Privacy Policy

Last updated: 5 October 2026

At a glance

• Data controller: HYGGO PTY LTD (ABN 26 680 569 653), trading as JoyPicks, Melbourne, Victoria, Australia.
• Contact: [email protected].
• What we use data for: orders, payments, delivery, returns, refunds, support, fraud prevention, legal compliance and, where allowed, marketing.
• Who receives order data: payment providers, carriers and the supply partner sending your item, mainly in China.
• Your rights: access, correction, deletion/erasure, restriction, portability, objection and complaint rights where the law gives them.

HYGGO PTY LTD (ABN 26 680 569 653), trading as JoyPicks ("we", "us"), based in Melbourne, Victoria, Australia, operates joypicks.com and is the seller and data controller for personal information collected through JoyPicks. This Privacy Policy explains what personal information we collect, how we use it, who we disclose it to, how we protect it, and the rights and choices you may have.

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where applicable, we also handle personal information in line with the EU GDPR, the UK GDPR and US state privacy laws such as the CCPA/CPRA.

JoyPicks is an international online fashion marketplace. Today, all products on JoyPicks are sold by HYGGO PTY LTD (ABN 26 680 569 653), trading as JoyPicks. The stores on JoyPicks group the ranges of our supply partners, and orders are sent directly to buyers by the relevant supply partner, mainly from China. The contract of sale is with HYGGO PTY LTD (ABN 26 680 569 653), trading as JoyPicks. We handle customer service, delivery problems, returns, refunds and privacy requests. For more about who we are, see About Us, Contact Us and our Terms of Service.

What personal information do we collect?

Depending on how you use JoyPicks, we may collect the following categories of personal information:

• Identity and contact details - such as your name, email address, phone number, billing address and delivery address.
• Account details - such as your password, sign-in information, saved preferences, wishlist items, language and communication settings.
• Order information - such as the products you order, order number, order value, currency, delivery method, tracking events, returns, refunds, cancellations, Buyer Protection claims and related correspondence.
• Payment information - limited payment details such as payment method, card brand, last four digits, expiry date, billing country and transaction status. Card payments are processed by Stripe and PayPal payments by PayPal. We never store your full card number. Stripe is PCI DSS certified. We accept only Visa, Mastercard and American Express cards, Apple Pay and Google Pay on supported devices via Stripe, and PayPal.
• Communications - such as emails, customer support messages, phone call notes, return requests, privacy requests, complaints, review submissions, product questions and any photos or documents you send us.
• Technical and usage information - such as your IP address, browser type, device type, operating system, approximate location derived from IP, referral source, pages viewed, time spent, links clicked, cart activity, and cookie or similar technology data.
• Fraud and security information - such as fraud screening results, chargeback data, order risk indicators and account or device signals used to protect JoyPicks, our customers and our business.
• Seller application information - if you apply to sell on JoyPicks, business details, contact people, verification information and information needed to assess your application and manage a seller relationship. See Sell on JoyPicks and Seller Terms.

We collect most of this information directly from you. We may also receive information from Stripe, PayPal, delivery carriers, analytics and hosting providers, advertising platforms where you have consented where required, and the supply partner handling your order.

You can browse parts of JoyPicks without giving us your name, but we need certain information to accept and fulfil orders, provide support, process returns and refunds, and comply with the law.

How do we collect personal information?

We collect personal information when you:

• visit or browse joypicks.com
• create an account or sign in
• place an order or attempt a payment
• change your ship-to country, currency or language settings
• contact us by email
• request a return, refund, cancellation or Buyer Protection claim
• subscribe to marketing
• leave a review or submit user content
• apply to become a seller
• accept or manage cookies through our cookie tools, where available

Why do we use personal information?

