Privacy
Privacy Policy
Omar Fahd trading as AccessibleTech — ABN 98 550 628 955
support@accessibletech.com.au · 0406 939 770 · Version 1.1 · Last updated 8 September 2026
1. About this policy
This policy explains what personal information AccessibleTech collects, why we collect it, who we share it with, how we keep it safe, and how you can access, correct or complain about it.
“Personal information” means information about an identified individual, or an individual who is reasonably identifiable, whether or not it's true and whether or not it's recorded in a material form. That's the definition in the Privacy Act 1988 (Cth).
This policy covers our website at accessibletech.com.au, our sales to customers, our device collection from businesses and individuals, and our dealings with suppliers and partners.
2. Which privacy laws apply to us
Because of our size, AccessibleTech is currently within the small business exemption in section 6D of the Privacy Act 1988 (Cth). We are not required by that Act to comply with the Australian Privacy Principles.
We have chosen to handle personal information as if we were bound by them anyway. This policy is written to meet Australian Privacy Principle 1.4, and we apply the other principles as a matter of practice. Where this policy makes a promise, we treat it as binding on us regardless of the exemption.
Some privacy obligations apply to us regardless of our size. These include the Spam Act 2003 (Cth) for our marketing emails, the Do Not Call Register Act 2006 (Cth) for any telephone contact, and the statutory cause of action for serious invasions of privacy in Schedule 2 of the Privacy Act 1988 (Cth), which has applied since 10 June 2025.
We will review this position whenever our turnover approaches $3 million, and whenever Commonwealth privacy law changes.
3. What personal information we collect
3.1 Customers and prospective customers
- name, delivery address, billing address, email address, phone number
- order history, device serial numbers matched to your order, warranty and returns correspondence
- payment confirmation data (a transaction reference and the last four digits of a card). We never see or store full card numbers, CVVs or bank login details — payments are processed directly by Stripe, and card data goes to them, not to us
- account credentials if you create an account. Passwords are stored as a one-way hash by our authentication provider — we cannot read your password. If you sign in with Google, we receive the email and name on that Google account, not your Google password
- information you give us in support, warranty or complaint correspondence
3.2 Applicants for student or hardship pricing
- your student email address, institution and enrolment status, or the evidence you provide in a hardship application
- your description of your circumstances
We ask you not to send us medical records, Centrelink statements, or details of your health, disability, race, religion or criminal record. We do not need them and we do not want them. If you send them anyway, we will use only the minimum necessary to decide your application, and we will delete the rest once the decision is made. Information of that kind is “sensitive information” under the Privacy Act 1988 (Cth) and attracts extra protection; we handle any that reaches us on that basis.
3.3 Individuals who sell or give us a device
If you sell or give us a device as an individual, Victorian law requires us to record and keep:
- your full name and address
- particulars of the identification you show us — the type of document and its number
- the date and time we received the device, a description of it, the identifying number we assign it, and the price we paid
We record these particulars only. We do not photograph, scan or retain a copy of your identity document. We do not use a government identifier as your customer reference.
This is required by the Second-Hand Dealers and Pawnbrokers Act 1989 (Vic) and its regulations, and the records must be available to Victoria Police on request. We cannot accept a device from an individual without them. We use this information for that legal purpose and for our own stock records — not for marketing, unless you separately opt in.
3.4 Business, school and partner contacts
Names, job titles, work email addresses and phone numbers of the people we deal with at businesses, schools, recyclers and suppliers, plus our correspondence with them and records of devices collected.
3.5 Website visitors
- IP address, browser and device type, pages viewed, referring page, and timestamps, collected through Hostinger server logs. We do not currently run a third-party analytics product
- cookies and similar technologies. Strictly necessary cookies keep a signed-in session working and cannot be turned off. Your cart is stored in your browser, not in a cookie. We do not set analytics cookies. You can block or delete cookies in your browser; if you do, you may need to sign in again
- typefaces loaded from Google Fonts, which receive your IP address and browser details when a page loads
- if you contact us through a web form, whatever you put in it
3.6 Young people
Some of our customers are school students, and schools may refer a student to us. We do not knowingly collect more information about a person under 18 than we need to complete a sale or assess an application, and we do not send marketing to anyone we know to be under 16.
