Privacy policy

Last updated: October 7, 2026

This Privacy Policy explains what personal information Meg's Story collects, why we collect it, who we share it with and what you can do about it. It applies to everyone who visits or buys from megstory.com.

Meg's Story is operated by Cedrus Holding B.V., a company registered in the Netherlands. That means two sets of privacy rules apply to how we handle your information, and we follow both:

the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which protect you as a customer in Australia
the EU General Data Protection Regulation (GDPR), which applies because our company is established in the European Union

Where the two differ, we apply the rule that gives you more protection.

1. Who is responsible for your information

Cedrus Holding B.V., trading as Meg's Story, is responsible for your personal information (under the GDPR, the "controller"). Our details are at the bottom of this page. For any privacy question or request, email info@megstory.com.

2. What we collect

When you order: your name, delivery and billing address, email address, phone number, the items you order and confirmation that your payment went through. We do not receive or store your full card number.
When you create a customer account: your name, email address and order history.
When you subscribe to our emails: your email address.
When you contact us: your contact details and what you tell us in your message.
When you browse the website: your IP address, device and browser type, the pages you view and the website you came from, collected through cookies and similar technologies (see section 8).

We do not collect sensitive information, such as information about your health, religion or ethnic origin. You can browse the website without telling us who you are, but we need your name and address to deliver an order.

3. How we collect it

Most information comes directly from you: when you place an order, create an account, subscribe or contact us. Some comes from others: Shopify Payments confirms whether your payment succeeded, and carriers tell us where your parcel is. Browsing information is collected automatically through cookies, and only with your consent where consent is required.

4. Why we use it

to process, ship and deliver your order and keep you informed about it (performance of our contract with you)
to answer your questions and handle returns, exchanges and refunds (performance of our contract with you)
to send you our marketing emails, only if you have asked for them (your consent)
to keep the website secure and prevent fraud, including automated fraud checks on payments by Shopify (our legitimate interest in a safe shop)
to understand how the website is used and improve it, through analytics cookies you have accepted (your consent)
to keep accounting and tax records (our legal obligations)

The descriptions in brackets are our legal bases under the GDPR (Article 6(1)(b), (a), (f) and (c)). Under the Australian Privacy Principles, we collect information only where it is reasonably necessary for these purposes (APP 3) and use or disclose it only for them (APP 6).

5. Marketing emails

We only send marketing emails if you have subscribed, in line with the Spam Act 2003 (Cth) and the GDPR. Every marketing email contains an unsubscribe link, and you can also unsubscribe by emailing info@megstory.com. Emails about your order, such as confirmations and tracking updates, are not marketing and are always sent.

6. Who we share it with

We share personal information only with the service providers we need to run the shop, and only as much as each one needs:

Shopify, the platform this shop runs on, including Shopify Payments, which processes your payment
Our suppliers and fulfilment partners, who receive your name, delivery address and phone number so they can pack and ship your order
Australia Post and other carriers, who deliver your parcel and provide tracking
Google Analytics and Meta (Facebook and Instagram), only if you accept analytics or marketing cookies

We may also disclose information where the law requires it, for example to a tax authority or in response to a valid legal request.

We do not sell your personal information, and we do not share it with anyone for their own marketing.

7. Sending information outside Australia

Because of how our business works, your personal information is disclosed to recipients outside Australia (APP 8):

to us, in the Netherlands (European Union), where Meg's Story is operated
to our suppliers and fulfilment partners in Asia, who ship your order
to Shopify, Google and Meta, which may process information in other countries where they operate, including Canada and the United States

We take reasonable steps to make sure overseas recipients handle your information in a way that is consistent with the Australian Privacy Principles. Where information leaves the European Union, we rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

8. Cookies and analytics

We use essential cookies to make the cart, checkout and your account work. These are always on. Analytics cookies (Google Analytics) and marketing cookies (Meta) are only placed if you accept them in our cookie banner. You can change or withdraw your choice at any time through the cookie settings on the website, and you can block cookies in your browser, although parts of the website may then stop working properly.

9. How long we keep it

Order, invoice and payment records: 7 years, because accounting and tax law require it
Customer account: until you ask us to close it
Emails with our customer service: 2 years after our last contact
Marketing email subscription: until you unsubscribe
Cookie and analytics data: for the period shown for each cookie in our cookie banner

When we no longer need information, we delete it or make it anonymous.

10. How we keep it secure

The website runs over an encrypted connection, access to customer information is limited to the people who need it for their work, and your payment details are handled by Shopify Payments, not by us. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and report it to the Autoriteit Persoonsgegevens where the GDPR requires it.

11. Your rights

You can ask us to:

give you access to the personal information we hold about you
correct information that is wrong, out of date or incomplete
delete your information, unless the law requires us to keep it
restrict or stop a particular use of your information, or object to it
give you a copy of your information in a commonly used electronic format
withdraw your consent at any time, for example for marketing emails or cookies

Email info@megstory.com. We may ask you to confirm your identity first. We respond within 30 days and we do not charge for this.

12. Complaints

If you are unhappy with how we have handled your personal information, please email us first at info@megstory.com. We look into every complaint and reply in writing within 30 days.

If you are not satisfied with our answer, you can complain to the Australian regulator:

Office of the Australian Information Commissioner (OAIC)
GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Website: oaic.gov.au

Because our company is established in the Netherlands, you can also complain to the Dutch data protection authority:

Autoriteit Persoonsgegevens
PO Box 93374, 2509 AJ The Hague, Netherlands
Website: autoriteitpersoonsgegevens.nl

13. Children

Our shop is meant for adults. We do not knowingly collect personal information from anyone under 18. If we find out that we have, we delete it.

14. Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date of the last change at the top.