Privacy policy

Last updated: 4 September 2026

This Privacy Policy explains how Karon Farm Coffee collects, uses, stores, discloses and protects your personal information when you visit karonfarmcoffee.com.au (the “Site”), buy from us online, order from us as a wholesale customer, or contact us.

Karon Farm Coffee is a specialty coffee roastery operating from Shed 5, 10 Builders Close, Wendouree, Victoria 3355, Australia (ABN 99 644 874 000). We are the entity responsible for the personal information described in this policy. We handle personal information in line with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

If you have any question about this policy, email us at hello@karonfarmcoffee.com.au.

1. The personal information we collect

Information you give us when you order
When you place or attempt to place an order through the Site, we collect your name, email address, phone number, billing address, shipping address, the products and quantities you ordered, any delivery instructions or gift message you write, and your order history with us. We call this Order Information.

Payment information
Payments on the Site are processed by Shopify Payments, and we also accept PayPal, Shop Pay, Apple Pay and Google Pay. Card numbers are entered directly into the payment provider’s systems and are encrypted in transit. Karon Farm Coffee does not see, receive or store your full card number. We receive only a record that the payment succeeded, the card type, the last four digits, and the billing name and address.

Account information
If you create a customer account, we store your email address, an encrypted password, your saved addresses and your order history so you can check out faster next time.

Subscription information
If you take out a coffee subscription, we store your chosen coffee, grind, size, delivery frequency, next delivery date, and the payment token your payment provider gives us so we can charge each recurring order. Subscriptions are managed for us by Appstle Subscriptions. Again, we do not store your card number.

Marketing information
If you subscribe to our emails or SMS, or opt in at checkout, we store your email address, phone number if you gave one, your name, the date and source of your consent, and a record of which emails you opened and clicked. This lets us send you relevant coffee news rather than the same message to everybody.

Wholesale and trade information
If you are a cafe, restaurant, retailer or other business customer, we collect your business name, ABN, trading address, delivery address, contact names, phone numbers and email addresses, your order and payment history, and where relevant the equipment installed at your site and its service history.

Booking information
If you book something with us through the Site, such as a tasting or a session at the roastery, we collect your name, email address, phone number and the date and time you booked.

Enquiry and support information
If you email us, call us, message us on social media or fill in a form on the Site, we keep a record of that correspondence and anything you tell us in it, so we can answer you and refer back to it if you contact us again.

Information collected automatically
When you visit the Site we automatically collect information about your device and how you use the Site, including your IP address, browser type and version, operating system, device type, screen size, time zone, referring website or search term, the pages and products you viewed, how long you spent on them, what you added to cart, and the date and time of your visit. We call this Device Information.

We do not buy marketing lists, and we do not collect sensitive information such as health, racial or ethnic origin, religious or political views, or membership of any organisation.

2. Cookies and tracking technologies

We use the following technologies on the Site:

  • Cookies are small data files placed on your device. We use essential cookies that make the Site work (keeping you signed in, remembering the contents of your cart, and securing checkout), analytics cookies that tell us how the Site is being used, and advertising cookies that let us measure and target our advertising. You can block or delete cookies through your browser settings, but the Site will not work properly without the essential ones. Guidance on managing cookies is available at allaboutcookies.org.
  • Log files record activity on the Site, including your IP address, browser type, internet service provider, referring and exit pages, and date and time stamps.
  • Web beacons, tags and pixels are small electronic files that record how you browse the Site and whether you opened an email from us. The advertising and analytics pixels we run are listed in section 4.
  • Local storage is used by our website platform and apps to hold information in your browser, such as your cart, your recently viewed products and your cookie preferences.
  • Session recording through Microsoft Clarity, which records how you move through the Site, including mouse movement, scrolling, clicks and taps, so we can see where the Site is confusing or broken. Clarity masks text you type into form fields, and we do not use it to identify individual people.

3. How we use your personal information

We use Order Information to:

  • roast, pack, ship and deliver your order, and arrange local delivery or courier where relevant;
  • take payment and issue receipts, invoices, order confirmations and shipping notifications;
  • manage subscriptions, including scheduling and charging recurring deliveries;
  • answer your questions and handle returns, refunds and problems with an order;
  • screen orders for fraud and payment risk;
  • invite you to leave a review after your order has been delivered;
  • keep the financial and tax records we are required by Australian law to keep; and
  • where you have opted in, send you marketing about our coffee, subscriptions and events.

We use Device Information to:

  • keep the Site secure and screen for fraudulent activity;
  • understand how customers find and use the Site so we can improve it, for example by seeing which pages lose people at checkout;
  • measure whether our advertising and email campaigns are working; and
  • show you advertising for our products on other websites and platforms, including reminding you about a cart you did not finish. This is described in section 5.

