Privacy Policy

GC Kreative Privacy Policy

Last updated: 17 September 2026

1. Who we are

GC Kreative is the trading name of Gian Vincent Dungca, a sole trader (ABN 34 182 331 679). We make custom personalised products — carved, painted and clear-finish keys, AI-printed items and related add-ons — and sell them at gckreative.com.au, a store hosted on Shopify. In this policy, "we", "us" and "our" mean GC Kreative, and "you" means anyone who visits the store, places an order, or contacts us.

We respect your privacy and handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

This policy explains what personal information we collect, why we collect it, who we share it with, and how you can access, correct or complain about it. It covers our website, our order and production process, and our email, phone and social media communications with you. It does not cover third-party websites we link to — those have their own policies.

By using our store or placing an order, you agree to your personal information being handled as described here.

2. What personal information we collect

We collect only what we need to make your product, deliver it, and support you afterwards.

Category

What it includes

Identity and contact

Name, email address, phone number, and the name on the order

Delivery

Shipping address, billing address, delivery instructions, and your required-by date

Order

Products ordered, options and add-ons chosen, order value, order history, and correspondence about the order

Personalisation content

Names, ages, dates, messages, bible verses, nicknames and any text you ask us to carve or print; any photos, artwork, logos or reference images you send us; and any notes about the recipient

Payment

Payment method type and the last digits and expiry of your card. We do not see or store your full card number — payments are processed by our payment providers

Account

Login email and account preferences, if you create a store account

Marketing

Your email address and subscription status if you sign up for our emails, and which emails you open or click

Technical

IP address, device and browser type, pages viewed, referring site, and cookie identifiers

Other

Anything else you choose to tell us in a message, call, review or social media comment

Personalisation content deserves a specific note. Because our products carry names, dates and messages, the text and images you give us are often personal information about someone other than you — the recipient of the gift. When you send us that content, you confirm you're entitled to share it with us for the purpose of making the product.

We do not seek sensitive information — health, race, religious or political beliefs, sexual orientation or criminal record — and ask you not to send it. Where you choose an inscription with religious or personal meaning, we treat it purely as order content and use it only to make your product.

3. How we collect it

Most of what we hold comes straight from you.

Directly from you — when you place an order or set your required date, create an account, fill in our contact form, subscribe to our emails, send us artwork or personalisation details, message us by email, phone, SMS or social media, or leave a review.

Automatically as you browse — our store and its analytics and advertising tools set cookies and similar technologies that record your IP address, device, and how you move through the site. Section 7 covers this.

From third parties, occasionally — our payment providers confirm whether a payment succeeded; our couriers give us delivery status; and if someone else orders a product for you, we receive your delivery details from them.

Where it's lawful and practical, you can deal with us anonymously or under a pseudonym — for example, asking a general question about a product. We can't fulfil an order anonymously, since we need a name and address to deliver it.

4. Why we collect it and how we use it

We use your information to:

  • take, confirm and process your order, and take payment
  • produce your custom item to the names, dates, wording and artwork you supplied
  • check and schedule your required-by date, and tell you if we can't meet it
  • send proofs, mock-ups or production photos for your approval
  • deliver your order and let you track it
  • answer your questions and handle changes, remakes, refunds and warranty claims
  • keep records of orders, invoices and correspondence
  • detect and prevent fraud, chargebacks and misuse of the store
  • understand how the store is used, so we can improve products, pricing and the ordering flow
  • send you marketing about our products, if you've asked for it or we're otherwise allowed to (see section 8)
  • meet our obligations under Australian consumer, tax and other laws

We use your information only for these purposes, for a directly related purpose you'd reasonably expect, or where you've consented or the law requires it.

Showcasing finished work. We sometimes photograph completed pieces for our website and social media, and those pieces carry names and dates. We ask for your permission before publishing a photograph of your piece, and you can withdraw that permission at any time by contacting us.

Automated decision-making. Decisions that significantly affect you — whether we accept an order, what we charge, whether we can meet your required date, and how we resolve a complaint — are made by a person, not by an automated system. Our store platform and payment providers apply their own automated fraud and security checks to transactions; where one of those checks affects your order, you can ask us to review it. If we ever introduce automated decision-making of our own, we will update this policy and describe it here before we rely on it.

