1. Our Commitment to Your Privacy

This Privacy Policy explains clearly and directly what personal information we collect, why we collect it, how we use and protect it, and what rights you have over it.

NAILU is operated by Elysay Sky trading as NAILU (ABN 57 133 490 900), a sole trader registered in Queensland, Australia ("we", "us", "our"). Our store is located at www.nailu.au.

While NAILU currently qualifies as a small business under the Privacy Act 1988 (Cth), we voluntarily comply with the Australian Privacy Principles (APPs) as a matter of trust and best practice — because we believe our customers deserve nothing less.

If you have any questions about this policy or how we handle your data, please contact us at info@nailu.au. We will respond within 30 days.

2. The Laws That Guide Us

We respect and voluntarily comply with multiple privacy frameworks depending on where you are located:

Where NAILU voluntarily adopts a framework beyond what is strictly required by law, we do so because we believe it reflects our values and the trust our customers place in us.

3. Age Requirement

Our Site is intended for users aged 13 and over. We do not direct our Site at children under the age of 13. If you are under 13, please do not use our Site or provide any personal information to us without verifiable parental or guardian consent. See Section 12 for our full Children's Privacy policy.

4. What Information We Collect

a) Information You Provide Directly

When you place an order or interact with our Site, you may provide:

• Full name
• Shipping and billing address
• Email address
• Phone number (if provided)
• Order details, product preferences, and purchase history
• Communications you send us (e.g. customer service enquiries)

Please note: Providing your name, shipping address, and email address is necessary to enter into and fulfil a purchase contract with us. Without this information, we are unable to process or deliver your order. Providing your phone number is optional.

b) Information Collected Automatically

When you visit our Site, Shopify's platform automatically collects:

• IP address and approximate location (country/city level)
• Browser type, operating system, and device information
• Pages visited, products viewed, and time spent on the Site
• Referring URL (how you arrived at our Site)

c) Payment Information

We do not collect, see, or store your payment card or banking details at any point. All payment data is handled exclusively and securely by our third-party payment processors (see Section 8). We receive only a transaction confirmation and order reference.

d) Email Address (Mailing List)

If you signed up via our landing page, we collected and securely stored your email address with your consent. We do not use it for marketing or promotional communications. It is held solely to notify you of significant updates, such as our official store launch. You may withdraw your consent and request removal at any time (see Section 13).

5. Why We Collect Your Information (Lawful Basis)

We only collect and process information for specific, legitimate purposes.

*Where we rely on legitimate interest, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. A summary is available on request at info@nailu.au.

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

6. Our Platform: Shopify

Our store is built on Shopify Inc., a globally trusted e-commerce platform. Shopify acts as a data processor on our behalf under our instructions and is PCI-DSS Level 1 compliant — the highest standard for payment data security.

Shopify's privacy policy: https://www.shopify.com/legal/privacy

Shopify may store and process your data on servers located in the United States and Canada. We are not responsible for Shopify's independent data practices beyond our contractual relationship with them.

7. Our Handmade Nail Artisans and Order Fulfilment

NAILU products are designed by us and handmade by skilled artisan suppliers based in Asia. The specific country of our fulfilment partners may vary as we grow and refine our supplier relationships. When you place an order, we share the following with our fulfilment partners solely to produce and deliver your order:

• Full name
• Shipping address
• Order details

For Australian customers: We are required under APP 8 to inform you that some of our Asia-based artisan suppliers are located in countries that may not have privacy protections equivalent to Australia's. By proceeding with your order, you acknowledge this disclosure.

For EU and UK customers: Transfers of your personal data to our fulfilment partners are made on the basis that they are necessary for the performance of our contract with you, pursuant to Article 49(1)(b) of the GDPR. These transfers are limited strictly to what is necessary to fulfil your order.

Our suppliers are contractually required to use your personal information only to fulfil your order and for no other purpose.

8. Payment Processors

Your payments are handled securely by the following third-party providers. We do not receive, view, or store your card or banking details at any point.

• PayPal: View PayPal Privacy Policy
• Afterpay: View Afterpay Privacy Policy
• Zip Pay: View Zip Pay Privacy Policy
• Apple Pay: View Apple Privacy Policy

By selecting any of these payment methods at checkout, you are also subject to that provider's terms and privacy policy. We are not responsible for their independent privacy or security practices.

9. International Shipping and Customs Disclosure

When we ship your order internationally, your personal information (name, address, and a description of order contents) may be disclosed to:

• Shipping and logistics carriers engaged by our Asia-based artisan suppliers to transport your order
• Customs and border protection agencies in your country and in transit countries, as required by applicable law

These disclosures are legally required for international fulfilment and are beyond our control.

10. Who Else We Share Your Information With

Beyond the parties described above, we may share your personal information only in the following limited circumstances:

• Legal or regulatory authorities — where required by law, a court order, or to defend our legal rights
• Fraud prevention — where we reasonably suspect fraudulent activity
• Business transfers — in the unlikely event of a business sale or restructure, subject to equivalent privacy protections

We do not sell, rent, or trade your personal information. We do not share your data with advertising networks, data brokers, or marketing platforms.

