Privacy policy

Last updated: 15 October 2026

The short version

  • We're House of Dune, run by Ten X Ventures Pty Limited on the Gold Coast. We sell to customers in Australia and New Zealand.
  • We collect what you give us and what our site, emails and ad partners record about your use of them.
  • We use it to deliver orders, look after you and run our business, including analytics, personalised offers and AI tools.
  • We use it for marketing (email and other channels) where you've opted in or the law allows, and for ads on Meta, Google and (when we advertise there) TikTok, including matching you to their users and finding people like you.
  • We share details with service providers, ad platforms and Shopify. Shopify, Meta, Google and TikTok also use it for their own purposes; Shopify combines it with information from other Shopify stores. Some recipients are overseas, mainly in the US.
  • Your email or phone is usually hashed (turned into a code) before we send it for ad matching; other details, such as your IP address, aren't. Hashed details are still personal information.
  • You can unsubscribe, opt out of our targeted ads, see or correct your information, or complain: hello@houseofdune.com.au. Section 8 explains your choices.

1. Who we are

House of Dune is a business name of Ten X Ventures Pty Limited (ABN 22 684 103 142), 2/194 Varsity Parade, WOTSO, Varsity Lakes QLD 4227, Australia ("we", "us").

This is our privacy policy under the Privacy Act 1988 (Cth) and the Australian Privacy Principles and, for our New Zealand business (including houseofdune.co.nz visitors, New Zealand customers, gift recipients and stockists), the Privacy Act 2020 (NZ). It explains how we manage personal information. It's a notice, not a contract: you don't "agree" to it by using our site.

Privacy contact: our Privacy Officer, hello@houseofdune.com.au (please put "Privacy" in the subject line), 1800 497 011 (7am–7pm AEST), or by post to the address above.

2. What we collect

Kind Examples
Contact Name, email, phone, billing and delivery addresses
Orders and account Products bought or returned, order value, discount codes, gift messages, login, preferences
Payment Payment method, card type and last four digits, payment status. We never receive your full card number or security code
Messages and content Emails, calls, chats, SMS, messaging-app and social media messages and comments (including photos), reviews, and posts you share with or tag us in
Programmes and events Survey answers, giveaway entries, loyalty and referral activity, and details you give us at events, pop-ups and markets
Website and device Pages viewed, searches, cart and checkout activity, IP address, approximate location, browser, device, online identifiers, and the ad or link that brought you
Marketing results and profile Email opens and clicks, ad results, and our inferences about your interests, such as "likely to buy again"
Business and creator contacts Name, business, contact details, social handles, content you create for us, commission details

We don't ask for sensitive information (such as health). If you include it in a message, we'll only use it to deal with that message.

3. How we collect and hold it

From you: when you shop, create an account, sign up, ask for a back-in-stock alert, enter a giveaway, answer a survey, join a loyalty or referral programme, visit us at an event or market, review a product, make a wholesale or creator enquiry, or contact us (including by social media or messaging apps).

Automatically: through cookies, pixels and similar tools on our site and in emails (section 7), and server-side connections that send events such as a purchase straight from our store to Meta and others, even when your browser blocks pixels.

From others:

Source What we receive
Someone sending you a gift Your name, delivery address, phone and gift message
Meta Details you enter in a House of Dune form on Facebook or Instagram, and your profile name with your messages
Shopify and Shop Shop account details if you use Shop Pay or Shop login; recognition as a returning shopper, including from other Shopify stores; fraud-risk results
Klaviyo Recognition of your browser as linked to an email profile we already hold
Payment providers, ad platforms, affiliates, couriers Payment status; ad results and match reports; the affiliate link you used; delivery status

Gift recipients: we use your name, address, phone and the gift message to deliver the gift, handle any delivery, return or warranty issue, check the order for fraud and keep our records. They're stored with the purchaser's order and shared for those purposes with providers in section 5, including our warehouse, couriers and platforms. We won't send you marketing, or knowingly use your details to target you with our ads, unless you deal with us yourself. Shopify also uses order details, including yours, for its own services (section 5).

How we hold it: electronically, mainly with Shopify, Klaviyo and Google Workspace, plus limited paper records such as packing slips.

You can browse and ask general questions anonymously or under a pseudonym; orders and returns need your real details.

