications

If you subscribe to marketing or if applicable law otherwise permits us to contact you, we may send information about products, launches, promotions, offers or other Comet Lore news.

You can unsubscribe at any time by using the unsubscribe mechanism in the message or contacting us at support.au@cometlore.com. We may retain limited information on a suppression list so that we can record and respect your opt-out.

Commercial electronic messages sent to Australian recipients will be handled in accordance with applicable Australian anti-spam requirements. This includes identifying the sender, providing valid contact details, offering a functional unsubscribe mechanism and actioning unsubscribe requests within the period required by law.

Even if you opt out of marketing, we may still send non-promotional messages that are necessary to complete or service a transaction, such as order confirmations, delivery notices, security messages or responses to your support requests.

8. How We Share or Disclose Personal Information

We do not disclose Personal Information indiscriminately. We may disclose Personal Information where reasonably necessary to operate our business, provide services, comply with law or protect legitimate interests, including to the following categories of recipients:

  • E-commerce and technology providers, including Shopify and providers supporting hosting, cloud infrastructure, security, communications, website functionality and technical support.
  • Payment providers, banks and financial institutions for payment processing, transaction verification, refunds, chargebacks, fraud prevention and financial compliance.
  • Suppliers, fulfilment facilities, warehouses, shipping providers, postal operators, couriers and logistics partners where necessary to prepare, route, deliver, track or return an order.
  • Customs, postal and border authorities where information is required for cross-border shipment or lawful import/export processing.
  • Customer-service and communications providers that help us manage customer requests, email or other communications.
  • Analytics and advertising providers where used and permitted by applicable law, including subject to consent where required.
  • Professional advisers, including accountants, lawyers, tax advisers, insurers, auditors and consultants where reasonably necessary.
  • Government authorities, regulators, courts, law-enforcement bodies or other third parties when required by law, legal process or a valid request, or where reasonably necessary to prevent or investigate unlawful conduct or protect rights, property or safety.
  • Prospective or actual buyers, investors, lenders, successor entities and their professional advisers in connection with a legitimate business transaction or restructuring, subject to confidentiality and applicable legal requirements.

Where a service provider processes Personal Information on our behalf, we take reasonable steps appropriate to the circumstances to use providers subject to suitable contractual, confidentiality, security or data-protection obligations. Some recipients may instead act as independent controllers under applicable law and will be responsible for their own processing.

We seek to disclose only the Personal Information reasonably necessary for the relevant purpose. For example, a fulfilment or delivery partner ordinarily needs information required to prepare and deliver an order, but does not need unrestricted access to all information we hold about a customer.

9. Shopify, Checkout and Payment Providers

Our online store is hosted on Shopify. Shopify processes customer Personal Information to provide the e-commerce platform and related services to us. For many merchant services, Shopify acts as a processor or service provider on our behalf.

You can read Shopify's Consumer Privacy Policy at shopify.com/legal/privacy/consumers.

Payments are processed through the payment options made available at checkout. Payment providers may independently collect and process payment credentials, fraud signals, transaction data and other information needed to provide payment services and comply with their own legal obligations. Their own privacy notices may apply to that processing.

Comet Lore generally does not receive or store your complete payment-card credentials. We may receive transaction status, payment method, limited card or payment identifiers, payment-provider references and other information needed to manage an order, refund, dispute or chargeback.

10. International Processing and Overseas Disclosures

Comet Lore operates internationally. Your Personal Information may therefore be processed in, transferred to or disclosed to recipients located outside Australia and outside the European Economic Area (“EEA”).

Depending on the service involved, recipients or processing locations are likely to include Poland and other EEA countries, Australia, Canada, Singapore, the United States and China, as well as other countries in which our e-commerce, technology, payment, fulfilment, logistics, communications or professional-service providers operate. The countries involved may change as providers or infrastructure change, and we will update this Policy where required.

For example, limited recipient, order and delivery information may be disclosed to international suppliers, fulfilment providers, postal operators, couriers or logistics partners where necessary to prepare and deliver an order. Shopify and its affiliated entities and subprocessors also operate internationally.

Where the GDPR requires safeguards for an international transfer, the transfer will be made using a legally recognised mechanism where applicable, which may include an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, contractual and organisational safeguards, or another lawful mechanism available under data protection law.

Where the Australian Privacy Act and APP 8 apply to an overseas disclosure, we will take reasonable steps required by law in relation to the overseas recipient, subject to any applicable exceptions.