11. Cookies

We use cookies for:

• Essential Site functionality (shopping cart, session management, checkout)
• Shopify's core platform operations

Essential cookies are strictly necessary and do not require your consent. They do not track you across other websites.

We do not use cookies for: advertising, retargeting, or third-party tracking. No Google Analytics, no Meta Pixel, no TikTok Pixel, no Pinterest Tag.

You can manage cookies through your browser settings. Disabling essential cookies may affect your ability to complete a purchase.

12. Children's Privacy

Our Site is intended for users aged 13 and over and is not directed at children under 13.

Children under 13 (United States — COPPA): We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information without your verifiable consent, contact us at info@nailu.au and we will delete that information promptly.

Children under 16 (EU and UK — GDPR): If you are under 16 and located in the EU or UK, you must obtain consent from a parent or legal guardian before providing any personal information or placing an order.

All minors: If we become aware that we have inadvertently collected personal information from a minor without appropriate consent, we will take immediate steps to delete that information.

13. Your Rights

To exercise any right, contact us at info@nailu.au. We will respond within 30 days.

All customers:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information (subject to legal retention obligations)

Australian customers: You may lodge a privacy complaint with the OAIC at www.oaic.gov.au or 1300 363 992 if unresolved by us.

EU and UK customers (GDPR / UK GDPR):

• Right to data portability
• Right to restrict processing
• Right to object to processing based on legitimate interest
• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority: EU authority directory | ICO (UK)

EU Representative: As a small business in the early stages of international operation, we are currently assessing our obligations under GDPR Article 27. We will appoint a representative as required as our EU customer base grows.

California customers (CCPA / CPRA — voluntarily adopted):

• Right to know what personal information we collect, use, and disclose
• Right to request correction or deletion of your personal information
• Right to opt out of the sale of personal information — we do not sell your personal information
• Right not to be discriminated against for exercising your CCPA rights

To remove your email from our mailing list: email info@nailu.au with the subject line "Remove My Email". We will action this within 5 business days.

14. Data Retention

Even if you request deletion, we may be legally required to retain certain transaction records for the periods specified below. We will inform you of the reason where this applies.

15. Electronic Communications and the Spam Act

We comply with the Spam Act 2003 (Cth). We will not send you unsolicited commercial electronic messages. If we ever send a commercial message, we will do so only with your consent, clearly identify ourselves as the sender, and include a functional unsubscribe mechanism.

Email addresses collected via our mailing list will not be used for ongoing marketing without seeking fresh consent from you.

16. Data Security

We have implemented the following security measures:

• HTTPS encryption across all pages of our Site
• Shopify's PCI-DSS Level 1 certified infrastructure for all checkout and payment data
• Access controls — only Elysay Sky as the sole operator of NAILU has access to customer data
• No card data storage — we never receive or store payment card or banking details

No method of data transmission over the internet is 100% secure. We are not liable for unauthorised access to your data that occurs despite these measures, to the maximum extent permitted by law.

17. Data Breach Notification

In the event of a security incident involving your personal data:

• We will contain and assess the breach as rapidly as possible
• Australian customers: where a breach is likely to result in serious harm, we will notify the OAIC and affected individuals under the Notifiable Data Breaches scheme, as voluntarily adopted
• EU/UK customers: we will notify the relevant supervisory authority within 72 hours and notify affected individuals without undue delay as required under GDPR Articles 33–34

18. User-Generated Content

Our Site does not currently support product reviews or photo submissions. If we introduce these features in the future, this policy will be updated before those features go live. Existing mailing list subscribers will be notified of any such material changes.

19. Third-Party Links

Our Site may contain links to third-party websites. Clicking those links takes you outside our Site and this Privacy Policy. We are not responsible for the privacy practices of external sites and encourage you to review their policies independently.

20. Changes to This Policy

We may update this Privacy Policy as our business grows or applicable laws change. When we do, we will update the version number and "Last updated" date at the top of this document.

For material changes, we will make reasonable efforts to notify our mailing list in advance.

For EU and UK customers: where a material change requires fresh consent, we will seek that consent directly and will not rely on continued use of our Site as implied acceptance.

For all other customers, continued use of our Site after changes are posted constitutes acceptance of the updated policy.

21. Governing Law

This Privacy Policy is governed by the laws of the state of Queensland, Australia. Any disputes are subject to the exclusive jurisdiction of the courts of Queensland, without prejudice to your rights under the mandatory laws of your country of residence.

22. Contact Us

We genuinely welcome questions, concerns, and feedback about how we handle your data.

Elysay Sky trading as NAILU
ABN: 57 133 490 900
PO Box 23, Moorooka QLD 4105, Australia
Email: info@nailu.au
Website: www.nailu.au

For unresolved privacy complaints — Australia:
Office of the Australian Information Commissioner (OAIC)
www.oaic.gov.au | 1300 363 992

For unresolved privacy complaints — EU and UK:
EU authority directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en
UK authority (ICO): https://ico.org.uk

Version 1.0 — This Privacy Policy is effective as of 22 June 2026 and supersedes all prior versions.

All privacy inquiries are handled securely and reviewed personally.