4. How we use it

  1. Orders and service: payment, delivery, returns, warranty claims, refunds, your account, replying to you, and review requests.
  2. Security: checking orders and payments, preventing fraud, handling chargebacks (section 10).
  3. Marketing: news, products, offers, restock alerts and order-by dates, tailored to what you've viewed or bought, by email, SMS/MMS, WhatsApp and other messaging apps, push and in-app notifications (including the Shop app), social media messages, post (such as postcards and catalogues) and phone, as section 8 allows.
  4. Advertising on other platforms: House of Dune ads on Facebook, Instagram, Google, YouTube, TikTok and their partner sites, including:
    • retargeting based on your activity on our site;
    • audience matching: sending hashed contact details so platforms show you our ads, or leave you out;
    • lookalikes: platforms use matched customers to find similar people;
    • advanced matching: hashed contact details sent with site events once we know who you are, to measure ads;
    • audiences for future campaigns, even when no ad is running.
  5. Platforms' own use: letting Meta, Google, TikTok and Shopify use what they receive under their own terms, including to improve their advertising services and for Shopify's cross-merchant features (section 5).
  6. Analytics: working out which ads, emails and pages work.
  7. Personalisation: relevant products and offers (including discount codes) on our site, in emails and ads, using predictions such as how likely you are to buy again, and a combined customer profile (mainly in Shopify and Klaviyo).
  8. Reviews and content: publishing reviews and photos on our site, in marketing and ads, and on Google Shopping and TikTok Shop. We'll ask before reusing your social media posts.
  9. Affiliates and creators: tracking referrals, paying commission, sending products for review and managing content.
  10. Wholesale, retail partners and suppliers: dealing with stockists, retail partners and suppliers, including joint promotions, and following up enquiries.
  11. Giveaways, loyalty, referrals and events: running them, checking eligibility, and contacting and announcing winners (first name and town). For a joint giveaway, we'll name the partner and say what it receives.
  12. Research: surveys, feedback and product development.
  13. AI tools: AI tools, including those built into our providers' platforms, may help us sort, draft and answer messages (including automatic replies), analyse orders and create content. Our people oversee them.
  14. Running the business and legal: accounting, tax, stock planning, insurance, training, complying with law, enforcing our terms and legal claims.
  15. Our group and business changes: sharing with related companies, and in confidence with prospective buyers, investors or financiers; a buyer may take over the information under this policy.

We may also use information for related purposes you'd reasonably expect, or as the law permits, and freely use reports that don't identify anyone (hashed identifiers aren't de-identified). We don't sell or rent our email list for other businesses to send you their marketing.

5. Who we share it with

  • Shopify (store, checkout, Shop, chat): everything you give us, plus site activity. Canada, US, other countries.
  • Payment providers (Shopify Payments/Stripe, Apple Pay, Google Pay, PayPal, Afterpay, Zip): order, payment and contact details. Australia, New Zealand, US.
  • Warehouse and freight providers (including our warehouse and couriers in Australia and New Zealand): order and delivery details. Australia, New Zealand, US.
  • Klaviyo (email, SMS and forms): contact details, order and browsing events, engagement, consent records. US.
  • Meta (Facebook, Instagram): site and server events, hashed contact details, IP address, device information, customer lists, lead-form answers, messages. Ireland, US, other countries.
  • Google (Analytics, Ads, YouTube, Merchant Center, Cloud, Workspace): site events, identifiers, hashed contact details (enhanced conversions, Customer Match), reviews, analytics exports and our business email. Australia, US, other countries.
  • TikTok (TikTok Pte. Ltd., Singapore), through the TikTok pixel on our site (we aren't currently advertising on TikTok): site events including purchases, contact details such as your name, email, phone and address (usually hashed), IP address and device information. Singapore, Malaysia, US, other countries.
  • Affiliate or referral platforms, if we run a programme: the referral link you used and the resulting order, and affiliates' own account details. Location depends on the provider; we'll update this list when we appoint one.
  • Judge.me (Judge.me Ltd, our reviews provider, processing customer data for us): name, email, phone, order, review, photos and site activity events, to request, publish and share reviews (including to Google Shopping and TikTok Shop). Its privacy policy applies to its review form. UK, US.
  • Creator platforms (such as Billo): creators' details. US.
  • AI providers (such as Anthropic): customer messages and orders. US.
  • Accounting software and business-systems providers (including A2X and Xero, our accountants, and the reporting and hosting services they use): order, payment and checkout details and wholesale customer details, for accounting, reporting and analysis. Australia, New Zealand, US.
  • Stockists, retail partners and promotion or event partners, where relevant to an order or joint promotion. Australia, New Zealand.
  • Messaging and mailing providers (SMS, messaging apps, printers, mail houses). Australia, New Zealand, US, other countries.
  • Related companies, other contractors, advisers, insurers, regulators and courts, as needed. Australia, New Zealand, US, other countries.

