Privacy policy

1. Who we are and how to contact us

Firefly Cove Pty Ltd (ABN 14 611 955 223), trading as Nordic Spa, runs this store. In this policy, "we", "us" and "our" mean Firefly Cove Pty Ltd. "You" means you, our customer or website visitor.

You can reach us here:

• Email: hello@nordicspa.com.au
• Phone: 03 6145 0600
• Post: 34 Levanswell Road, Moorabbin VIC 3189, Australia

We respect your privacy. We handle your personal information in line with the Australian Privacy Principles (the APPs). This is our commitment and our standard of good practice. This policy explains what we collect, why we collect it, who we share it with, and the choices you have.

2. Scope and our approach

This policy covers the personal information we collect when you visit our website, buy from us, set up an account, ask us a question, request a freight quote, or deal with us in any other way.

This policy forms part of our terms of sale. You can read our full terms in our Terms of service.

We only collect the information we need to sell and deliver our products and to run our business properly. We do not seek sensitive information or health information from you. If a suitability question ever calls for health information, we handle it as set out in section 15.

Where it is lawful and practicable, you can deal with us anonymously or using a pseudonym, for example when you make a general enquiry. For most purchases and deliveries we will need your real name and your contact and delivery details so we can supply and deliver your order.

3. The kinds of personal information we collect

Depending on how you deal with us, we may collect:

• Identity and contact details, such as your name, delivery and billing address, email address and phone number.
• Order and transaction details, such as the products you buy, order value, and your order history.
• Account details, if you create an account. Our ecommerce platform holds your login credentials. We do not hold or see your password.
• Freight and delivery details, such as your delivery address, site access notes, and any special instructions needed to deliver large items.
• Communications, such as your enquiries, messages, product reviews, and your marketing preferences.
• Device and usage data, such as your IP address, browser type, the pages you view, and how you move through our site.
• Cookie and tracking identifiers, as described in section 8.

Payment card details are handled by our payment provider under the PCI-DSS security standard. We do not store your full card number.

4. How we collect it

We collect personal information in three main ways.

Directly from you, when you place an order at checkout, create an account, fill in an enquiry or freight-quote form, leave a review, or contact us by phone or email.

Automatically, when you use our website. We and our providers use cookies, pixels and analytics tools to collect device and usage data, as described in section 8.

From third parties, such as our freight and delivery partners and our payment provider, when they pass us information needed to complete your order or delivery.

When we collect your information, we give you a short collection notice at that point so you know what is happening and why.

5. Why we collect, use and disclose it

We use your personal information to:

• Process your order, arrange freight, and deliver your products.
• Take payment and manage refunds through our payment provider.
• Provide customer service, handle warranty claims, and answer your questions.
• Set up and manage your account.
• Send you marketing messages where you have asked to receive them, as described in section 9.
• Understand how our site is used and improve our products, service and website.
• Meet our accounting, tax and other legal obligations.
• Help prevent fraud and keep our store and customers safe.

We only use your information for the purposes it was collected for, for a related purpose you would reasonably expect, or where you have given consent.

6. Who we share it with

We share personal information with trusted providers so we can run our business and deliver your order. We share it by category with:

• Our ecommerce platform provider, which hosts our online store.
• Our payment provider, which processes your payment.
• Our freight and delivery partners and couriers, which deliver your products.
• Our email and messaging provider, which sends our emails and SMS.
• Third-party analytics and advertising providers, as described in section 8.
• Our accounting provider, which supports our bookkeeping and tax obligations.

We may also disclose information where the law requires or allows it, for example to a court, regulator or law enforcement.

We do not sell your personal information.

7. Sending information overseas

Some of our providers are located overseas or process data overseas, including in the United States. Some may also store or process it in other countries where they, or their own providers, operate, which we cannot always specify. This means your personal information may be stored or handled outside Australia.

When this happens, we take reasonable steps to protect your information. This includes putting appropriate contracts in place and checking that our providers handle information properly. We remain accountable for how your information is handled and we choose our providers with that in mind.

8. Cookies, analytics and advertising

Cookies are small files stored on your device. They help our website work and help us understand how it is used.