Foreign privacy and disclosure laws may differ from those in Australia or the EEA. You may contact us for further information about relevant international-transfer safeguards.

11. Fraud Prevention, Profiling and Automated Tools

We and our service providers may use automated tools to assist with fraud screening, transaction risk, cybersecurity, bot detection, product recommendations, personalisation, analytics and advertising measurement. These systems may use information such as transaction characteristics, device information, shopping activity, IP address, account or order history and other risk signals to produce scores, classifications or recommendations.

Automated tools may assist our staff or service providers, but Comet Lore does not ordinarily rely solely on automated processing to make decisions that produce legal or similarly significant effects on an individual. If we introduce processing that is subject to specific legal requirements concerning significant automated decisions, we will provide the additional information, rights and safeguards required by applicable law.

We may decline, hold, cancel or investigate a transaction where reasonably necessary to manage fraud, payment or security risk, subject to applicable law and our contractual rights.

12. How Long We Keep Personal Information

We retain Personal Information only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required or permitted by law.

Retention periods vary depending on the type of information and may take into account:

  • the duration of our customer or contractual relationship;
  • order fulfilment, returns, refunds, warranties and customer-service requirements;
  • tax, accounting, bookkeeping and regulatory record-keeping obligations;
  • payment disputes, chargeback windows, fraud prevention and security needs;
  • applicable limitation periods and the need to establish, exercise or defend legal claims;
  • consent and marketing preferences; and
  • legal holds, investigations or lawful requests.

When Personal Information is no longer reasonably required, we take appropriate steps to delete, anonymise or otherwise dispose of it, unless continued retention is required or permitted by law. Backup systems may retain information for a limited additional period before routine deletion or overwrite.

Where you unsubscribe from marketing, we may retain minimal suppression information for as long as necessary to ensure that your opt-out continues to be respected.

13. How We Protect Personal Information

We use reasonable technical, organisational and administrative measures appropriate to the nature of the information and our business to protect Personal Information against accidental or unlawful loss, misuse, interference, unauthorised access, alteration or disclosure.

Measures may include access controls, account security, encryption in transit where supported, use of reputable service providers, system and platform security features, data minimisation, authentication controls and internal procedures for handling customer information.

No method of transmission over the internet and no information-storage system can be guaranteed to be completely secure. Accordingly, while we take reasonable steps to protect Personal Information, we cannot guarantee absolute security.

If we become aware of a suspected data breach, we will investigate it and take reasonable steps to contain and remediate the incident. Where notification is legally required, we will notify affected individuals and/or relevant supervisory authorities in accordance with applicable law, including the Australian Notifiable Data Breaches scheme where it applies.

14. Your Privacy Rights

Depending on the law that applies to you and the processing concerned, you may have rights including:

  • to request access to Personal Information we hold about you;
  • to request correction of inaccurate or incomplete information;
  • to request deletion of Personal Information in circumstances where the law provides that right;
  • to request restriction of certain processing;
  • to receive certain Personal Information in a portable format and, where applicable, have it transmitted to another controller;
  • to object to processing based on legitimate interests in circumstances provided by law;
  • to object at any time to processing for direct marketing;
  • to withdraw consent where processing is based on consent;
  • to obtain information about certain international-transfer safeguards; and
  • where applicable, to rights relating to solely automated decisions that produce legal or similarly significant effects.

Privacy rights are not absolute. A request may be limited or refused where applicable law permits or requires this, including where information must be retained for tax, accounting, fraud-prevention, dispute-resolution or legal-claims purposes, or where disclosure would adversely affect the rights of another person. Where required, we will explain the basis for refusing or limiting a request.

Before acting on a request, we may take reasonable steps to verify your identity and authority. This is intended to prevent Personal Information from being disclosed or altered in response to a fraudulent request. We will request only information reasonably necessary for verification.

Where the GDPR applies, we will respond to valid rights requests within the time required by the GDPR, subject to any lawful extension. We generally do not charge a fee for exercising privacy rights, although a fee or refusal may be permitted for manifestly unfounded, excessive or repetitive requests in circumstances allowed by law.

To exercise a privacy right, email support.au@cometlore.com with the subject line Privacy Request.

