Privacy Policy

Last Updated: June 7, 2026

1. Overview & Data Controller Identification

This Privacy Policy describes how Zewao (hereinafter referred to as "the Store", "we", "us", or "our"), a brand wholly owned and legally operated under the corporate structure of ONLY BANH MI PTY LTD (ABN: 28 697 476 878), collects, utilizes, retains, protects, and discloses your personal information when you browse, interact with, access, or execute a commercial transaction via our digital commerce portal www.zewao.shop (the "Services").

Our digital infrastructure is technically powered by Shopify, which acts as our primary data processor enabling the logistical delivery of our online Services to consumers located within the United States. If any operational conflict arises between our terms of service and this Privacy Policy, this instrument shall strictly dictate our structural protocols regarding consumer data protection.

By engaging with our Services, you explicitly acknowledge that you have read, understood, and consented to the data collection and operational practices codified within this comprehensive document.

2. Exhaustive Taxonomy of Personal Information We Process

We process distinct categories of data to provide a seamless, highly secure, and custom-tailored commercial experience. The depth of data processed relies directly on your behavioral interactions with our digital environment:

• Identity & Essential Contact Logs: Legal first and last name, verified physical delivery shipping address, billing address, active email communication channels, and mobile or landline telephone numbers.
• Financial Framework & Transaction Security Data: Encrypted credit card details, debit card identifiers, digital tokenized financial account metadata, payment confirmation receipts, and comprehensive transaction summaries. All checkout details are directly parsed to certified PCI-DSS compliant payment gateways.
• Account Authentication Credentials: Securely hashed usernames, automated passwords, custom account preferences, and targeted system settings.
• Commercial Behavioral Metrics: Documented records of item files viewed, products placed into shopping carts, wishlist additions, real-time purchase logs, historical order tracking profiles, return filings, and cancelation records.
• Direct Consumer Communications: Any specific text strings, document attachments, or metadata provided directly when submitting interactive customer care or support tickets to info@zewao.shop.
• Automated Device & Network Identifiers: Dynamic and static Internet Protocol (IP) addresses, unique device hardware serial numbers, specific web browser configurations, operating system architectures, and regional network access tokens collected automatically via secure browser sessions.

3. Structural Mechanisms of Data Collection

We procure personal information utilizing four core structural vectors:

1. Direct Submission: Information volunteered explicitly by your person during account onboarding, order placement protocols, or live support engagement.
2. Automated Network Tracking: Machine-level analytics gathered silently upon system initialization, utilizing native HTTP cookies, web beacons, tracking pixels, and server log infrastructures to monitor session navigation metrics.
3. Upstream Infrastructure Providers: Analytical data provided dynamically by our core platform provider, Shopify, to cross-verify transaction parameters and eliminate automated security vulnerabilities.
4. Third-Party Strategic Partners: Operational vectors including licensed payment merchant accounts, global freight forwarding systems, and authorized marketing data processing suites.

4. Justifiable and Legal Uses of Consumer Data

We deploy collected personal information strictly under established legal bases, structured precisely around the following business operational requirements:

• Fulfillment of Contractual Commitments: Processing underlying financial transactions, compiling individual shipping labels, validating warehouse logistics, sending digital order confirmations, managing eligible free 30-day returns, and delivering essential system alerts.
• Cybersecurity Safeguards & Fraud Deterrence: Cross-referencing billing data against financial risks, tracking system vulnerabilities, detecting unauthorized network entries, protecting human buyers from digital identity theft, and eliminating bot-driven malicious attacks.
• Transparent Promotional Communication: Transmitting targeted commercial announcements, discount parameters, and cross-channel marketing strategies aligned strictly with your communication opt-in history.
• Regulatory & Corporate Legal Compliance: Preserving explicit transaction archives required to satisfy international tax assessments, responding to valid judicial mandates, protecting parent corporate assets, and facilitating civil discovery protocols when legally required.

