Posted bare-rooted on Mondays · Australia-wide except WA, TAS and NT · Get release alerts
Effective 4 October 2026. Valewood Clivias is operated by B.J Ezzy & S.E Ezzy, ABN 90 964 561 924.
About this policy
This policy explains how Valewood Clivias collects, uses, shares and protects personal information when you visit valewoodclivias.com.au, buy from us, sign up for our emails or get in touch.
Valewood Clivias is a family business near Toowoomba, Queensland. It is operated by B.J Ezzy & S.E Ezzy, a family partnership (ABN 90 964 561 924). In this policy, “we”, “us” and “our” mean that partnership.
We choose to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Effective date: 4 October 2026.
How to contact us
For any privacy question, request or complaint, email sales@valewoodclivias.com.au. Putting “Privacy” in the subject line helps us find it quickly.
What we collect
We only collect what we need to run the shop and to stay in touch with people who ask us to.
- Orders: your name, billing and delivery addresses, email address, phone number, the plants you buy, any order notes and the payment status. We also record how you found our website (see “Cookies” below).
- Customer accounts (optional): your username, password and order history. Passwords are stored in scrambled (hashed) form, so we can’t read them.
- Contact form and emails: the details you give us, such as your name, email address and message.
- Newsletter and release alerts: your email address, your name if you give it, the interests you choose (for example, the kinds of plants you’d like to hear about), when you signed up and confirmed, and the IP address used. We keep these details as a record of your consent.
- Payments: Stripe collects your card or digital wallet details directly. We only receive limited details, such as the card type, the last four digits and whether the payment went through.
- Technical and security information: like most websites, our web host’s servers log technical details such as IP addresses, browser type and the pages requested. Our security tools record the IP address and username used in failed login attempts.
You can browse the website without telling us who you are. To buy a plant, we need your name and delivery details so we can post it to you.
We don’t ask for sensitive information, such as health information. Please don’t send it to us.
How we collect it
- Directly from you, when you place an order, create an account, fill in a form, subscribe or email us.
- Automatically, through cookies and server logs when you use the website.
- From our service providers. For example, Stripe tells us whether a payment went through and whether it was flagged as a fraud risk, and Australia Post provides delivery tracking.
- From Facebook or Instagram, if you message us there. Those platforms handle your information under their own privacy policies.
Why we use it
- to process, pack and post your order, and to contact you about it (for example, to confirm any extra postage for an order with more than one plant)
- to take payment and help prevent fraud
- to answer your questions and handle any problem, refund or consumer guarantee claim
- to run your customer account, if you have one
- to send the newsletter and release alerts you’ve asked for
- to keep the website and your information secure
- to understand, in general terms, which websites and links bring us orders
- to meet our legal obligations, such as keeping tax records
We don’t sell or rent personal information, and we don’t use it to build advertising profiles.
Who we share it with
We share personal information only with the services that help us run the shop, and only what each one needs:
- GoDaddy hosts our website and store database, including order, account and subscriber details and website backups. GoDaddy privacy notice
- Stripe processes card, Apple Pay and Google Pay payments and checks them for fraud. Stripe privacy policy
- Automattic provides WooCommerce and WooPayments, our payment service, and receives the order and payment details needed to process your payment. Automattic privacy policy
- SMTP2GO delivers our order emails, newsletters and release alerts, and keeps delivery records. SMTP2GO privacy policy
- Microsoft provides our business email (Microsoft 365), where your emails and contact form messages arrive. Microsoft privacy statement
- Australia Post receives your name and delivery address (and your email address or phone number if we arrange tracking notifications) so it can deliver your parcel. Australia Post privacy policy
If you pay with Apple Pay or Google Pay, Apple or Google also handle your payment under their own privacy terms.
We may also share information with our professional advisers (such as an accountant), or with government agencies and others when the law requires or allows it.
Information stored or handled overseas
Some of these services store or process information outside Australia:
| Service | What it handles | Where |
|---|---|---|
| GoDaddy (website hosting) | Our website, store database and backups | Singapore, where our website server is located |
| Stripe (payments) | Payment and fraud prevention information | The United States, India and other countries where Stripe operates |
| Automattic (WooPayments) | Order and payment details | The United States and other countries where Automattic operates |
| SMTP2GO (email delivery) | Email addresses, email content and delivery records | SMTP2GO is based in New Zealand. Data may be processed on servers outside Australia |
| Microsoft 365 (business email) | Emails we send and receive | Microsoft may store or process data in Australia or overseas |
| Australia Post (delivery) | Delivery details | Australia. Australia Post says some of its service providers are overseas. |
We use these providers because they are established businesses with published privacy and security commitments. Information held overseas may also be subject to the laws of those countries.
Newsletter, release alerts and your choices
- We only send our newsletter and release alerts if you sign up and then confirm by clicking the link in our confirmation email.
- You choose your interests when you sign up, and you can change them using the link at the bottom of any of our emails.
- Every email has an unsubscribe link that works without logging in. We stop sending as soon as we can, and always within 5 working days. You can also email us to unsubscribe.
- Buying from us doesn’t add you to our mailing list.
- Our newsletter tool may record whether an email is opened and which links are clicked. We use this only to see which news readers find useful.
