Your privacy
at XE'LHA Australia

1. Who we are

This website is operated by Glorien Pty Ltd (ABN 28 690 377 952), trading as XE'LHA Australia, the official Australian distributor of XE'LHA professional skincare ("we", "us", "our"). Our address is 214/1 Katherine St, Chatswood NSW 2067.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to xelha.com.au, our trade portal, and our dealings with clinics, skin professionals and enquirers.

2. What personal information we collect

We only collect what we need to answer enquiries, approve trade accounts and supply products. Depending on how you deal with us, this may include:

• Enquiries (Contact Us form): your name, email, phone, clinic or salon name, business type, what you're interested in and your message.
• Trade account applications: your name, email, phone, business name and type, ABN, website, business address and any notes you add. Your password is handled by our authentication provider and stored only in hashed form; we never see it.
• Orders: contact details, delivery and billing addresses (including saved addresses), the products ordered, order notes, payment status, and shipping and tracking details.
• Payments: card payments are processed by Stripe. We do not see or store your full card number. For bank transfers we record whether and when payment was received.
• Newsletter: your email address and where you signed up.
• Website usage: technical information such as your IP address, browser and device type, pages visited and referring site, collected through cookies and similar technologies (see section 7).

Our products are for professional use and our services are directed at businesses. We do not knowingly collect sensitive information (such as health information) and ask that you don't include it, or details about your clients, in forms or messages.

3. How we collect it

We collect personal information directly from you when you fill in a form on our website, apply for or use a trade account, place an order, subscribe to our newsletter, or contact us by email, phone or Instagram. Some technical information is collected automatically when you visit the site.

You can browse the public pages of our website without telling us who you are. If you don't give us the information a form asks for, we may not be able to respond to your enquiry, approve a trade account or fulfil an order.

4. How we use it

We use personal information to:

• respond to enquiries about supply, pricing, training and support;
• verify that applicants are clinics or skin professionals, and approve and manage trade accounts;
• process and deliver orders, take payment, issue tax invoices and handle returns or questions;
• send service emails, such as account approval, order confirmation, payment and shipping updates;
• send product news, training dates and clinic resources if you have subscribed;
• measure and improve our website and advertising, including on Facebook and Instagram;
• protect our website and customers from spam, fraud and misuse; and
• meet our legal obligations, including tax and record-keeping requirements.

We do not sell personal information.

5. Who we share it with

We share personal information only as needed to run our business, with service providers who handle it on our behalf:

• Cloudflare: website hosting and security;
• Supabase: our database, trade account sign-in and file storage;
• Stripe: card payment processing;
• Resend: delivery of our emails;
• Meta Platforms (Facebook and Instagram): advertising measurement through the Meta Pixel;
• couriers and postal services: delivering your order; and
• our professional advisers, such as our accountant, where needed.

We may also disclose information where the law requires or authorises it, for example to a government authority.

6. Overseas storage and disclosure

Some of our service providers store or process information outside Australia, including in the United States and other countries where they or their sub-processors operate. Where we use overseas providers, we take reasonable steps to ensure they handle personal information in a way consistent with the APPs.

XE'LHA products are developed in Korea. If we need to share information with the brand in Korea, for example about a product question or a partner clinic, we will only share what is needed for that purpose.

7. Cookies and tracking

Our website uses:

• Essential storage: to keep you signed in to your trade account and to remember the contents of your cart in your browser.
• Meta Pixel: a tool from Meta that uses cookies to measure visits and the results of our Facebook and Instagram ads, and to show relevant ads to people who have visited our site. Meta may combine this with information it already holds about you under its own privacy policy.
• Payment security: on checkout, Stripe may use cookies and device information to prevent fraud.

You can block or delete cookies in your browser settings, and manage ad preferences in your Facebook or Instagram settings. Blocking essential storage may stop sign-in or the cart from working.

8. Security and retention

We take reasonable steps to protect personal information from misuse, loss and unauthorised access. Our website uses encrypted connections (HTTPS), and access to trade account and order records is restricted to authorised staff, with database rules that limit each member to their own records.

We keep personal information only for as long as we need it for the purposes above. Order and invoice records are kept for at least five years to meet Australian tax requirements. When information is no longer needed, we take reasonable steps to delete or de-identify it.

No method of transmission over the internet is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner where required.

9. Marketing emails

We only send product news and clinic resources to people who have subscribed or who have a trade relationship with us. You can opt out at any time by emailing [email protected] with "Unsubscribe". Service emails about your account and orders will continue while you have an active account or order.

10. Access and correction

You can ask to see the personal information we hold about you, or ask us to correct it. Trade members can update their profile and saved addresses directly in their account. For anything else, contact us using the details below. We will respond within 30 days and may need to confirm your identity first. In limited cases the law allows us to refuse access; if so, we will tell you why.

11. Questions and complaints

If you have a question about this policy or a concern about how we have handled your personal information, please contact us:

We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We may update this policy from time to time, for example when we add new services or providers. The current version is always published on this page, with the date it was last updated.