Privacy policy

Last updated: 8 November 2026

This Privacy Policy explains how G.F.A. (Aust) Pty Ltd (ABN 81 006 436 362), the company behind BYS Cosmetics ("BYS", "we", "us"), collects, uses, shares and protects your personal information. We're bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy applies when you visit bys.com.au, shop with us, sign up to our emails, contact us, apply to become a stockist, or deal with us in any other way.

The personal information we collect

Contact details: your name, email address, phone number, and delivery and billing addresses.

Order details: what you buy, return or exchange, and how you pay. Our payment providers process your card details, so we never see or store your full card number.

Account and preferences: your account details and your marketing preferences.

What you tell us: your emails, calls and messages to us, your product reviews and competition entries, and any stockist, collaboration or job applications.

Device and usage information: your IP address, browser and device type, the pages you view, and how you arrived at our website. We collect this through cookies and similar technology, as explained in our Cookie Policy.

Health information: if you tell us about a skin reaction or other health concern linked to one of our products, we'll use that information only to handle your enquiry and to meet our legal obligations, including product safety reporting.

How we collect it

We collect most information directly from you, for example when you place an order, create an account, sign up to our emails or contact us. We also collect information automatically when you use our website, and from the businesses that help us run our store, such as Shopify, our payment providers and Australia Post.

If you'd rather not give us some information, you don't have to, but we may not be able to process your order or answer your enquiry without it.

How we use it

We use your personal information to process and deliver your orders, take payments, handle returns and refunds, manage your account, answer your questions and publish your reviews. We also use it to send you marketing if you've agreed to receive it, to understand how people use our website so we can improve it, to prevent fraud, and to meet our legal obligations, such as keeping tax records.

Marketing

We only send you marketing emails or text messages if you've agreed to receive them. Every marketing message includes a way to unsubscribe, and we'll act on your request within five business days. You can also contact us to opt out. We may still send you messages about your orders or account after you unsubscribe.

We may also show you BYS ads on other websites and social media, based on your visits to our website. You can control this through your browser settings and the ad settings of Google and Meta.

Who we share it with

We share personal information only as needed with the businesses that help us run our store: Shopify, which hosts our website, checkout and customer emails; our payment providers, Shopify Payments and PayPal; Australia Post, which delivers your orders; and Judge.me, which runs our product reviews. We may also share it with other companies in our group, our professional advisers, and government authorities or law enforcement where the law requires it.

We don't sell your personal information.

Shopify

Our store runs on Shopify, which processes your information to provide our website and checkout. Shopify also uses some information about how you interact with our store, along with information from other Shopify stores, to provide features such as Shop Pay and fraud protection. Shopify is responsible for that use under its own Consumer Privacy Policy, and you can exercise your rights over it through the Shopify Privacy Portal.

Information stored outside Australia

Shopify and some of our other service providers store and process information outside Australia, including in Canada and the United States. We take reasonable steps to make sure they protect your information in line with the Australian Privacy Principles.

Automated fraud checks

When you pay, Shopify and our payment providers run automated fraud checks using your order, payment and device information. These checks can decline a payment or flag an order for us to review.

Keeping your information secure

We store personal information on secure systems and limit access to the people who need it. Our checkout meets PCI DSS Level 1, the highest standard for card payment security. We keep personal information only for as long as we need it for the purposes in this policy or as the law requires, and then delete it or remove anything that identifies you.

Accessing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer. It's free to make a request. If giving you access takes significant work, we may charge a reasonable fee and will tell you before we go ahead. We'll respond within 30 days, and if we can't give you access or make a correction, we'll explain why. You can also update your account details by signing in to your account.

Making a complaint

If you think we've mishandled your personal information, please contact our Privacy Officer and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Children

Our website is designed for adults. If you're under 18, please ask a parent or guardian to shop for you.

Changes to this policy

We may update this policy from time to time. We'll post the new version on this page and change the date at the top.

Contact our Privacy Officer

Privacy Officer, G.F.A. (Aust) Pty Ltd
PO Box 518, Moorabbin VIC 3189
Email: james@gfa.net.au
Phone: +61 3 9551 4666