XYX Holdings Pty Ltd (ACN 632 303 685, ABN 21 632 303 685), trading as "Oceania Smart Select" ("we", "us", "our"), respects your privacy. This Privacy Policy explains how we collect, use, store and disclose personal information when you visit oceaniasmartselect.com.au or contact us regarding our products. Our corporate site is xyxtrade.com.au.
We comply with the Australian Privacy Principles contained in the Privacy Act 1988 (Cth). For visitors from the EU/UK we apply the equivalent standards under the GDPR; for visitors from China we apply the principles of the Personal Information Protection Law (PIPL).
1. Information we collect
- Information you give us — when you contact us via email, the contact form, or partnership inquiries: your name, email, phone, company, and the content of your message.
- Orders — Stripe collects payment and delivery details at checkout. After payment, our private order and notification records retain necessary contact and delivery information, products, quantities, amounts, payment and delivery status, refund and invoice references, and a fixed copy of notification content. We use these records to fulfil orders, prevent duplicate notifications and audit delivery. Stripe handles card details; our site does not store them.
- Cart and checkout progress — necessary browser storage holds product identifiers, quantities and checkout references. Our order service records order snapshots and transaction references to avoid duplicate charges, plus short-lived security identifiers for request limits; those identifiers do not store your raw IP address. Cart storage is separate from optional analytics consent.
- Automatically collected — IP address (anonymised by Google Analytics), browser type, device type, pages viewed, time on site, referrer. Collected only after you grant analytics consent via our cookie banner.
- We do not collect — payment card data, government identification, biometric data, or sensitive information as defined under the Privacy Act.
2. How we use your information
- Respond to inquiries about our products, pricing, and partnership opportunities.
- Process orders, reconcile payments, arrange delivery, handle refunds and provide order support.
- Improve our website, content, and product range based on aggregate usage analytics.
- Comply with legal obligations (e.g. tax, customs, anti-money-laundering record-keeping).
We do not sell your personal information. We do not use it for advertising profiling.
3. Lawful basis (GDPR / PIPL)
- Consent — for analytics cookies (you can withdraw consent at any time).
- Legitimate interest — to respond to your business inquiries.
- Legal obligation — to retain transaction records as required by law.
4. Sharing of information
We share information only with:
- Service providers who help us run the site (Google Analytics for traffic measurement; Cloudflare for content delivery and security). These providers are bound by their own privacy commitments.
- Order providers — Stripe handles payments and checkout details, and Cloudflare supports our private order and notification records. If transaction notifications are enabled, Resend delivers them through our separate delivery service. Authorised operators and designated internal recipients may receive necessary contact and delivery information for fulfilment. Our private records retain the necessary details and a fixed copy of notification content; the separate central delivery ledger retains hashes, delivery status and other audit metadata, rather than message content or delivery addresses.
- Authorities when required by law (court order, tax authority, customs).
- Successors in the event of a merger or acquisition, with notice to you.
5. Cross-border data transfer
Some service providers (e.g. Google) process data outside Australia. We use providers that maintain adequate data-protection standards. For PIPL-regulated data we apply Standard Contractual Clauses where required.
6. Security
The site is served over HTTPS. Personal information in order records and inquiry messages is subject to our internal access controls. We retain transaction event identifiers and checksums for reconciliation rather than the full payment-provider event payload. Card details are processed by Stripe and are not stored by our site.
7. Retention
Inquiry records: up to 7 years (to comply with Australian record-keeping requirements). Analytics data: aggregated, retained for 14 months in Google Analytics 4 (the platform default; we do not increase this).
Order records are retained for fulfilment, payment reconciliation and customer support. The order service currently has no automatic scheduled deletion of these records. Contact us about access, correction or deletion requests; applicable record-keeping requirements may limit deletion.
8. Your rights
You have the right to:
- Access personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion (subject to legal retention obligations).
- Withdraw analytics consent — re-open the cookie banner by clearing your browser's site data, or email us.
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC), or the equivalent regulator in your country.
9. Children
Our site and services are aimed at trade and adult consumers. We do not knowingly collect information from anyone under 18.
10. Changes to this policy
We will post any changes on this page with an updated "Last updated" date. Material changes will be highlighted on our home page for 30 days.
11. Contact
Privacy enquiries: contact us. Write "Privacy enquiry" in the subject line. We respond within 30 days.
See also our Cookie Policy for details on cookies and similar technologies.
