Privacy policy

Last updated: 13 October 2026

Savannah And Three (“Savannah And Three”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, hold, use and disclose your personal information when you visit savannahandthree.com.au (the “Site”), buy from us, subscribe to our emails, follow or message us on social media, or otherwise deal with us (together, the “Services”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), and, where they apply to you, overseas privacy laws such as the EU and UK General Data Protection Regulation (GDPR) and United States state privacy laws. By using the Services, you acknowledge that your personal information will be handled as described in this Privacy Policy.

1. Who we are and how to contact us

Savannah And Three is an Australian online retailer based in Queensland. If you have any questions about this Privacy Policy or how we handle your personal information, please contact our Privacy Officer:

• Email: hello@savannahandthree.com.au
• Post: Privacy Officer, Savannah And Three, 34 Duranbah Circuit, Blacks Beach QLD 4740, Australia

2. What personal information we collect

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. The kinds of personal information we collect depend on how you interact with us, and may include:

• Contact details – your name, email address, phone number, and billing and delivery addresses.
• Order and transaction information – products you buy, order history, payment confirmation, delivery details, returns, exchanges and gift messages. We do not see or store your full card details; payments are handled by our payment providers.
• Account information – login details, preferences and saved addresses if you create an account.
• Communications – the content of emails, contact forms, social media messages, reviews, survey responses and other messages you send us, including any information you choose to share about your child (for example a name for a personalised or gift item, or a due date).
• Marketing information – your subscription status, marketing preferences, and whether you open or click on our emails.
• Device and usage information – IP address, approximate location (derived from your IP address), browser and device type, operating system, referring website, pages viewed, products viewed or added to cart, search terms, time spent on pages, and interactions with our advertisements.
• Advertising and analytics identifiers – cookie identifiers, advertising IDs, click identifiers (such as Google click IDs) and similar online identifiers.
• Social media information – if you interact with us on Instagram, Facebook or other platforms, your public profile name, handle, profile picture and the content you share with or tag us in.
• Wholesale and stockist information – if you are a business customer or stockist, your business name, ABN, contact person and trading details.

We do not intentionally collect sensitive information (such as health information, racial or ethnic origin, religious beliefs or sexual orientation). Please do not send us sensitive information. If you do, we will only hold it with your consent and where reasonably necessary, or we will de-identify or destroy it.

3. How we collect personal information

We collect personal information:

• directly from you – when you place an order, create an account, subscribe to our mailing list or a pop-up offer, enter a competition, contact us, leave a review or apply to be a stockist;
• automatically – through cookies, pixels, tags, scripts and similar technologies when you use the Site, open our emails or interact with our ads (see section 8); and
• from third parties – including Shopify and Shop, payment and buy-now-pay-later providers, delivery partners, advertising and analytics providers (such as Google and Meta), social media platforms and marketplace or stockist partners.

If we receive personal information we did not ask for, we will decide whether we could have lawfully collected it. If not, we will destroy or de-identify it where lawful and reasonable to do so.

Where practicable, you may deal with us anonymously or using a pseudonym (for example, when browsing or asking a general question). However, we need your name, contact and delivery details to process and deliver an order.

4. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information to:

• process, fulfil and deliver your orders, handle payments, returns, exchanges, warranty claims and refunds;
• create and manage your account;
• respond to your enquiries and provide customer service;
• send you order confirmations, shipping updates and other service messages;
• send you marketing communications, offers and newsletters where you have consented or where otherwise permitted by law;
• show you relevant advertising on our Site and on third-party websites, apps and social media platforms (including remarketing), and measure how effective our advertising is;
• analyse how the Site and our marketing are used so we can improve our products, content, website performance and customer experience;
• create website content, product information, marketing material and business insights, including with the help of artificial intelligence tools (see section 6);
• run competitions, giveaways, surveys and reviews;
• detect, prevent and investigate fraud, security incidents, misuse and unlawful activity;
• manage our business, including accounting, record keeping, audits, insurance and legal advice; and
• comply with our legal obligations and enforce our terms and rights.

We may also use or disclose your personal information for related purposes you would reasonably expect, with your consent, or where required or authorised by law.

5. Who we share personal information with

We do not sell your personal information for money. We may disclose personal information to the following kinds of third parties, who help us run our business or provide services to us:

• E-commerce platform and hosting – Shopify (our online store platform), Shop and related Shopify services.
• Payment and buy-now-pay-later providers – such as Shopify Payments, PayPal, Afterpay, Zip, Apple Pay and Google Pay, which process payments and may carry out their own identity and fraud checks.
• Delivery and logistics providers – such as Australia Post, couriers and fulfilment partners.
• Advertising, marketing and analytics providers – including Google (Google Ads, Google Analytics, Google Merchant Center, YouTube), Meta (Facebook and Instagram) and other social media and advertising platforms, email and SMS marketing providers, and review platforms.
• Artificial intelligence and technology service providers – including Anthropic (Claude), Google (Gemini) and other AI, software, cloud storage, IT, website and app providers (see section 6).
• Professional advisers and contractors – including our marketing agency, website developers, bookkeepers, accountants, insurers and lawyers.
• Government and law enforcement – where required or authorised by law.
• A purchaser or successor – if we sell, merge or restructure all or part of our business, personal information may be transferred as part of that transaction.