5. Who we share it with

We never sell your personal information. We share it only with the parties below, and only so much as they need.

Who

Why

What they receive

Our e-commerce platform and website host

Running the store, checkout, customer accounts and order records

Order, account and browsing data

Payment providers, card schemes and digital wallets

Taking and verifying payment, and processing refunds

Name, billing address, contact details, payment details

Delivery and courier partners

Delivering your order and resolving delivery problems

Name, delivery address, phone, email, parcel details

Production, printing and materials suppliers, where part of an order is made or finished outside our workshop

Producing or finishing your order

The personalisation content and artwork needed for that step

Email and messaging providers

Sending order updates and marketing

Name, email, phone, order history, engagement

Analytics and advertising providers

Measuring how the store is used and running our ads

Browsing behaviour, device and cookie identifiers, and hashed contact details where those services are configured to receive them

Apps and integrations installed on our store

The specific function each one performs, such as scheduling and order management

Only the data that app needs to work

Professional advisers — accountant, bookkeeper, lawyer, insurer

Running the business and meeting our legal obligations

Usually order and payment records

Government agencies, regulators and law enforcement

Where the law requires or authorises it, or to establish or defend a legal claim

Only what is required

We may also transfer your information to a buyer if we sell the business, and we require any recipient to keep handling it in line with this policy.

These providers change from time to time as we add or replace tools. If you want to know which providers we use at any given moment, email us and we will tell you.

6. Overseas disclosure

Some of the providers above store or process data outside Australia, so your information is likely to be handled overseas.

Our e-commerce platform, payment providers, email services, and analytics and advertising providers are largely based in the United States, Canada and other overseas countries, and their infrastructure may extend to the European Union, Singapore and elsewhere. We may also work with suppliers or contractors located outside Australia.

Before disclosing your information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles — principally by using established providers whose contracts include data protection terms. We can't guarantee that every overseas law gives the same protection as Australian law.

If you'd rather your information were not disclosed overseas, contact us — but be aware we may then be unable to process your order, since our store and checkout themselves run overseas.

7. Cookies, analytics and advertising

Cookies are small files stored on your device that let the store work and let us measure how it's used. We use four kinds:

  • Essential — keep you logged in, remember your cart and your required date, and secure the checkout. The store won't work without these.
  • Preference — remember choices such as your region or display settings.
  • Analytics — tell us which pages and products get attention, and where visitors come from.
  • Advertising — let us show ads to people who've visited the store, and measure whether those ads led to a sale.

You can block or delete cookies in your browser settings, and you can opt out of personalised Google advertising at adssettings.google.com and of participating networks at youronlinechoices.com.au. Blocking essential cookies will break parts of the store.

Where our store displays a cookie notice, the choice you make there is remembered and you can change it at any time through your browser settings or by clearing the cookies for our site.

Browser "Do Not Track" signals are not handled consistently across the web because no single standard exists for them. Where our platform or the privacy tools we use support a recognised signal such as Global Privacy Control, that signal is honoured.

8. Marketing, and how to stop it

We send marketing emails only to people who have subscribed, or who have bought from us and would reasonably expect to hear about similar products.

Every marketing email includes an unsubscribe link, and we action unsubscribes promptly. You can also email us at iamjiiyan@gmail.com and ask to be removed. We'll confirm when it's done and won't ask you to justify it.

Unsubscribing from marketing doesn't stop transactional messages — order confirmations, proof approvals, production updates and delivery notices — because those are part of fulfilling your order.

If you ever want to know how we got your details, ask and we'll tell you.

9. Security and how long we keep your information

Your information is held in our e-commerce platform, our email and messaging accounts, and our business records. We protect it with passwords and access controls, multi-factor authentication on the accounts that support it, encrypted connections across the website and checkout, device and account security on the equipment we use, and by limiting access to those who need it to do their work.

No system is completely secure, and we can't guarantee absolute security of information sent over the internet.

We keep:

  • order, payment and tax records for at least seven years, as Australian tax law requires
  • personalisation content and artwork for a limited period after delivery, so we can remake a piece or repeat an order, after which it is deleted
  • marketing contacts until you unsubscribe, plus a suppression record so we do not email you again by mistake
  • enquiries that do not become orders for a limited period, after which they are deleted

When we no longer need personal information and no law requires us to keep it, we destroy it or de-identify it.

