Privacy Policy

Who we are

This site is operated by The Fine Food Commons Australia Pty Ltd, ABN 71 691 868 103, a company registered in Queensland, Australia. In this policy, "we", "us" and "our" mean that company.

Our postal address is Shop 8, 130 Scarborough Street, Southport QLD 4215 and you can reach us about anything in this policy at commons@thefinefood.com.

This policy applies to this online store and to the emails we send you. It takes effect on 6 August 2026.

What we collect

We only collect what we need to take an order, get it to you, and answer you when you write to us.

• Contact details. Your name, email address and phone number.
• Delivery details. The delivery address, the recipient's name if it is not you, and any delivery instructions you give us.
• Order details. What you bought, what you paid, the currency, the order number and the delivery status.
• Payment details. Your card or wallet details are entered into our payment provider's systems, not ours. We never see or store your full card number. We receive only a confirmation that payment succeeded, the card type and the last four digits. Our checkout uses Shopify Payments and PayPal, with Apple Pay and Google Pay.
• The Korean Personal Customs Clearance Code. If your order is going to South Korea, we ask for the recipient's Personal Customs Clearance Code, a government-issued code in the form P followed by twelve digits. It is entered in the cart before checkout. This is a government identifier, so we treat it separately and carefully. There is a section on it below.
• Device and usage data. When you browse the site we collect your IP address, browser and device type, the pages you view, how you arrived at the site, and similar technical information, through cookies and similar technologies.
• Communications. Emails, contact form messages and any other correspondence you send us, and our replies.
• Account details. If you create an account, your login email and your saved addresses and order history.

We do not ask for health information, and you should not send us any. Our products are foods, and we do not collect or want details of your medical history or condition.

How we use it

• To take, process, pack and ship your order, and to give you the tracking details.
• To lodge the customs paperwork your parcel needs to enter your country, and any export paperwork Australian law requires for that order.
• To take payment, issue receipts and invoices, and process refunds and returns.
• To answer your questions and handle complaints and warranty or consumer guarantee claims.
• To keep the accounting, tax and trade records Australian law requires us to keep.
• To detect and prevent fraud and abuse of the site.
• To send you marketing email, but only if you asked us to, and you can stop it at any time.
• To understand how the site is used so we can improve it.

We do not sell your personal information, and we do not rent or trade contact lists.

Cookies, analytics and advertising

Cookies are small files a website stores on your device. We use them in three ways.

• Essential cookies. These keep your cart, your session and the checkout working. The site cannot function without them.
• Analytics cookies. These tell us how many people visited, which pages they looked at and where they came from. We use this in aggregate, to improve the site.
• Advertising and marketing cookies. These can be used to measure whether an ad or an email led to a visit or a sale, and to show you ads elsewhere.

The analytics, advertising and marketing tools currently running on this site are Google Analytics and Meta Pixel, and nothing else. Cookie choices on this site are handled as follows: we use Shopify's built-in privacy banner, and it is shown in all four markets.

You can block or delete cookies in your browser settings. If you block essential cookies, the cart and checkout will not work.

Who we share it with

We share your information only with the parties below, and only with the part of it they need.