We use personal information for the following purposes:

• to process orders, take payment when an order is placed, and arrange dispatch and delivery
• to disclose the order information needed to the supply partner sending your item
• to provide customer service and answer questions
• to manage cancellations, returns, refunds, damaged parcel reports and Buyer Protection claims
• to send service messages such as order confirmations, dispatch notifications, tracking updates and refund confirmations
• to detect, investigate and prevent fraud, abuse, chargebacks, prohibited activity and security incidents
• to operate, secure, troubleshoot, maintain and improve JoyPicks
• to enforce our policies, including our Terms of Service, Prohibited Items Policy, Product Safety Policy, IP Policy and Review Guidelines
• to comply with legal obligations, including tax, accounting, consumer law, sanctions screening, product safety and record-keeping obligations
• to send marketing communications if you have consented where required or if otherwise permitted by law; you can unsubscribe at any time
• to measure website performance and marketing effectiveness, only with consent where required for non-essential cookies or similar technologies

What are our legal bases under the GDPR and UK GDPR?

If the GDPR or UK GDPR applies to you, our legal bases include:

• Contract - where processing is necessary to take your order, process payment, arrange delivery, provide support, and handle returns, refunds and claims.
• Legal obligation - where processing is necessary to comply with laws that apply to us, such as tax, accounting, consumer protection, product safety and fraud prevention obligations.
• Legitimate interests - where processing is necessary for the operation, security and improvement of our business and website, customer service, dispute handling, fraud prevention, and enforcement of our policies, provided those interests are not overridden by your rights.
• Consent - where we rely on consent, such as for marketing in some jurisdictions and for non-essential cookies or similar technologies where required by law. You may withdraw consent at any time, but this does not affect processing already carried out lawfully before withdrawal.

Who do we disclose personal information to?

Supply partners that fulfil orders

To fulfil your order, we disclose your name, delivery address, phone number and order details to the supply partner sending the item, mainly in China. They use this information only to fulfil the order, arrange delivery, deal with delivery issues and assist with after-sales matters such as returns, replacements or product questions. We do not disclose your full card number to supply partners.

Payment providers

We use Stripe to process Visa, Mastercard and American Express card payments, Apple Pay and Google Pay on supported devices, and PayPal to process PayPal payments. Payment is taken when the order is placed. These providers process payment information under their own privacy notices and security standards.

We do not offer bank transfer, cash, cheque, cryptocurrency, third-party gift cards, buy now pay later or instalment services, including Afterpay, Zip, Klarna, Humm, Latitude, PayPal Pay in 4 or PayPal Credit.

Service providers

We use service providers that help us run JoyPicks, including our hosting and email providers in Australia, Cloudflare, Google for analytics and advertising tools where consent is given where required, customer support tools, fraud prevention providers and delivery carriers. They may access personal information only as needed to provide services to us.

Professional advisers and authorities

We may disclose personal information to legal, accounting, insurance and other professional advisers, and to regulators, courts, law enforcement, tax authorities, consumer protection agencies or product safety authorities where required or authorised by law or where reasonably necessary to protect rights, property or safety.

Business transfers

If our business is sold, merged, reorganised or assets are transferred, personal information may be disclosed to a buyer or successor as part of that process, subject to applicable law. If JoyPicks ever stops trading, HYGGO PTY LTD (ABN 26 680 569 653), trading as JoyPicks remains responsible for orders already placed, refunds and claims.

We do not sell personal information. We also do not share personal information for cross-context behavioural advertising in a way that requires an opt-out under applicable US state privacy laws.

Are personal information and orders transferred internationally?

Yes. JoyPicks serves customers in 222 countries and territories that appear in the ship-to list in the site header, except that we do not deliver to mainland China, Hong Kong, Macau, Taiwan, Russia, Belarus, North Korea, Iran, Syria or Cuba. Because of our business model, personal information is often transferred internationally.

In particular:

• order fulfilment information is disclosed to the supply partner sending your item, mainly in China
• payment providers may process data in Australia, the United States, the European Union, Singapore and other countries where they operate
• our hosting, email, security, analytics and support providers may process data in Australia, the United States, the European Union and other countries where they or their sub-processors operate

Where required by law, we use appropriate safeguards for international transfers, such as contractual protections including standard contractual clauses. We also take reasonable steps to ensure overseas recipients handle personal information consistently with applicable privacy requirements. However, privacy protections in another country may differ from those in your own country.