If a data breach occurs that is likely to cause you serious harm, we will tell you and notify the Office of the Australian Information Commissioner, as required under the Notifiable Data Breaches scheme.

10. Your rights

You can ask us to:

  • give you access to the personal information we hold about you
  • correct anything inaccurate, out of date, incomplete or misleading
  • delete information we no longer need, subject to records we're legally required to keep
  • stop marketing to you
  • tell you what we've disclosed and to whom

Email iamjiiyan@gmail.com with enough detail for us to find your records — your name, order number if you have one, and what you're asking for. We may need to verify your identity first.

We'll respond within 30 days. Access and correction are free; if a request is unusually large we may charge a reasonable cost, and we'll tell you before we do.

If we refuse access or correction, we'll explain why in writing and how to complain.

If the information is about someone else — the recipient of a gift, say — we can generally only act on a request from that person, or from you where you supplied the information for their order.

11. Complaints

If you think we've mishandled your personal information, email iamjiiyan@gmail.com with "Privacy complaint" in the subject line and tell us what happened.

We'll acknowledge your complaint within 5 business days, investigate, and give you a written response within 30 days. If we need longer, we'll tell you why and when to expect an answer.

If you're not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner:

12. Children and young people

Our store is intended for adults. We don't knowingly collect personal information from anyone under 16, and we don't market to them.

Our products are frequently bought as 18th and 21st birthday gifts, so an order often contains the name and date of birth of a young person. That information comes from the buyer, is used only to make the item, and is held under the retention rules in section 9.

If you believe a child has given us personal information directly, contact us and we'll delete it.

13. Changes to this policy

We update this policy when our practices, tools or legal obligations change. The current version always sits at gckreative.com.au/policies/privacy-policy, with the date it took effect at the top.

If a change materially affects how we handle information we already hold about you, we'll tell you by email or a notice on the store before it takes effect.

14. Contact us

For anything in this policy — access, correction, marketing, or a complaint — contact:

GC Kreative Gian Vincent Dungca (ABN 34 182 331 679) Email: iamjiiyan@gmail.com Phone: 0435 622 533 Post: 7 Kerrawary Grove, Schofields NSW 2762

You can also use the form at gckreative.com.au/pages/contact, though email is faster for privacy requests.

Before you publish (not part of the policy)

Fill or cut

  • ABN, trading entity name and contact details — done
  • Decide whether to publish your home address, swap in a PO Box, or drop the postal line entirely
  • Check whether "GC Kreative" is registered as a business name with ASIC
  • Read section 5 and confirm nothing listed there is something you genuinely never do
  • Confirm the seven-year tax retention period suits your record-keeping
  • Verify the OAIC's current phone and postal details at oaic.gov.au — I used the long-standing ones, but confirm rather than trust them
  • Diarise a review if you add analytics, ads, an email platform or any AI tool that decides something about a customer

Where the law is unsettled

Does the Privacy Act bind GC Kreative today? Probably not, if turnover is under $3 million and none of the existing carve-outs apply. That exemption has stood since 2001. But sources disagree sharply about when it ends. Several recent Australian advisory sites state flatly that the small business exemption is removed on 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024. Others — including a compliance timeline from around June 2026 — list the removal as proposed only, with no confirmed date, pending the Tranche 2 reforms. I could not resolve this from secondary sources, and it matters to you directly. Check the OAIC's own site, or ask a lawyer, before relying on either version.

What is clearly legislated for 10 December 2026: new APP 1.7–1.9, requiring privacy policies to disclose automated decision-making where a computer program makes or substantially informs a decision significantly affecting someone; and the OAIC's Children's Online Privacy Code. That's why section 4 carries an ADM placeholder — leaving it unanswered is the most likely gap in this draft.

Overseas customers. If you ship to or advertise into the EU or UK, GDPR-style obligations can attach regardless of your size: a cookie consent banner, a lawful basis for each use, and data subject rights beyond what's above. This draft doesn't cover that.

Consumer law is separate. Your refunds, remakes and delivery terms sit under the Australian Consumer Law, not here. A custom-made item is not exempt from consumer guarantees just because it's personalised.

Sources consulted