Order emails, such as confirmations, postage quotes and dispatch notices, aren’t marketing. You’ll receive them whether or not you subscribe.
Cookies
Cookies are small files a website stores in your browser. We keep them to a minimum:
- no analytics, advertising or social media tracking cookies or pixels
- no Google reCAPTCHA
- our fonts are stored on our own server, so our pages don’t contact Google Fonts
- our Facebook and Instagram links are plain links, so nothing from those sites loads unless you click them
These are the cookies we do use:
| Cookie | Purpose | How long |
|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart | Keep track of what’s in your cart | Until you close your browser |
| wp_woocommerce_session_ | Links your browser to your cart | 2 days |
| sbjs_ cookies (such as sbjs_current, sbjs_first, sbjs_session and sbjs_udata) | WooCommerce order attribution. Records how you reached our website (for example, from a search engine, another website or a link), your device type, browser and IP address, and how many pages you viewed. This is saved with your order only if you place one. | Until you close your browser (sbjs_session ends after 30 minutes) |
| wordpress_logged_in_, wordpress_sec_, wordpress_test_cookie | Keep you logged in to your account and check that cookies are turned on | Until you close your browser, or up to 14 days if you tick “Remember me” |
| __stripe_mid, __stripe_sid | Set by Stripe to help detect and prevent payment fraud | Up to 1 year (__stripe_mid) and 30 minutes (__stripe_sid) |
| newsletter | A technical cookie our subscription pages use to show you the right messages | Set when you use a subscription page; short term |
Stripe also collects information about your device and how you use the checkout (such as browser settings and how the page is used) to spot fraud and bots. Stripe says it uses this information only for fraud prevention and security, not for advertising. Stripe’s automated checks may occasionally block a payment. If that happens, email us and we’ll help.
Order attribution information is stored with your order in our own store database. WooCommerce usage tracking is switched off, so this information isn’t shared with WooCommerce.
You can block or delete cookies in your browser settings, but the cart, checkout and account login won’t work without them.
Some pages also load small emoji images from WordPress.org (s.w.org), which means your browser sends its IP address to WordPress.org when those images load.
How we protect it
- Our website uses encrypted (HTTPS) connections.
- Card details are entered into Stripe’s secure payment fields. Your full card number never reaches our website and is never stored on it.
- Only the family members who run the business and look after the website can access customer information, using their own logins protected by strong passwords.
- We use security tools that limit repeated login attempts, and we keep regular backups.
No website can be perfectly secure. If a data breach is likely to cause you serious harm, we’ll tell you promptly, explain what happened and what you can do, and notify the Office of the Australian Information Commissioner where required.
How long we keep it
- Orders: for 5 years after the end of the financial year in which you ordered, because tax law requires us to keep transaction records for 5 years. After that, we delete or de-identify them.
- Customer accounts: until you ask us to close your account, or until it hasn’t been used for 3 years.
- Newsletter and release alerts: until you unsubscribe. After that, we may keep your email address and the date you unsubscribed so we don’t email you again by mistake.
- Enquiries: for as long as we need them to help you and to keep a record of what we agreed.
- Security logs: for a limited time, then cleared.
- Backups: kept for a limited time and replaced on a rolling basis.
Accessing, correcting or deleting your information
You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing us. If you have an account, you can update most of your details yourself under My Account.
We’ll respond within 30 days and won’t charge you. We may need to check your identity first. If we can’t do what you’ve asked, we’ll explain why in writing.
You can also ask us to delete your information. We’ll do so unless we need to keep it, for example to meet tax record-keeping rules.
Complaints
If you’re concerned about how we’ve handled your personal information, please email us first with the details. We’ll look into it and reply within 30 days.
If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or lodge a privacy complaint online.
Changes to this policy
We may update this policy, for example if we change the services we use. We’ll post the new version on this page with a new effective date, and point out any significant changes.
Sources and further reading (24)
- OAIC: Australian Privacy Principles quick reference
- OAIC: Small business (Privacy Act coverage and $3 million threshold)
- OAIC: Privacy complaints
- OAIC: Lodge a privacy complaint
- Attorney-General's Department: Privacy reform consultation (exposure draft, 31 August to 18 September 2026)
- Herbert Smith Freehills Kramer: The draft tranche 2 Privacy Act reforms (September 2026)
- Corrs: Australia's ongoing privacy reforms (commencement dates)
- ACMA: Avoid sending spam
- WooCommerce: Order attribution tracking
- WooCommerce: Cookies
- WooCommerce: Privacy considerations for payment extensions
- WordPress: Cookies
- Stripe: Advanced fraud detection
- Stripe: Privacy policy (international transfers)
- Stripe: Privacy Center (Australian entities)
- Automattic: Privacy policy
- GoDaddy: Global privacy notice
- GoDaddy: Australian supplemental privacy notice
- SMTP2GO: Privacy policy (Sand Dune Mail Ltd, Christchurch NZ)
- SMTP2GO: Vendor information (data centre regions)
- Microsoft: Product Terms data residency (Australia)
- Australia Post: Privacy policy
- The Newsletter Plugin: GDPR and data collected
- ATO: Overview of record-keeping rules for business