Recipients that also use information for their own purposes:

  • Shopify hosts our store and collects and processes our customers' personal information. Information you submit is shared with Shopify and with third parties that may be in other countries. We use Shopify's enhanced features (Shopify Network Intelligence), which combine information from your use of our store with information from other Shopify merchants and Shopify itself; for those features Shopify uses it under its Consumer Privacy Policy. To opt out of Shopify's processing, use Shopify's Privacy Portal or "Your privacy choices" in our footer, where shown.
  • Afterpay (AU, NZ), Zip (AU, NZ) and PayPal follow their own policies.
  • Klaviyo may use aggregated data that doesn't identify you or us to improve its service.

6. Overseas recipients

Recipients in section 5 are likely to hold information in the United States, Canada, Ireland, the United Kingdom, Singapore and Malaysia, and other countries where they or their sub-processors operate. For New Zealand customers, that includes Australia.

Australia: before disclosing information overseas, we take reasonable steps (mainly through providers' data-processing terms) to ensure the recipient handles it consistently with the Australian Privacy Principles.

New Zealand: most providers in section 5 (such as our warehouse, email platform and hosting) hold your information only on our behalf. Where we disclose it overseas for a recipient's own purposes (such as ad platforms or Shopify's enhanced features), we do so only where the Privacy Act 2020 allows, usually because the recipient is subject to the Act in New Zealand or must protect it with comparable safeguards. Ask us which applies.

7. Cookies, pixels and ads

Third parties, including Meta, Google and TikTok, use cookies, pixels, web beacons and other storage technologies to collect or receive information from our website and elsewhere on the internet. They use it to provide measurement services and to target and deliver ads, including House of Dune ads on their platforms and partner sites.

What runs on our site:

  • Google Analytics 4, with Google signals and Google Ads linking. We use these Google Analytics Advertising Features: remarketing, demographics and interests reporting, and Google Ads integration. We and Google use first-party cookies (such as the Google Analytics cookie) and Google advertising cookies or identifiers together to report on ad performance and build remarketing audiences. See How Google uses information from sites or apps that use our services.
  • Shopify cookies (essential, analytics, marketing).
  • Google Ads tag with enhanced conversions.
  • Meta Pixel and Conversions API with advanced matching (including the email you enter when you sign up).
  • TikTok Pixel with contact details (usually hashed).
  • Klaviyo: the __kla_id cookie (up to two years) links your browsing to your email profile once you've signed up or clicked one of our emails.
  • Judge.me: review widgets.

Klaviyo may also use Extended ID and First-Party ID: if you've given us your email, these reconnect your browser to your profile after our cookie expires or is cleared, using other identifiers set on our site (such as Shopify's or Google's) and a cookie from our web address. They don't create new profiles.

Email tracking: our marketing emails contain pixels and tracked links that record opens and clicks, when, and on what device. Some email apps preload images, so an "open" may be recorded without you reading the email.

8. Your choices

Email, SMS and messaging apps. We send electronic marketing only with your consent or as the law otherwise allows. For customers that means ticking our (unticked) checkout box or signing up on one of our forms (including on Facebook or Instagram); for business contacts, consent may be inferred from our relationship or a published work address. SMS marketing needs its own separate opt-in: a phone number given for delivery isn't used for SMS marketing without it. Every marketing message has an unsubscribe (reply STOP to texts), actioned within 5 working days; order messages continue. Turning off image loading stops email open tracking; links are still tracked.

Post, phone and notifications. We may send customers marketing by post, such as postcards and catalogues; ask us to stop any time. Marketing calls respect Australia's Do Not Call Register, and we'll stop if you ask. Turn off push and in-app notifications in your device or app settings.

Ads opt-out. Email us "ads opt-out" to stop us using your details to target you with House of Dune ads. We aim to act within 10 business days, and we will:

  • remove you from customer lists we upload to Meta, Google and TikTok, including lists already uploaded;
  • add you to our exclusion lists on those platforms, so our targeted ads aren't shown to you as far as the platforms allow; and
  • where feasible, stop adding your contact details to events our site sends them.

