Last updated: August 20, 2026

1. Overview

DB Cosmetics NZ ("DB Cosmetics NZ", "we", "us", "our") operates this website and online store, together with all related content, features, tools and services (the "Services"), to provide you with a curated shopping experience. DB Cosmetics NZ is part of the Total Beauty Network group of brands.

This Privacy Policy explains how we collect, hold, use and disclose your personal information when you visit or use the Services, make a purchase, or otherwise interact with us. It is written to comply with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs). If you are located outside New Zealand, section 21 explains what additional rights may apply to you.

By using the Services, you acknowledge that you have read this Privacy Policy. If there is a conflict between our Terms of Service and this Privacy Policy in relation to the handling of your personal information, this Privacy Policy prevails.

2. What "personal information" means

"Personal information" means information about an identifiable individual. It does not include information that has been de-identified or aggregated so that it can no longer reasonably identify you.

3. The personal information we collect

Depending on how you interact with us, we may collect:

• Contact details: name, billing and shipping address, phone number and email address.
• Financial information: payment card details, financial account information, transaction details and payment confirmations. Card numbers are processed by our payment processor and Shopify; we do not store full card numbers ourselves.
• Account information: username, password, preferences and settings.
• Transaction information: items viewed, added to cart or wishlist, purchases, returns, exchanges and cancellations.
• Communications: anything you tell us, for example in a customer support enquiry, product review or competition entry.
• Device and usage information: your IP address, device and browser type, and how you interact with the Services, collected automatically through cookies and similar technologies.

4. Sensitive information

We do not seek to collect sensitive information (including health information). Please do not include sensitive information in free-text fields such as reviews, product enquiries or customer support messages unless it is necessary and you are comfortable with us handling it for that purpose.

5. How we collect your personal information

We collect personal information:

• directly from you, when you create an account, place an order, contact us or otherwise use the Services;
• automatically, through your use of the Services and through cookies and similar technologies;
• from our service providers who help us operate the Services (for example, Shopify, payment processors and shipping partners); and
• from other third parties, such as marketing and advertising partners, where you have interacted with them in a way that results in information being shared with us.

6. Why we collect, use and disclose your personal information

We collect, hold, use and disclose personal information for the following purposes:

• Providing the Services: processing payments, fulfilling and shipping orders, managing your account, handling returns and exchanges, and providing customer support.
• Improving the Services: understanding how customers use our store so we can improve our range, website and service.
• Marketing and advertising: see section 7 below.
• Security and fraud prevention: authenticating your account and protecting the Services, our customers and our business from fraudulent, unlawful or unsafe activity.
• Legal compliance: complying with our legal obligations, responding to lawful requests from regulators or law enforcement, and establishing, exercising or defending legal claims.

We only use and disclose personal information for the purpose we collected it for, a related purpose you would reasonably expect, or another purpose you have consented to, consistent with IPP 10 (limits on use) and IPP 11 (limits on disclosure) of the Privacy Act 2020.

7. Marketing and advertising, including audience matching with media partners

We use your personal information to send you marketing communications by email, SMS or post, and to show you advertising for our products, including retargeting based on items you have viewed, added to cart or purchased.

We also work with advertising and media partners (such as Meta, Google and TikTok) to reach new customers who share characteristics with our existing customers. To do this, we may provide a partner with certain contact details from our customer or subscriber list — typically your email address and/or phone number, converted into a non-readable "hashed" format before it is sent. The partner uses this only to:

• match the hashed details against its own users, so we can advertise to you on its platform ("custom audiences"); and/or
• build a model of other users who share similar characteristics, so we can advertise to them ("lookalike audiences").

Our partners are contractually required to use this information only to provide these services to us, not to combine it with their own data to build an independent profile of you, and not to re-identify or contact you directly outside the advertising platform. You can opt out of this kind of sharing at any time — see section 11 (Direct marketing and your choices).

8. Who we disclose your personal information to

We may disclose personal information to:

• Shopify and other service providers who perform functions on our behalf, such as payment processing, data analytics, customer support, cloud storage, and order fulfilment and shipping.
• Messaging platform providers, mobile carriers and vendors, if you opt in to receive SMS or text messages from us, limited to what is needed to deliver those messages.
• Advertising and media partners, as described in section 7.
• Other companies in the Total Beauty Network group, for the purposes described in this policy.
• A prospective buyer or its advisers, in connection with an actual or proposed business sale, merger, restructure or other transaction.
• Courts, regulators, law enforcement or other third parties, where required or authorised by law, or to establish, exercise or defend a legal claim.
• Anyone else you direct us to share your information with — for example, to arrange delivery, or through a social media login integration.

We do not sell your personal information for money.