4. Who we share your personal information with

We do not sell your personal information. We share it with the following service providers, only to the extent they need it to do their job for us:

  • Shopify Inc. hosts our online store and processes orders and payments through Shopify Payments. Shopify privacy policy
  • PayPal, where you choose to pay by PayPal. PayPal privacy policy
  • Appstle Subscriptions manages our coffee subscriptions, including your delivery schedule, subscription preferences and recurring billing tokens. Appstle privacy policy
  • Klaviyo sends and measures our marketing emails and SMS and stores the associated contact and engagement data. Klaviyo privacy policy
  • Google, for Google Analytics (site usage measurement) and Google Ads (advertising and conversion measurement). Google privacy policy. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
  • Meta Platforms (Facebook and Instagram), for advertising, audience building and conversion measurement via the Meta pixel and Conversions API. Meta privacy policy
  • Microsoft, for advertising and conversion measurement via the Microsoft UET tag and product listings in the Microsoft Merchant Center, and for Microsoft Clarity, which records how visitors use the Site. Microsoft privacy statement
  • Australia Post and Aramex, who receive your name, delivery address, phone number and email so they can deliver your order and send you tracking updates.
  • Shippit and SellerDash, which we use to create shipping labels and tracking. They receive your name, delivery address, phone number and email. Shippit privacy policy
  • EasyRoutes, which plans our local delivery runs and receives the name, address and phone number of local delivery orders. EasyRoutes privacy policy
  • Cowlendar, which handles bookings made through the Site and receives the name, email and phone number you enter when you book.
  • Google Reviews and Reputon Reviews, which send review invitations after an order and receive your name, email address and what you bought.
  • Xero, our accounting system, which receives order and invoice data for bookkeeping and tax compliance, and our accountants, who work in it. Xero privacy policy

We may also disclose your personal information where we are required or permitted to do so by law, including responding to a subpoena, court order, or lawful request from a government agency or regulator, and where necessary to establish or defend a legal claim or protect the safety of any person.

If our business or part of it is sold or transferred, customer information may be transferred with it. If that happens, the information stays subject to a policy no less protective than this one.

5. Advertising and how to opt out

We advertise our coffee on Meta, Google and Microsoft platforms. To do that we use the pixels and tags listed above, and we share hashed (scrambled) versions of email addresses with those platforms so they can match customers to accounts, show relevant ads, exclude people who have already bought, and tell us which ads led to sales. We do not share your name, address or order contents for advertising purposes.

You can opt out of personalised advertising here:

Opting out of personalised advertising does not stop you seeing our ads. It stops them being targeted using your data.

You can unsubscribe from our marketing emails at any time using the unsubscribe link at the bottom of every email, or by replying to any email from us and asking. For SMS, reply STOP. Unsubscribing from marketing does not stop transactional messages about an order you have placed.

6. Do Not Track

Our Site does not currently change its data collection practices in response to a Do Not Track signal from your browser. You can control tracking using the browser and opt out settings described above.

7. Storage, security and overseas disclosure

Your personal information is stored on servers operated by the service providers listed in section 4. Several of them, including Shopify, Klaviyo, Google, Meta and Microsoft, store and process data outside Australia, including in the United States, Canada and the European Union. By providing your personal information to us, you consent to it being disclosed to and stored by those providers overseas. We take reasonable steps to use reputable providers who are contractually required to protect your information.

We protect your information using encrypted connections (HTTPS) across the Site and checkout, access controls that limit staff access to what each person needs to do their job, and multi factor authentication on our core systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take the protection of your information seriously and will notify you and the Office of the Australian Information Commissioner if an eligible data breach occurs, as required by the Privacy Act 1988 (Cth).

8. How long we keep your information

  • Order and payment records: at least five years from the date of the transaction, as required by Australian tax law.
  • Customer account and subscription records: for as long as your account or subscription is active, and then in line with the record keeping period above.
  • Marketing contact records: until you unsubscribe. After you unsubscribe we keep a minimal suppression record (your email address and the fact you unsubscribed) so we do not accidentally email you again.
  • Wholesale account records: for the life of the trading relationship and then in line with the record keeping period above.
  • Enquiry and support correspondence: up to two years, unless it relates to an order or a dispute, in which case it is kept with the order records.
  • Website analytics and advertising data: in line with the retention settings of the platforms listed in section 4, generally between 14 months and 26 months.

When we no longer need your personal information and are not required to keep it by law, we delete it or de-identify it.

9. Your rights

You can ask us to:

  • tell you what personal information we hold about you and give you a copy of it;
  • correct anything that is wrong or out of date;
  • delete your personal information, subject to records we are legally required to keep;
  • stop sending you marketing; or
  • stop using your information for personalised advertising.

Email hello@karonfarmcoffee.com.au with your request and the email address or order number you used, so we can find you. We will respond within 30 days. We do not charge for these requests. We may need to confirm your identity before we release or delete information, to make sure we are not handing your details to somebody else.

10. Complaints

If you think we have mishandled your personal information, email hello@karonfarmcoffee.com.au and we will investigate and respond within 30 days. If you are not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au or by phoning 1300 363 992.

11. Children

The Site sells coffee and coffee equipment and is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

12. Changes to this policy

We may update this policy to reflect changes to our practices or for legal or operational reasons. The date at the top of this page shows when it was last updated. If we make a material change to how we handle your personal information, we will let customers know by email.

13. Contact us

Karon Farm Coffee
ABN 99 644 874 000
Shed 5, 10 Builders Close, Wendouree, Victoria 3355, Australia
Email: hello@karonfarmcoffee.com.au
Phone: 0493 431 705