We take reasonable steps to ensure our service providers handle personal information securely and only for the purposes for which it was provided. Third-party platforms such as Google, Meta, Shopify and PayPal also handle personal information under their own privacy policies.

6. Our use of artificial intelligence (AI)

We use artificial intelligence and machine learning tools to help run our business more efficiently. These include large language model services such as Claude by Anthropic, Google’s AI services (including Gemini and the automated features built into Google Ads and Google Analytics), AI features built into Shopify and our other software, and similar tools from other reputable providers.

How we use AI

We may use AI tools to:

• help draft, summarise, translate or categorise customer enquiries, emails, reviews and responses (a member of our team remains responsible for what we send you);
• write and improve product descriptions, website content, emails, social media posts and advertising copy, and generate or edit images;
• analyse sales, website, customer and advertising data (generally in aggregated or de-identified form) to understand trends, plan stock and improve our marketing;
• build and optimise advertising campaigns and audiences, including through Google Ads automated bidding, Performance Max and similar automated advertising features;
• personalise product recommendations, content and offers on our Site and in our marketing;
• help detect fraud, spam and security threats; and
• assist with internal administration, reporting and software development.

What information may be processed by AI

Depending on the task, information processed by AI tools may include your name, contact details, order and purchase history, the content of your messages, reviews and survey responses, and website, device and advertising interaction data. We aim to limit the personal information we put into AI tools to what is reasonably necessary for the task, and where practicable we remove or de-identify personal details first. We do not knowingly input sensitive information or payment card details into AI tools.

How AI providers handle your information

Where we use AI tools, information is sent to and processed by the relevant provider, which may be located overseas (including in the United States). Where available, we use business or commercial versions of these services, whose terms generally restrict the provider from using our business data to train their AI models and require them to keep that data secure. AI providers handle data in accordance with their own terms and privacy policies, for example Anthropic’s privacy policy at anthropic.com/legal/privacy and Google’s privacy policy at policies.google.com/privacy.

Accuracy and human oversight

AI-generated content can contain errors. We review AI-assisted content and decisions that affect you, and you can contact us at any time if you think something is wrong. If we introduce an AI chat assistant on our Site, we will make it clear that you are interacting with an automated tool, and you can always ask to speak with a person.

7. Automated decision-making

We do not use computer programs to make decisions that, on their own, significantly affect your rights or interests without human involvement, other than as described here:

• Fraud and payment screening – Shopify, our payment providers and buy-now-pay-later providers use automated systems that analyse order, payment, device and location information to assess fraud risk and decide whether a payment or credit application is approved. These may result in a payment being declined or an order being flagged for review or cancelled. Buy-now-pay-later providers make their own credit and eligibility decisions under their own terms.
• Advertising and personalisation – advertising platforms such as Google and Meta, and the tools we use, automatically decide which ads, offers, prices shown in ads or product recommendations you see, based on your browsing, purchase and interaction data. These do not affect your ability to buy from us at the prices on our Site.
• Discount and promotion eligibility – our systems may automatically decide whether a discount code, offer or free shipping applies based on your order details, account or subscription status.

If you have concerns about an automated outcome, please contact us and a member of our team will review it.

8. Cookies, tracking technologies and advertising

We and our partners use cookies, pixels, tags, software development kits, local storage and similar technologies (“Cookies”) to operate the Site (for example, to keep items in your cart), remember your preferences, understand how people use the Site, measure the performance of our marketing and show you relevant advertising. For information about the Cookies used to power our Shopify store, see shopify.com/legal/cookies.

Google Ads and Google Analytics

We use Google Analytics and Google Ads, including conversion tracking, remarketing and audience features. This means:

• Google and other third-party vendors use Cookies to show you our ads on websites and apps across the internet (including Google Search, YouTube, Gmail and the Google Display Network) based on your previous visits to our Site and other websites;
• we use Google Analytics, including Google Signals and demographic and interest reporting where enabled, to understand how visitors use the Site;
• we may use Google’s enhanced conversions and Customer Match features, which involve sharing information such as your email address, phone number or address with Google in a hashed (encoded) form so Google can measure ad effectiveness and show relevant ads; and
• we may use Google Consent Mode, so Google’s tags adjust their behaviour based on your consent choices where consent is required.

You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can opt out of personalised Google advertising through My Ad Center, and opt out of Google Analytics using the Google Analytics opt-out browser add-on.

Meta (Facebook and Instagram) and other platforms

We may use the Meta Pixel and Conversions API, and similar tools from other social media and advertising platforms, to measure our ads and show you relevant ads on those platforms. You can manage your ad preferences in your Facebook and Instagram settings. You can also opt out of interest-based advertising from many providers at youradchoices.com or youronlinechoices.eu.

