Privacy policy
Cuba St Coffee Roasters
Last updated: 10 August 2026
1. About this policy
RA&KL HOLDINGS PTY LTD (ABN 47 661 569 188) trading as Cuba St Coffee Roasters ("we", "us", "our") operates the website at cubastcoffee.com.au, our online store and our café and roastery at Marcoola, Queensland.
We respect your privacy. This policy explains what personal information we collect, why we collect it, who we share it with, and how you can access, correct or complain about it. It is written to align with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).
This policy explains how we handle your personal information. Where we need your consent for something — such as marketing, or matching your details with advertising platforms — we will ask for it separately.
Our online store is hosted by Shopify. Shopify also handles personal information about your use of the store — see section 8.
2. What personal information we collect
We only collect personal information that is reasonably necessary for our business. Depending on how you interact with us, this may include:
Contact details — your name, email address, phone number, delivery address and billing address.
Order and transaction information — what you bought, order value, grind preference, delivery instructions, order history, subscription details, returns and refunds.
Payment information — we do not store your full card number. Payments are processed by our payment providers (Shopify Payments and/or Square) and we receive only a confirmation, the last four digits of the card and the card type.
Account information — if you create an account: your username, password (stored in encrypted form), saved addresses and preferences.
Communications — emails, contact-form messages, social media messages, product reviews and support enquiries, including anything you choose to tell us in them.
Marketing preferences — whether you have subscribed to our emails or SMS, and whether you've opted out.
Website and device information — your IP address, browser type, device type, operating system, referring page, the pages you view, what you add to your cart, and how you move through the site. This is collected automatically through cookies and similar technologies (see section 9).
Wholesale and café enquiries — business name, ABN, contact person and requirements.
Sensitive information
We do not seek to collect sensitive information (such as health information). Please do not send us sensitive information unless we specifically ask for it. If you tell us about a food allergy or intolerance in connection with an order or café visit, we will use that information only to respond to your request and will not retain it any longer than necessary.
Children
Our store is not directed at children, and our Terms of Service require purchasers to be at least 18. We do not knowingly collect personal information from anyone under 18 without the involvement of a parent or guardian. If you believe a child has given us their information, contact us and we will delete it.
3. How we collect it
Directly from you — when you place an order, create an account, start a subscription, sign up to our mailing list, complete a contact or wholesale form, leave a review, enter a competition, or email, call or speak to us in the café.
Automatically — through cookies, pixels and analytics tools when you browse our website.
From third parties — from Shopify and our apps, payment providers, Australia Post (delivery status), our email marketing platform, and social or advertising platforms where you have interacted with our content.
Where it is lawful and practicable, you can deal with us anonymously or under a pseudonym — for example, browsing the store or making a general enquiry. We can't fulfil an order or a delivery without your real name and address.
4. Why we collect and use it
We use your personal information to:
- Fulfil your order — take payment, roast and pack your coffee, arrange delivery with Australia Post, and send you order confirmations and tracking.
- Manage subscriptions — process recurring charges, send you renewal and dispatch notices, and handle skips, swaps and cancellations.
- Provide customer service — respond to enquiries, process returns, refunds and warranty claims.
- Manage your account — authenticate you, save your preferences and order history.
- Send marketing — new releases, restocks, offers and roastery news, where you have opted in or where you are an existing customer and the message relates to similar products. Every marketing message includes an unsubscribe link, as required by the Spam Act 2003 (Cth).
- Improve our store and products — understand which products and pages perform, fix problems, and plan what to roast.
- Advertise — show you relevant ads on other platforms, and measure whether they worked. See section 9.
- Protect our business — detect and prevent fraud, chargebacks, abuse and security incidents.
- Comply with the law — tax and business records, food safety obligations, and responding to lawful requests.
We will not use your personal information for an unrelated purpose unless you would reasonably expect it, you have consented, or the law requires or permits it.
5. Who we disclose it to
We disclose personal information to the following categories of recipients, only as needed for the purposes above:
| Recipient | Why |
|---|---|
| Shopify | Hosting our online store, checkout, order management and analytics |
| Payment providers (Shopify Payments, Square, PayPal, Afterpay or similar) | Processing payments and refunds |
| Australia Post | Delivering your order and providing tracking |
| Subscription and app providers installed on our store | Managing recurring orders, reviews, loyalty and similar features |
| Email and SMS marketing platforms | Sending you communications you've asked for |
| Analytics and advertising platforms (e.g. Google, Meta) | Measuring site performance and delivering ads |
| Our accountants, bookkeepers, IT and professional advisers | Running the business |
| Government agencies, regulators, courts or law enforcement | Where required or authorised by law |
| A purchaser | If we sell or restructure the business, as part of that transaction |
We do not sell your personal information.
We require our service providers to handle your information consistently with this policy and the Privacy Act, and to use it only for the purpose we engaged them for.