We use two kinds of cookies:

• Essential cookies, which are needed for the site to function, for example to keep items in your cart and to keep you signed in. These always run.
• Non-essential cookies, which cover analytics and advertising. These run only after you consent through our cookie banner.

With your consent, our analytics and advertising providers may use cookies and pixels to measure how our site performs and to show you our ads on other websites and social media platforms. This is sometimes called retargeting, and it means you may see our products again after visiting our site.

You can control non-essential cookies at any time. You can change your choice in our cookie banner, adjust the cookie and privacy controls in your browser, and use the ad-preference tools offered by the advertising providers themselves. If you decline non-essential cookies, our website will still work.

9. Direct marketing and your choices

We send marketing emails and SMS only to people who have asked to receive them. This is express opt-in, which means you tick to subscribe. We do not add you to marketing lists without your consent.

Every marketing message includes an easy way to unsubscribe. When you unsubscribe, we act on your request within 5 business days, and we keep every unsubscribe option working for at least 30 days after the message is sent.

You can change your marketing preferences or opt out at any time by using the unsubscribe link, replying to stop an SMS, or contacting us at hello@nordicspa.com.au.

Any phone calls we make are about your order or enquiry, for example to confirm your order or request a missing detail, to arrange delivery, or because you have asked us to call or booked a time with us. We do not make unsolicited marketing calls.

10. How we keep your information secure

We take reasonable technical and organisational steps to protect your personal information from misuse, loss, and unauthorised access, use or disclosure. This includes limiting who can access information and relying on reputable providers.

No online service can promise perfect security, but we work to keep your information safe and to review our practices as our business grows.

We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires. As a guide:

• Order and financial records: about 7 years, to meet our tax and consumer-law record-keeping obligations.
• Account information: while your account is active, and for a reasonable period afterwards if it becomes inactive.
• Marketing information: until you unsubscribe, and for a short period after that so we can act on your request and keep a record of it.

When we no longer need your information, we take reasonable steps to destroy it or de-identify it.

11. Data breaches

We take data breaches seriously. If we suspect a breach involving personal information, we act promptly to assess what has happened and to contain it.

Where a breach is likely to cause serious harm, and where the law requires it or where we consider it the right thing to do, we will notify the Office of the Australian Information Commissioner (OAIC) and the individuals affected, and we will explain the steps you can take.

12. Accessing and correcting your information

You can ask to see the personal information we hold about you, and you can ask us to correct it if it is wrong or out of date. Just contact us at hello@nordicspa.com.au or by post at the address in section 1.

We will respond within a reasonable time. We do not charge you to correct your information.

If we cannot give you access or make a correction, we will let you know the reasons in writing. If we decline to correct your information, you can ask us to attach a statement to it saying you believe it is inaccurate. We will take reasonable steps to do so.

13. Automated decision-making

We are not aware of any tool we use that makes a fully automated decision with a significant effect on you. Where a tool helps us with a task such as fraud checks, we keep a person involved in any decision that affects you.

New transparency rules for automated decision-making commence on 10 December 2026. As a matter of good practice, we are getting ready for them now. If we ever introduce automated decision-making that could significantly affect you, we will update this policy first and explain how it works.

14. Children's privacy

Our store and products are intended for adults. Our Terms of service require customers to be at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has given us their personal information, please contact us and we will take reasonable steps to remove it.

15. Sensitive and health information

We do not seek sensitive information or health information from you, and we ask that you do not send it to us unless it is needed.

Sometimes a product suitability question may lead you to share health information, for example about a medical condition. If you choose to give us health information, we handle it only with your consent, we keep it to the minimum needed, we store it securely, and we do not use it for marketing without your consent.

16. How to make a privacy complaint

If you are concerned about how we have handled your personal information, please contact us first so we can put things right:

• Email: hello@nordicspa.com.au
• Post: 34 Levanswell Road, Moorabbin VIC 3189, Australia

We will acknowledge your complaint, look into it, and respond within a reasonable time.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

17. Changes to this policy and governing law

This policy was last updated on 9 September 2026.

We may update this policy from time to time. When we make an important change, we will post the new version on this page and update the date above. Please check back so you stay informed.

This policy is governed by the law of the State of Victoria, Australia.