Managing Cookies

You can set your browser to block or delete Cookies, and where a cookie banner is shown you can manage your choices there. Blocking some Cookies may affect how the Site works (for example, your cart may not be saved). Our Site recognises the Global Privacy Control (GPC) signal as a request to opt out of targeted advertising and the “sale” or “sharing” of personal information for that browser or device, where those laws apply. Other than GPC, we do not currently respond to “Do Not Track” signals. You can also use our Your Privacy Choices page.

9. Direct marketing

With your consent (for example, when you subscribe at checkout or through a sign-up form), or where otherwise permitted by law, we may send you marketing by email, SMS, post or social media about our products, offers and events. Every marketing email or SMS will include a way to unsubscribe, and you can also contact us at any time to opt out. We will action your request promptly. Even if you opt out of marketing, we will still send you service messages about your orders or account.

10. Overseas disclosure and storage

Many of the service providers we use store or process personal information outside Australia. As a result, your personal information is likely to be disclosed to, stored in, or accessed from countries including the United States, Canada, Ireland and other member states of the European Union, the United Kingdom, Singapore, India and New Zealand, and other countries where our providers (such as Shopify, Google, Meta, Anthropic, PayPal and our other software providers) or their sub-processors operate.

We take reasonable steps to ensure overseas recipients handle personal information in a way consistent with the Australian Privacy Principles, including by using reputable providers with appropriate contractual, security and privacy commitments. Where we transfer personal information from the EU or UK, we rely on recognised transfer mechanisms such as Standard Contractual Clauses or adequacy decisions.

11. How we store and protect personal information

We hold personal information electronically using secure, reputable cloud-based systems, and occasionally in hard copy. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, including encrypted (HTTPS) connections, PCI-compliant payment processing, access controls, multi-factor authentication where available, and limiting access to people who need it.

No method of transmitting or storing information online is completely secure, so we cannot guarantee the security of your information. Please keep your account password confidential and contact us immediately if you think your account has been compromised.

If we experience a data breach that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

12. How long we keep personal information

We keep personal information only for as long as it is needed for the purposes described in this Privacy Policy, including to fulfil orders, provide customer service, maintain our business and tax records (generally for at least five years as required by Australian tax law), resolve disputes and comply with our legal obligations. When it is no longer needed, we take reasonable steps to securely destroy or de-identify it.

13. Accessing and correcting your personal information

You may ask to access the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Please contact us using the details in section 1. We may need to verify your identity before responding. We will respond within a reasonable time (usually within 30 days). We will not charge you for making a request, but may charge a reasonable fee for providing access in some circumstances. If we refuse your request, we will tell you why in writing (unless it would be unreasonable to do so) and how you can complain.

You can also update many of your details yourself by logging in to your account, or ask us to delete your account and personal information, subject to the records we must keep by law.

14. Additional rights for customers outside Australia

Depending on where you live, you may have additional rights under local law, including the right to: request access to, a copy of, or portability of your personal information; request correction or deletion; restrict or object to certain processing (including direct marketing and profiling); withdraw consent at any time; opt out of targeted advertising and the “sale” or “sharing” of personal information (as those terms are defined in some United States state laws); and appeal our decision on a request or lodge a complaint with your local data protection authority.

EU and UK residents: we are the controller of your personal information. We process it on the basis of performing our contract with you (for orders), our legitimate interests (operating, securing, improving and marketing our business), your consent (for certain Cookies and marketing, which you can withdraw at any time), and compliance with legal obligations.

United States residents: in the past 12 months we have collected the categories of information described in section 2 (identifiers, commercial information, internet and network activity, approximate geolocation and inferences) for the purposes in section 4, and disclosed them to the categories of recipients in section 5. Our use of advertising Cookies and pixels may be considered “selling” or “sharing” for targeted advertising under some state laws. You can opt out using our Your Privacy Choices page or a GPC signal. We do not use or disclose sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request, and we may ask for proof of authorisation and verify your identity.

To exercise any of these rights, contact us using the details in section 1.

15. Children’s privacy

Our products are designed for babies and children, but our Services are intended for adults. We do not knowingly collect personal information directly from children under 16. Where a parent, carer or gift giver provides information about a child (for example, a name for a personalised item), we use it only to fulfil that request. If you believe a child has provided us with personal information, please contact us and we will delete it. We do not knowingly “sell” or “share” the personal information of anyone under 16.

16. Reviews, social media and links to other websites

If you post a review, comment or other content on our Site or social media pages, it may be publicly visible. If you tag or mention @savannahandthree, we may re-share your content in line with our Terms of Service. Our Site may link to or embed content from third-party websites and platforms (such as Instagram feeds, payment providers or YouTube). We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

17. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact our Privacy Officer in writing using the details in section 1. We will acknowledge your complaint promptly, investigate it, and aim to respond within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

If you live outside Australia, you may also contact the data protection authority in your country (for the EEA, see the list of authorities at edpb.europa.eu).

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology (including the AI and advertising tools we use) or the law. The updated version will be published on this page with a new “Last updated” date. Where changes are significant, we will take reasonable steps to let you know. Please check this page regularly.