6. Overseas disclosure
Some of our service providers store or process personal information outside Australia. This means your information may be held in, or accessible from, countries including:
- Canada and the United States — Shopify and its infrastructure
- The United States — Google, Meta, and most email marketing and app providers
- Ireland and other European Union countries — some hosting and analytics infrastructure
Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the APPs — generally through contractual commitments in our supplier agreements. You should be aware that overseas recipients may be subject to different privacy laws, and that in some cases we may not be able to control or enforce how they handle your information.
If the list of countries changes materially, we will update this policy.
7. Security and retention
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include HTTPS encryption across our store, PCI-DSS compliant payment processing handled by our providers rather than by us, restricted staff access, strong authentication on our admin accounts, and choosing reputable platforms.
No system is perfectly secure. We cannot guarantee the security of information transmitted to us over the internet, and any transmission is at your own risk. Please do not send us card numbers, passwords or identity documents by email.
How long we keep it. We keep your personal information only as long as we need it:
- Order and transaction records — at least 7 years, to meet our record-keeping obligations under the Corporations Act 2001 (Cth) (7 years) and ATO requirements (5 years).
- Account and subscription details — while your account is active, and for a reasonable period afterwards.
- Marketing contact details — until you unsubscribe, plus a suppression record so we don't email you again by mistake.
- Website analytics data — as set by the retention settings of the relevant platform.
When we no longer need personal information and are not required to retain it, we take reasonable steps to destroy or de-identify it.
Data breaches. If we suffer a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
8. Our relationship with Shopify
Our store is hosted by Shopify Inc. Shopify collects and processes personal information about your access to and use of the store in order to provide and improve its services, including for security, fraud prevention and analytics, and to power certain enhanced features that draw on data from across Shopify's merchant network.
For those purposes Shopify acts in its own right, not simply on our behalf, and Shopify is responsible for how it handles that information — including responding to requests you make about it. You can read Shopify's Consumer Privacy Policy and exercise your rights with Shopify at privacy.shopify.com.
9. Cookies, analytics and advertising
Our website uses cookies and similar technologies:
- Essential cookies — keep you logged in, remember your cart, and make checkout work. The site doesn't function without these.
- Analytics cookies — help us understand how the store is used so we can improve it.
- Marketing and advertising cookies — let us and our advertising partners show you relevant ads on other websites and social platforms, and measure their performance.
You can control cookies through your browser settings, and you can opt out of personalised advertising through the settings of the relevant platform (for example, Google Ads Settings or Meta's ad preferences). Blocking essential cookies will break parts of the store.
We do not currently respond to browser-level opt-out signals such as "Do Not Track" or Global Privacy Control, as there is no consistent standard for them in Australia. Use the controls above instead.
Automated decision-making
We do not use automated decision-making, profiling or artificial intelligence to make — or substantially assist in making — decisions that significantly affect you. Our automation is limited to routine order processing, fraud screening by our payment providers, and product recommendations. If that changes, we will update this policy and tell you what information is used.
10. Direct marketing and how to opt out
If you receive marketing from us, you can opt out at any time by:
- clicking unsubscribe in any marketing email
- replying STOP to any marketing SMS
- emailing us at info@cubastcoffee.com.au
We action opt-outs promptly and, in any case, within 5 working days as required by the Spam Act 2003.
Opting out of marketing does not stop transactional messages — order confirmations, dispatch and tracking notices, subscription renewal reminders and account notifications. You can only stop those by closing your account or cancelling your subscription.
11. Accessing and correcting your information
You have the right to:
- Ask what we hold about you and get a copy of it
- Ask us to correct anything inaccurate, out of date, incomplete, irrelevant or misleading
- Ask us to delete your information — we will do so where we are not required by law to keep it. (The Privacy Act does not give a general right to erasure, but we will act on reasonable requests.)
To make a request, email info@cubastcoffee.com.au with "Privacy request" in the subject line. We may need to verify your identity before we act on it.
We will respond within a reasonable period, and generally within 30 days. We don't charge for making a request, though we may charge a reasonable fee for the cost of providing access in some circumstances — we'll tell you before we do.
If we refuse a request, we will tell you why in writing and explain how you can complain.
You can also update your own contact details and marketing preferences at any time through your account on our store.
12. Complaints
If you think we have breached the Australian Privacy Principles or mishandled your personal information, please tell us first:
Privacy enquiries — Cuba St Coffee Roasters
Email: info@cubastcoffee.com.au
Post: 968 David Low Way, Marcoola QLD 4564
We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. We will tell you the outcome in writing.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
13. Third-party websites
Our store may link to other websites, or embed third-party content such as social feeds and maps. We are not responsible for the privacy practices of those sites. Read their privacy policies before giving them your information.
14. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available on this page, and the "Last updated" date at the top will change. If we make a material change, we will let you know by email or a notice on our website.
15. Contact us
RA&KL HOLDINGS PTY LTD trading as Cuba St Coffee Roasters
ABN 47 661 569 188
968 David Low Way, Marcoola QLD 4564
Email: info@cubastcoffee.com.au
Phone: +61 434 162 786