Where a school or another adult gives us a student's details, we use those details only for the purpose the school gave them to us for. A parent or guardian may make a request under section 13 on behalf of a young person, and we may ask for evidence of that relationship before we act on it.
3.7 Data found on devices we receive
This is the most sensitive category we deal with, and we did not ask for any of it.
Devices we collect from businesses and individuals frequently still contain the previous user's files, emails, photographs, browser data, saved passwords and account sessions. We do not want this information, we do not read it, index it, copy it or use it, and we do not disclose it to anyone.
Our practice is:
- every incoming device is logged and stored in a secured area from the moment it arrives
- storage media are erased to the NIST SP 800-88 Rev. 1 standard before any device is tested for resale, and the erasure is recorded against the device's serial number. Media that cannot be verifiably erased are physically destroyed or sent to a licensed recycler for destruction
- devices that cannot be refurbished are erased or have their media destroyed before they leave us
- staff are not permitted to open, view or copy user files at any stage. Where a technician must boot a device before erasure, they do so only to confirm hardware function
- we can issue a certificate of erasure to the business or individual that supplied the device
If you were the previous user of a device that reached us, you can ask us what we hold about it (section 13).
4. How we collect personal information
We collect personal information directly from you wherever we can — through the checkout, an account signup, a form on our website, an email, a phone call, or in person when we collect devices.
Sometimes we collect it from someone else: an employer who gives us a fleet and provides a contact person's details, a school that refers a student, our shipping carrier's tracking data, or our payment provider's confirmation of a transaction. Where we collect information about you from a third party, we will tell you, unless it's unreasonable or impracticable to do so.
You can deal with us anonymously or under a pseudonym when you're simply asking us a question. We can't do that for a purchase — we need a real name and address to deliver a device and to honour a warranty — and we can't do it where the law requires us to record your identity, as in section 3.3.
5. Why we collect it and how we use it
We use personal information to:
- process, fulfil, ship and invoice your order
- handle returns, warranty claims and consumer guarantee claims under the Australian Consumer Law
- verify eligibility for student or hardship pricing
- keep the stock, sourcing and identity records the law requires us to keep
- answer your questions and resolve complaints
- detect and prevent fraud, payment abuse and the purchase or sale of stolen devices
- meet our tax, accounting and regulatory obligations
- improve our website and understand which listings people find useful
- send you marketing, if you have asked to receive it (section 6)
We do not sell personal information. We do not trade it, rent it, or share it with data brokers, and we do not use it to build profiles for other companies.
6. Direct marketing
We only send marketing emails to people who have opted in. Every marketing email carries a working unsubscribe link, we act on unsubscribes within 5 business days, and every message identifies us and how to contact us. That's what the Spam Act 2003 (Cth) requires and we treat it as the floor, not the target.
Order confirmations, shipping notices, warranty correspondence and recall notices are not marketing and will still be sent to you.
You can opt out at any time by using the unsubscribe link or emailing support@accessibletech.com.au. If you ask us to stop, we'll also tell you where we got your address if you want to know.
8. Overseas disclosure
Some of the providers above store or process data outside Australia. As at 8 September 2026 this includes:
| Provider | Purpose | Countries |
|---|---|---|
| Stripe | Payment processing | United States, Ireland |
| Hostinger | Website hosting, business email | Singapore (data at rest); Lithuania and Cyprus (provider access for support) |
| Supabase | Database, sign-in, file storage | Singapore (data at rest); United States (provider access for support) |
| Brevo | France | |
| Cloudflare | Product image delivery | Global network of servers, including in the United States and the European Union. Because images are served from whichever location is closest to you, we can't list every country exhaustively |
| Sign-in (if you use it) and typefaces | United States |
Before we send personal information to an overseas recipient we take reasonable steps to satisfy ourselves that it will be handled consistently with this policy, usually through the provider's contractual data-processing terms. We will keep this list current. If you want to know where a specific piece of your information is stored, email support@accessibletech.com.au and we'll tell you.
