Privacy Policy

Who we are

This site is operated by Ova Dressed Pty Ltd, a company registered in New South Wales, Australia, trading as The Process Studio. Ova Dressed Pty Ltd is the data controller responsible for your personal information collected on this site.

For any privacy question, data access request, correction, or deletion request, please contact us at info@theprocess.studio. We respond within 30 days.

What we collect

We collect only the personal information necessary to run the site and deliver what you’ve asked for:

• Name and email address — when you subscribe to the newsletter, purchase a ticket or record, claim a comp ticket, or join the vinyl waitlist.
• Shipping address and (optionally) phone — when you order a vinyl record for delivery.
• Order history — the items you purchased, order totals, and ticket references, so we can deliver your order, honour refunds, and admit you at the door.
• City / interest tags — when you subscribe to the newsletter, so we only email you about relevant shows and releases.

We do not collect: your payment card details, your location, tracking cookies, analytics data, social-media identifiers, or any information from third-party ad networks. This site runs no advertising, analytics, or tracking pixels of any kind.

How payment is handled

All payments are processed by Stripe Payments Australia Pty Ltd. Your card details are entered directly on Stripe’s hosted checkout page and are never sent to, seen by, or stored on our servers. Stripe is PCI-DSS Level 1 certified — the highest tier of card-data security compliance.

Stripe’s own privacy notice governs how they handle your payment data. You can review it at stripe.com/au/privacy.

Why we collect it (legal basis)

• To fulfil your order — performance of a contract between you and us (GDPR Art. 6(1)(b) / APP 6).
• To send you the newsletter — your explicit consent given at signup (GDPR Art. 6(1)(a) / APP 7). You can withdraw at any time via the unsubscribe link in every email.
• To meet our legal obligations — including tax records, refund processing, and consumer-law compliance (GDPR Art. 6(1)(c) / APP 6).
• To protect the site from fraud and abuse — legitimate interest (GDPR Art. 6(1)(f) / APP 6).

Who we share it with

We only share your personal information with the small number of service providers we need to run the site and honour your order:

• Stripe — to process payments and refunds.
• Resend — to send you order confirmations, ticket PDFs, newsletter emails, and reissue notices.
• Our hosting provider — to serve the site itself and store order records securely.

We do not sell, rent, or lease your personal information to anyone. We do not share it with advertisers, data brokers, or third parties for their own marketing.

International transfers

Some of our service providers store data outside Australia (Stripe holds servers in the US and EU; Resend and our hosting provider store data in the US). Where personal data leaves Australia, we rely on the provider’s Standard Contractual Clauses and equivalent safeguards to protect your information to a standard consistent with the Australian Privacy Act, UK GDPR, and EU GDPR.

How long we keep it

We keep order records for seven (7) years as required by Australian tax law. Newsletter subscriptions are kept until you unsubscribe. Vinyl waitlist entries are kept until the record ships or until you ask us to delete them. Once no longer needed, personal information is securely deleted.

Your rights

Under the Australian Privacy Act, UK GDPR, and EU GDPR, you have the right to:

• Access a copy of the personal information we hold about you.
• Correct anything inaccurate.
• Delete your personal information (right to erasure), subject to our legal record-keeping obligations.
• Withdraw consent to marketing at any time.
• Object to our processing on legitimate-interest grounds.
• Port your data to another service in a machine-readable format.

To exercise any of these rights, email info@theprocess.studio. We may ask you to verify your identity (typically by confirming the request from the email address we hold on file) before we action it. We respond within 30 days.

Data security

Card data is handled entirely by Stripe (PCI-DSS Level 1). Personal information we do hold is stored on access-controlled cloud infrastructure, encrypted in transit (TLS), and accessible only to a small number of authorised administrators. We take reasonable steps to protect against loss, misuse, and unauthorised access.

If a data breach ever occurs that is likely to result in serious harm to you, we will notify you and the relevant regulator (the Office of the Australian Information Commissioner and, where applicable, the UK ICO or EU supervisory authority) without undue delay, in accordance with the Notifiable Data Breaches scheme and GDPR Art. 33.

Cookies

This site uses only strictly-necessary cookies to keep your cart working across pages. We do not use analytics, tracking, advertising, or third-party cookies of any kind. No cookie consent banner is required under EU ePrivacy law because we set no non-essential cookies.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to newsletter subscribers and posted here at least 14 days before taking effect.

How to complain

If you are unhappy with how we handle your personal information, please contact us first at info@theprocess.studio. If we are unable to resolve your concern, you may lodge a complaint with:

• Australia: the Office of the Australian Information Commissioner — oaic.gov.au
• United Kingdom: the Information Commissioner’s Office — ico.org.uk
• European Union: your local data-protection authority.