15. Australian Privacy Rights and Anonymous Dealings

Where the Australian Privacy Act and APPs apply to us, you may request access to Personal Information we hold about you and request that inaccurate, out-of-date, incomplete, irrelevant or misleading Personal Information be corrected, subject to applicable exceptions.

Where practicable, you may interact with our website without identifying yourself, for example by browsing products without placing an order. However, anonymity or use of a pseudonym is not practicable where we reasonably need to identify you to process a purchase, deliver an order, verify payment, process a return or refund, respond to an account-specific enquiry, investigate fraud, or comply with law.

If you believe we have interfered with your privacy or breached an applicable Australian Privacy Principle, please contact us first using the complaint process in section 21. Where the Privacy Act applies and you are not satisfied with our response, you may be entitled to complain to the Office of the Australian Information Commissioner (“OAIC”).

16. Sensitive Information, Sizing Information and Product-Issue Photos

Because Comet Lore sells lingerie and sleepwear, we take particular care to avoid collecting unnecessary sensitive or intimate information.

Please do not send photographs or videos showing intimate body parts, nudity, or more of your body than is necessary to show a product issue. If you contact us about a faulty, damaged or incorrect item, photographs or videos should show the garment, packaging, label and/or defect only, wherever reasonably possible.

Our standard Returns Form is intended for ordinary change-of-mind returns and does not require product-issue photographs. Faulty, damaged, incorrect or materially not-as-described product issues should be reported by email in accordance with our Returns & Refunds Policy.

If you voluntarily provide body measurements, fit information or other sizing information when asking for assistance, we will use it only as reasonably necessary to respond to your request and for related customer-service purposes, unless another lawful basis applies. Please do not provide medical, health, sexual-life or other special-category information unless we specifically request it and there is a lawful need.

17. Children's Privacy

Our website and services are not directed to children under 16, and we do not knowingly seek to collect Personal Information from children under 16 for marketing purposes. If you believe that a child has provided Personal Information to us in circumstances where we should not hold it, please contact us so that we can assess and, where appropriate, delete or restrict the information.

18. Business Transfers, Incorporation and Restructuring

As a business develops, its ownership or legal structure may change. Subject to applicable law, Personal Information may be disclosed or transferred as part of a proposed or completed incorporation, financing, investment, merger, acquisition, sale of assets or business, internal reorganisation, transfer of the Comet Lore brand or operations, insolvency process or other legitimate corporate transaction.

Such disclosures may be made to prospective or actual purchasers, successor entities, investors, lenders and their professional advisers where reasonably necessary for evaluating or completing the transaction. We will take reasonable steps appropriate to the circumstances to protect confidentiality during the transaction and will provide any notice or obtain any consent required by applicable law.

If another entity becomes responsible for Comet Lore or becomes the controller of relevant Personal Information, this Policy may be updated to identify the new controller and explain any material change in processing.

Our website may contain links to third-party websites, apps, payment services or social-media platforms. We do not control the privacy practices of independent third parties. If you leave our website or interact directly with another service, review that party's privacy notice before providing Personal Information.

Links to third-party services do not mean that Comet Lore is responsible for the security, content or privacy practices of those services, except to the extent responsibility cannot lawfully be excluded.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, service providers, technology, business structure, information-handling practices or legal requirements.

The updated version will be published on this page. Where required by law, we will provide additional notice of material changes or obtain consent before applying a change to Personal Information already collected.

We encourage you to review this Policy periodically, particularly before providing new Personal Information.

21. Contact, Privacy Requests and Complaints

Data Controller / Business Operator
MIRAD Commerce & Operations Michał Radziński
Poland
Email: support.au@cometlore.com
Website: cometlore.com

For a privacy request, use the subject line Privacy Request. For a privacy complaint, use the subject line Privacy Complaint and describe the issue in sufficient detail for us to investigate it.

We will acknowledge and assess privacy complaints within a reasonable period, may request further information where necessary, and will provide a response after investigating the matter. We may keep appropriate records of the complaint and our response for compliance, dispute-resolution and legal purposes.

If the GDPR applies and you believe your data-protection rights have been infringed, you have the right to lodge a complaint with a competent supervisory authority. As our business is based in Poland, the relevant Polish supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO). Further information is available at uodo.gov.pl.

Where the Australian Privacy Act applies, you may also have the right to complain to the Office of the Australian Information Commissioner (OAIC) after giving us a reasonable opportunity to address your complaint. Further information is available at oaic.gov.au.