We may still tell platforms about purchases to measure our ads, but not to target you. This can't stop other businesses' ads or platforms' own use of what they hold.

Other businesses' marketing. Shopify's enhanced features can help Shopify and other merchants market to you. An "ads opt-out" also asks us to stop that, and we'll take the steps available to us; or use Shopify's Privacy Portal (section 5).

Settings you control:

  • Our site: "Your privacy choices" in our footer, where shown, tells Shopify and apps that follow its settings (including our Meta and TikTok pixels) not to share that browser's activity for targeted ads.
  • Meta: Ad preferences.
  • Google: My Ad Center (this also turns off Google Analytics Advertising Features for your account) or the Google Analytics opt-out add-on.
  • TikTok: in the app, Settings and privacy, then Ads.
  • Industry opt-out: WebChoices opts your browser out of interest-based ads from participating companies.
  • Your browser: blocking cookies limits pixels, but not server-side connections when you buy or sign up, or our recognising you once signed up.

Where we got your details: ask, and we'll tell you unless impracticable or unreasonable.

Opting out never affects your ability to buy from us.

9. How long we keep it

We keep information only as long as we need it for section 4 purposes, including legal obligations and honouring your choices. As a guide:

Information How long
Orders, payments and invoices Generally 7 years after the end of the financial year, then deleted or de-identified when no longer needed
Account While open, and for as long as we keep the related order records
Marketing profile While you're subscribed or a recent customer. We aim to remove or de-identify profiles inactive for 24 months
Unsubscribe and opt-out records Indefinitely, so we keep honouring your choice
Customer-service messages As long as needed for the matter, warranty or dispute; generally up to 7 years
Reviews While published, then in our records. Ask us to take yours down
Analytics Google Analytics user-level data 14 months. We aim to keep our own exports no more than 26 months
Ad audiences While used, within platform limits (such as 180 days for Meta website audiences, 540 days for Google); platforms keep event data under their own terms
Internal reporting copies We aim to reduce these to non-identifying totals within 90 days
Business and creator contacts While we deal with you, then as long as reasonable for our records
Cookies End of visit up to 2 years; most marketing cookies a year or less

10. Automated decisions

Fraud screening. Shopify automatically checks every order using order and payment details, payment-risk signals, billing and delivery addresses, email, phone, IP address and device information. Orders it flags are reviewed by a person at House of Dune, who decides whether to fulfil or cancel them. If you think an order was wrongly held or cancelled, contact us for a human review.

Afterpay, Zip and PayPal make their own approval decisions.

Our marketing software and ad platforms automatically decide which messages, ads and offers you see, based on your activity and profile, so some discounts go only to particular groups. This doesn't stop you buying at our listed prices.

11. Access, correction, deletion and complaints

See or correct your information: email us or use your account (we may confirm your identity). Asking and correction are free; we may charge a reasonable fee to give access to a large request, and will tell you first. We'll respond within a reasonable time, usually 30 days (in New Zealand, within 20 working days unless we extend that as the law allows and tell you why). If we refuse, we'll explain why. If we don't make a correction you ask for, you can ask us to attach a statement of it.

Deletion: ask, and we'll delete or de-identify what we no longer need. We may keep what we need for tax records, fraud prevention or disputes, and your contact details to honour your opt-outs. Platforms' own copies are subject to their policies.

Complaints: contact our Privacy Officer. We aim to acknowledge within 5 business days and answer in writing within 30 days. Not satisfied? Contact:

12. Security and breaches

We use access controls, secure logins, encrypted connections and providers with recognised security practices. No system is completely secure; tell us if you think your account is compromised.

If a privacy breach has caused or is likely to cause serious harm, we'll notify the regulator and the people affected (or give public notice where allowed) as Australian and New Zealand law requires.

13. Children

Our store is for adults, not people under 18. Apart from delivery details when someone sends a child a gift, we don't knowingly collect children's information or include children in ad audiences. If a review photo shows a child, we won't use it in our ads or other marketing without a parent's or guardian's permission. Tell us if a child has given us information and we'll delete it.

14. Changes and contact

We'll update this policy as our practices change and change the date above. For significant changes we'll also take reasonable steps to draw them to your attention, such as a website or email notice.

This policy is free. Ask if you'd like it in another form.

Contact: hello@houseofdune.com.au · 1800 497 011 · Ten X Ventures Pty Limited, 2/194 Varsity Parade, WOTSO, Varsity Lakes QLD 4227, Australia.