9. How we keep it safe
Reasonable steps we take:
- HTTPS across the whole website, including checkout
- multi-factor authentication on our website admin, email, banking and cloud accounts
- no full card numbers stored anywhere in our systems
- access limited to the people who need it — currently one person — with individual logins, not shared ones
- database access controlled by row-level security rules, so an account can only reach its own records
- physical devices held in a locked area, and stock, once erased, holding no customer data
- encrypted backups, and encryption on any laptop or phone with access to our systems
- we monitor security advisories for the software our site depends on and apply patches
- storage media erased or physically destroyed, as in section 3.7
No system is perfectly secure. If something goes wrong, section 10 explains what we'll do.
10. Data breaches
If personal information we hold is lost, or accessed or disclosed without authorisation, and a reasonable person would conclude that this is likely to result in serious harm to anyone affected, we will:
- contain it and assess it immediately
- notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable after we form that view
- tell you plainly what happened, what information was involved, and what you should do about it
Where we suspect a breach but aren't yet sure whether it's likely to cause serious harm, we will complete our assessment within 30 days.
We do this voluntarily. The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) does not currently bind us because of the small business exemption, but we have adopted it as our standard and we will follow it.
11. Automated decision-making
Fraud screening. When you place an order, Stripe's automated fraud system assesses it before the payment goes through. This is a machine learning system: it produces a risk score and, if the score is high enough, the payment is declined automatically without a person looking at it.
To do this, Stripe uses information about the payment and the circumstances around it — the card details you enter, the billing and delivery addresses, your email address, your IP address and approximate location, your browser and device characteristics, and patterns Stripe has observed across the many businesses it processes payments for. We do not choose the rules and we do not see the underlying model.
What this means for you. Your order may be declined even though your card is valid and you have done nothing wrong. Automated fraud systems make mistakes, and they are known to misfire more often on people using shared or mobile connections, VPNs, prepaid cards, or a delivery address that differs from their billing address.
You can ask a person to look at it. If your order was declined and you believe it shouldn't have been, email support@accessibletech.com.au and a person will review it and, where we're satisfied it was a false positive, arrange another way for you to complete the purchase. We won't ask you to justify yourself, and we won't hold a declined order against you.
Other decisions are made by people. Student eligibility, hardship pricing, warranty claims, returns and refunds are all decided by a person, not by software.
12. How long we keep it
| Record | Kept for |
|---|---|
| Order, invoice and tax records | 7 years from the transaction. Tax law requires 5; we keep 7 so we can still answer a consumer guarantee claim |
| Warranty and returns correspondence | 7 years, for the same reason |
| Second-hand dealing records (section 3.3) | 7 years. The Act and its regulations require us to keep these records and produce them to Victoria Police on request, but they do not set a fixed number of years. We keep them for 7 years so they sit with our other business records |
| Student or hardship application evidence | 12 months after the decision, then deleted |
| Marketing list entries | Until you unsubscribe, then a suppression record only |
| Website server logs | 90 days |
| Data on incoming devices | Erased before refurbishment; never retained |
When we no longer need personal information and no law requires us to keep it, we destroy it or de-identify it.
13. Accessing and correcting your information
You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it if it's wrong, out of date or incomplete. Email support@accessibletech.com.au. We'll ask you to verify your identity, and we'll respond within 30 days.
There's no charge for making a request. If a request takes substantial work we may charge a reasonable cost-based fee, and we'll tell you what it is before we do anything.
We may refuse in limited circumstances — for example where giving you access would unreasonably affect someone else's privacy, or where we're required to keep the record for a law enforcement purpose. If we refuse, we'll tell you why in writing and how to complain.
14. Complaints
Email support@accessibletech.com.au with “Privacy complaint” in the subject line. We'll acknowledge within 5 business days and give you a written answer within 30 days.
If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, GPO Box 5218 Sydney NSW 2001. For complaints about our conduct as a trader rather than our handling of your information, Consumer Affairs Victoria is on 1300 55 81 81.
15. Changes to this policy
We may update this policy. The current version is always at accessibletech.com.au/privacy, with a version number and date at the top. If we make a change that materially affects how we handle information we already hold about you, we'll tell you directly.
16. Contact us
Privacy enquiries: support@accessibletech.com.au · 0406 939 770
Person responsible: Omar Fahd, Founder
If you need to post something to us, email first and we'll give you our postal address.