How do cookies, analytics and advertising work?

We use cookies and similar technologies to make JoyPicks work, keep you signed in, remember your cart and preferences, keep the site secure, understand how visitors use the site, and measure advertising performance where you have consented where required. Some cookies are essential and some are optional.

For more detail, including how to manage cookies, see our Cookie Policy.

What about reviews and user content?

If you submit a review, question, photo or similar content, we may display the content you choose to provide on JoyPicks. Our review practices are described in our Review Guidelines. We do not publish fake, paid or incentivised reviews, and we do not edit reviews to change their meaning.

Do we use automated decision-making?

We and our payment providers use automated tools to help detect fraud and security risks when orders are placed. These checks may cause an order to be held for review, refused or cancelled before dispatch. This helps protect customers, payment systems and our business.

If a decision of this kind affects you and you want us to review it, email [email protected] with the subject line Privacy request. We may ask for information needed to verify your identity and review the decision.

How do we protect personal information?

We use reasonable technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These measures include HTTPS encryption, restricted access controls, authentication measures, monitoring, and the use of established payment processors so that we do not store full card numbers ourselves.

No system is completely secure, but we work to reduce risk and to respond quickly if an issue occurs.

How long do we keep personal information?

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to provide services, complete transactions, keep business and tax records, resolve disputes, enforce our agreements and comply with legal obligations. We then delete, anonymise or de-identify it where appropriate, unless we are required or permitted by law to retain it for longer.

What privacy rights do you have?

Depending on where you live, you may have some or all of the following rights:

• to know whether we hold personal information about you
• to request access to personal information we hold about you
• to request correction of inaccurate or incomplete information
• to request deletion or erasure of personal information in some circumstances
• to request restriction of processing in some circumstances
• to object to certain processing in some circumstances
• to request portability of certain information
• to withdraw consent where we rely on consent
• to complain to a privacy regulator or supervisory authority

Under applicable US state privacy laws, these rights may include the right to know, access, correct and delete personal information, subject to exceptions. We do not sell personal information or share it for cross-context behavioural advertising in a way that requires an opt-out.

To make a privacy request, email [email protected] with the subject line Privacy request. We will need to verify your identity before acting on a request. You may also update some information through your account settings.

We will respond within the time required by applicable law. Where no specific period applies, we usually respond within 30 days. If we cannot comply fully with a request, we will explain why, subject to legal limits.

How do direct marketing choices work?

We may send marketing emails where you have consented where required or where otherwise permitted by law. We comply with the Australian Spam Act 2003 (Cth) and other applicable anti-spam laws. You can unsubscribe at any time using the unsubscribe link in the message or by emailing [email protected] with the subject line Privacy request.

Even if you opt out of marketing, we may still send non-promotional service messages about your orders, returns, refunds, account or legal notices.

Children's privacy

JoyPicks is not directed to children, and we do not knowingly collect personal information from children in violation of applicable law. If you believe a child has provided us with personal information unlawfully, please contact us so we can investigate and take appropriate steps.

How can you make a privacy complaint?

If you have a complaint about how we have handled your personal information, please email [email protected] with the subject line Privacy complaint and include the details. We will acknowledge your complaint, investigate it and aim to respond within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner. If the GDPR or UK GDPR applies to you, you also have the right to complain to your local supervisory authority or, in the UK, the Information Commissioner's Office.

Changes to this policy

These pages were rewritten on 5 October 2026 to be clearer and more complete. The current version of this Privacy Policy will always be published on this page with the latest last updated date. If we make a material change, we may also take additional steps to notify you where appropriate.

Contact us

HYGGO PTY LTD (ABN 26 680 569 653), trading as JoyPicks

Melbourne, Victoria, Australia

• Email: [email protected] for customer service, orders, returns, privacy, IP and seller enquiries. Please use subject lines such as Privacy request or Privacy complaint so we can route your message quickly.
• Response times: we usually answer emails within one business day.

For general help, see our Help Centre. You may also wish to read our Shipping Policy, Returns Policy, Buyer Protection, Payments, Terms of Service and Contact Us page.