• Customs and border authorities in the destination country. This is the largest disclosure we make, and it is unavoidable for an international parcel. Every parcel we send overseas carries a customs declaration with the recipient's name, full delivery address, phone number, a description of the goods, the quantity and the declared value. That declaration is lodged electronically with the customs authority of the destination country, and for South Korea it also carries the Personal Customs Clearance Code. The authorities involved are the Korea Customs Service, the Customs Administration of Taiwan, and Singapore Customs, depending on where the parcel is going. Where an order is large enough to require an Australian export declaration, that declaration goes to the Australian Border Force. Most of our orders are below the threshold at which an export declaration is required, and no declaration is lodged for them.
• Carriers. Australia Post carries our parcels to Singapore and Taiwan, and our contracted courier service carries our parcels to South Korea. Whichever carrier takes your parcel is the party that lodges the customs declaration with the destination authority on our behalf, and then hands the parcel to the postal or delivery operator in your country, which needs your name, address and phone number to deliver it and may contact you about duties or customs clearance.
• Our online store platform. Shopify hosts this store and processes orders, customer records and store analytics for us.
• Payment providers. They receive your payment details directly and confirm the payment to us.
• Order and marketing email. Your order confirmations, shipping notices and any marketing email you have asked for are sent by Shopify, our store platform. We do not use a separate email or marketing platform.
• Our accountant and professional advisers, where they need order or transaction records to do their work.
• Government agencies, regulators, courts or police, where the law requires it or where it is necessary to establish or defend a legal claim.
• A buyer of the business, if the business or its assets are ever sold, in which case customer records would transfer with it.

Overseas disclosure

We are an Australian business, but your information does go overseas. The countries involved are:

• Australia, where we and our carrier are based.
• The countries in which our store platform stores and processes data. Shopify hosts this store on servers outside Australia, and publishes a current list of the providers it uses to do so.
• South Korea, Singapore and Taiwan, where the customs authority and the local delivery operator receive the parcel data described above. If your order is going to one of those places, your details will be disclosed to its authorities as a condition of importing the goods.

Once your information is with a foreign customs authority, it is handled under that country's law, not Australian law, and we cannot control or retrieve it.

Security

The site runs over an encrypted connection (HTTPS). Payment card data is handled by payment providers on PCI DSS certified systems and never reaches our own records. Access to the store's admin, where customer and order records live, is limited to the small number of people who need it to run the business, and access is removed when someone no longer needs it.

No system is completely secure. If a data breach happens that is likely to cause you serious harm, we will tell you as soon as we reasonably can, we will tell you what was involved and what to do about it, and we will notify the Office of the Australian Information Commissioner as well where the notifiable data breaches scheme applies to us.

How long we keep it

• Order, invoice, payment and refund records: seven years from the end of the financial year the order falls in, because the Corporations Act 2001 requires a company to keep its financial records for seven years.
• Export declarations, where one is required: five years from the date of export, in line with Australian customs record keeping.
• The Korean Personal Customs Clearance Code: twelve months from the date of the order. We will not use the code for any purpose other than clearing your parcel.
• Customer accounts: until you ask us to delete the account, or three years from your last order, whichever comes first.
• Emails and support messages: two years from your last message, unless they relate to a dispute or a claim, in which case we keep them until it is finished.
• Marketing subscribers: until you unsubscribe. After you unsubscribe we keep a minimal record of your email address on a suppression list, so that we do not email you again by mistake.
• Abandoned checkouts: Shopify removes these automatically at about three months.
• Website analytics: kept in aggregate. Individual visit records are retained for the period set by the analytics tools listed above.

Access, correction and deletion

You can ask us to:

• tell you what personal information we hold about you, and give you a copy of it;
• correct anything that is wrong or out of date;
• delete your information; or
• stop sending you marketing.

Email us at commons@thefinefood.com and we will respond within 30 days. There is no charge. We may ask you a question or two to confirm you are who you say you are, so that we do not hand your details to someone else.

Two limits apply to deletion. We cannot delete records the law requires us to keep, such as the order and tax records described above, so we will keep those to the end of their retention period and delete everything else. And we cannot recall information that has already been lodged with a foreign customs authority.

You can unsubscribe from marketing email using the link at the bottom of any marketing email. We will still send you emails about an order you have placed, because those are not marketing.

Australian customers, and our status under the Privacy Act

We want to be straight with you about this rather than claim more than we can support.

The Privacy Act 1988 (Cth) generally applies to organisations with an annual turnover of more than three million dollars. We are a new business below that threshold, which means the Act and the Australian Privacy Principles do not automatically apply to us, and the Office of the Australian Information Commissioner generally cannot investigate a complaint about a business in that position. A small business can choose to opt in and be treated as covered.