9. Overseas disclosure of personal information

Some of our service providers and advertising partners store or process personal information outside New Zealand, including in Australia and the United States. Before we disclose your personal information to an overseas recipient, we take reasonable steps to ensure the recipient is subject to safeguards comparable to the Information Privacy Principles, consistent with IPP 12 of the Privacy Act 2020 — including through contractual protections — except where an exception under IPP 12 applies (for example, where you have authorised the disclosure, or the recipient is otherwise required by law to protect the information to a comparable standard).

Where practicable, we will tell you which countries our overseas recipients are likely to be located in if you ask us — see section 20 (Contact us).

10. Our relationship with Shopify

Our Services are hosted by Shopify, which processes personal information about your use of the Services on our behalf and as our service provider, so that Shopify can provide and improve its platform for us and other merchants. In some circumstances — where Shopify uses information from your interactions with our store together with your interactions with other Shopify merchants to provide "enhanced features" (for example, cross-store fraud prevention or shared shopping tools) — Shopify handles that information as an independent party responsible for that processing, and you can exercise your rights over that use directly with Shopify. You can read more in the Shopify Consumer Privacy Policy.

11. Direct marketing and your choices

You can opt out of receiving marketing emails at any time using the unsubscribe link in any email, and opt out of SMS/text marketing at any time by replying STOP, consistent with the Unsolicited Electronic Messages Act 2007 (NZ). If you opt out, we may still send you non-marketing messages, such as order and account updates.

You can also ask us at any time not to share your details with advertising or media partners for the custom audience and lookalike audience purposes described in section 7, without affecting your ability to use the Services or receive direct marketing from us. Contact us using the details in section 20 to action this.

12. Cookies and tracking technologies

We and our service providers use cookies, pixels and similar technologies to operate the Services, remember your preferences, understand how customers use our store, and support the advertising described in section 7. You can control cookies through your browser settings; disabling cookies may affect how the Services function.

13. Security of your personal information

We take reasonable steps, consistent with IPP 5 of the Privacy Act 2020, to protect the personal information we hold from loss, and from unauthorised access, use, modification or disclosure, including through technical and organisational security measures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please avoid sending sensitive information to us over unsecured channels.

14. How long we keep your personal information

Consistent with IPP 9 of the Privacy Act 2020, we keep personal information for as long as we need it to provide the Services, meet our legal, accounting, tax and regulatory obligations, resolve disputes, and enforce our agreements. When we no longer need personal information for these purposes, we take reasonable steps to destroy or de-identify it.

15. Automated decision-making

We do not currently use personal information in a computer program to make decisions that significantly affect your rights or interests. If this changes, we will update this Privacy Policy to describe the kinds of personal information used and the kinds of decisions involved.

16. Children's personal information

The Services are not directed at children, and we do not knowingly collect personal information from children without the consent of a parent or guardian. If you are a parent or guardian and believe your child has provided us with personal information, contact us using the details in section 20 and we will take reasonable steps to delete it.

17. Third party links

The Services may link to websites or platforms operated by third parties. We are not responsible for the privacy practices or content of those third parties. We recommend you review their privacy policies before providing them with personal information.

18. Data breaches

If we experience a privacy breach involving your personal information that has caused or is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner, consistent with the notifiable privacy breach requirements under the Privacy Act 2020.

19. Your rights under the Privacy Act 2020

Subject to some exceptions permitted by law, you have the right to:

• ask for access to the personal information we hold about you (IPP 6);
• ask us to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading (IPP 7);
• ask us to delete personal information we hold about you, which we will consider and action as a matter of good practice where we are not otherwise required or permitted by law to retain it (for example, to meet tax, accounting or other legal obligations);
• ask us not to use your personal information for direct marketing purposes, at any time and free of charge; and
• deal with us anonymously or under a pseudonym, where it is lawful and practicable to do so (IPP 1).

To exercise any of these rights, contact us using the details in section 20. We may need to verify your identity first. We will not charge you for making a request, and we will not discriminate against you for exercising your rights. You may nominate an authorised representative to make a request on your behalf; we may ask for evidence of that authority and may still need to verify your identity directly with you.

20. Making a complaint

If you have a complaint about how we have handled your personal information, contact us at:

Phone: +61 3 8544 8000
Email: db@dbcosmetics.co.nz
Post: DB Cosmetics, 813 Springvale Rd, Mulgrave VIC 3170, Australia

We will investigate and respond to your complaint within a reasonable time. If you are not satisfied with our response, you can lodge a complaint with the Office of the Privacy Commissioner:

Website: privacy.org.nz
Phone: 0800 803 909

21. Additional rights for overseas customers

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post any updated policy on this page and update the "Last updated" date above.