5. Controlled and Documented Disclosures of Data

Zewao does not sell your private details for unverified financial gain. We only disclose personal information to specified third-party entities to execute necessary business functions:

• To Core Logistics & Operational Vendors: Transmitting data to Shopify, premier international payment merchant accounts (such as Visa, Mastercard, AMEX, PayPal), and domestic US delivery carriers (including USPS, FedEx, DHL) to directly execute order delivery.
• To Licensed Advertising Intermediaries: Utilizing tracking tags to deploy contextual marketing displays via verified online ad spaces, operating in strict synchronization with standard global consumer privacy frameworks.
• To Corporate Affiliates: Internal reporting pathways structurally maintained under the asset tracking protocols of our parent entity, ONLY BANH MI PTY LTD.
• Under Extraordinary Contingencies: Disclosing files during corporate restructuring, handling active bankruptcy actions, responding to authenticated judicial subpoenas, enforcing our legal policies, or protecting the safety of the public or our users.

6. United States Regional Privacy Adaptations (CCPA / CPRA Compliance)

If you reside within the United States (including California, Virginia, Colorado, and other states maintaining specialized data protection legal standards), you possess specific statutory rights regarding your personal information:

• Right to Know and Access: The right to demand a completely readable, itemized summary detailing exactly what personal parameters we have logged over the previous 12-month trailing period.
• Right to Deletion: The right to order the complete, structural purging of your personal records from our databases, subject to specific legal and financial auditing exceptions.
• Right to Correction: The right to modify or adjust inaccurate data fields tied to your identity profile.
• Right to Opt-Out of Sale or Targeted Sharing: Although we do not sell data for monetary compensation, our deployment of third-party tracking pixels for behavioral advertising may be categorized as "sharing" under certain state laws. You retain an absolute right to opt out of these configurations via our cookies preference banner or the designated links pointing to the Shopify Privacy Portal.

To exercise any of these state-specific consumer protections, please submit an explicit request to our legal intake infrastructure at info@zewao.shop. We will never discriminate, degrade service speed, or modify pricing matrixes based on your choice to exercise your personal data rights.

7. Data Retention Boundaries & Imperfect Security Disclaimer

We retain your personal transaction history only for the duration required to achieve active business processing needs, manage account infrastructures, settle localized warranty timelines, or fulfill mandatory statutory record-keeping periods enforced by corporate tax authorities (up to 7 fiscal years for certified commerce invoices).

While we implement elite, multi-layered 256-bit SSL encryption to insulate all digital records during network transit, no internet data storage channel can be guaranteed as 100% impenetrable. Consequently, we explicitly notify consumers that sensitive information transmitted via unsecured personal email chains is done at the user's independent risk. We highly urge you to preserve the absolute confidentiality of your private account credentials.

8. International Data Movements & Cross-Border Frameworks

By executing an order on www.zewao.shop, you understand that your tracking and transactional summaries are processed across international lines, passing securely through global database facilities managed by Shopify and our parent company, ONLY BANH MI PTY LTD, located within Australia, the United States, and secondary international storage zones. For transfers originating out of regulated zones (such as the EEA or UK), we rely rigorously on authorized Standard Contractual Clauses (SCCs) to validate cross-border security compliance.

9. Protection of Minor Consumers (Children's Privacy Notice)

Our website and commercial products are intentionally designed exclusively for adult consumers who have attained the legal age of majority within their specific domestic jurisdiction. We do not knowingly target, track, or harvest personal data from children. If a parent or authorized guardian discovers that a minor has submitted personal tracking information to our store, contact us immediately at info@zewao.shop, and we will delete the corresponding file records immediately.

10. Complete Legal Contact Architecture

For any formal inquiries regarding our data handling procedures, to file an administrative complaint, or to formally execute your consumer data rights, please contact our corporate compliance infrastructure directly through the verified channels documented below:

• Dedicated Compliance Email: info@zewao.shop
• Corporate Telephone Inbound Line: +61 480 806 854
• Physical Corporate Headquarters Address: ONLY BANH MI PTY LTD, 248 Barkly St, Footscray, VIC 3011, Australia