Our position is: we rely on the small business exemption, and we have not opted in under section 6EA of the Act.

Even so, the commitments in this policy are commitments we make to you directly. We will follow them, and you can hold us to them. If our turnover grows past the threshold, or if we opt in, the Act will apply to us and we will update this policy to say so.

South Korean customers, and the customs code

If you are having an order delivered in South Korea, we ask for the recipient's Personal Customs Clearance Code, which looks like the letter P followed by twelve digits. This is what happens to it.

• Why it is required. Korean law requires a personal customs clearance code for goods imported for personal use. Without it, the parcel cannot be cleared and will be held, returned or destroyed. We collect it in the cart so that it travels with the parcel from the start.
• Who it goes to. It is stored in our Shopify store record for your order, it is passed to our contracted courier service, which includes it in the electronic customs declaration lodged with the Korea Customs Service, and it reaches the Korean delivery operator handling the final leg. It goes nowhere else, and it is never used for marketing or shared with any advertiser or partner.
• What it is not used for. We do not use it to identify you, to build a profile, for marketing, for fraud checks or for anything at all except clearing your parcel.
• How long we keep it. See the retention section above.
• Getting it right. Please enter the code that belongs to the person named as the recipient. The code, the recipient's name and the phone number must match Korean customs records or the parcel will stall. If you need to correct it after ordering, email us and we will change it before dispatch.
• Do not use a purchase agent or forwarding service. Ordering through a forwarder changes the import from a personal one to something else, and the code will not do its job.

The commitments in this policy apply to you wherever you are, and nothing in it takes away any right you have under the law of your own country.

Taiwanese customers

Parcels arriving in Taiwan are subject to real-name verification. The consignee's name we print on the parcel must match the name on the recipient's Taiwanese identity document, and the recipient confirms the parcel themselves in the EZ WAY app or through the customs broker.

We never ask for and never store your Taiwanese national identity number. That verification happens directly between you and the Taiwanese authorities. All we pass on is the name, address and phone number you gave us, in the customs declaration.

The commitments in this policy apply to you wherever you are, and nothing in it takes away any right you have under the law of your own country.

Singaporean customers

Singapore orders are posted from Australia, so your details are handled the same way as for our other international orders: they go to Australia Post and to Singapore customs for the import declaration. If your order is shipped from Australia, your name, address and phone number are included in the customs declaration lodged with Singapore Customs, and the local delivery operator receives them to make the delivery.

The commitments in this policy apply to you wherever you are, and nothing in it takes away any right you have under the law of your own country.

Children

This store is intended for adults. We do not knowingly collect personal information from children. If you believe a child has given us their details, email us and we will delete them.

Complaints and escalation

If you think we have mishandled your personal information, email us at commons@thefinefood.com with the word "Privacy" in the subject line. Tell us what happened and what you would like us to do. We will acknowledge your complaint promptly and give you a decision within 30 days.

If you are not happy with our answer, you can ask us to escalate it to a director, who will review it independently of whoever handled it first.

Beyond that, your options depend on where you are. Because we rely on the small business exemption, as set out in the Australian section above, the Office of the Australian Information Commissioner generally cannot take a complaint about us, and we tell you that plainly rather than send you on a pointless errand. You may also have rights with the consumer or data protection authority in your own country, and nothing in this policy takes those away.

Changes to this policy

We may update this policy as the business changes. The version on this page is always the current one, and the effective date is shown at the top. If we make a change that materially affects how we handle information we already hold about you, we will email customers who have ordered from us before the change takes effect. Continuing to use the site after a change means the updated policy applies to your future orders.

Contact

The Fine Food Commons Australia Pty Ltd, ABN 71 691 868 103. Email commons@thefinefood.com. Postal address Shop 8, 130 Scarborough Street, Southport QLD 4215.