Last updated: September 8, 2026

The Policy at a Glance

We respect your privacy and want you to know exactly how your information is handled. This summary is for convenience only. Please refer to the full Privacy Policy below for complete details.

What we collect

• Basic details you share (like name, email, shipping address).

• Order history and payment details (processed securely by trusted providers).

• How you use our site/app (via cookies and analytics), including recognising your device across visits for longer than a standard browser session, using cookies we control directly (including one served from our own subdomain) or by referencing cookies already set by other tools we use (e.g. Shopify, Google, TikTok, Meta).

• Messages or info you send us (e.g. customer care, competitions, DMs).

Why we collect it

• To deliver your orders and provide customer support.

• To personalise your shopping experience.

• To send you updates and offers (only if you opt in).

• To show you relevant ads on platforms like Instagram, Facebook, TikTok and Google.

• To meet legal, tax and fraud-prevention requirements.

Who we share it with

• Service providers who help VRG GRL provide the best possible shopping experience.

• Advertising and analytics partners, solely to display VRG GRL’s own advertisements to you.

• Legal authorities where required.

• No one else — we do not sell your personal information, and we do not share it with third parties for their own advertising purposes.

Your choices

• You can opt out of marketing anytime (unsubscribe links, SMS stop commands, push settings).

• You can manage cookies and ad tracking through your browser, device, or our consent banner.

• You can ask us to access, update or delete your personal data.

How we protect your data

• Encryption, firewalls, and strict access controls.

• Retained only as long as needed (e.g. order records for 7 years for tax).

• Transfers outside Australia (like to the US/EU) use legal safeguards.

The full Privacy Policy below explains everything in detail, including your rights under the Privacy Act and GDPR.

Full Policy

This Privacy Policy applies to all personal information collected by VRG GRL Operations Pty Ltd ABN 24 641 978 814.

VRG GRL recognises and values the protection of your personal information. We are committed to handling your data responsibly and in line with the Privacy Act 1988 (Australia), the General Data Protection Regulation (GDPR) in the EU and UK, and other applicable international privacy laws.

This policy explains what we collect, how we use it, and the rights you have. By using our website, app or services, you consent to the collection, use and disclosure of your information as described here.

Information We Collect

When we say personal information, we mean details that can identify you, or could reasonably be used to identify you. We may collect:

• Contact details: name, email, phone, billing and shipping addresses.

• Account details: passwordless login information (we do not store passwords).

• Payment information: securely processed by providers such as Shopify Payments, Afterpay, Google Pay, Apple Pay, PayPal, Zip Pay, and credit card processors (we do not store full card details).

• Purchase history and order details.

• Marketing preferences: subscriptions to email, SMS and push notifications.

• Device and browsing data: IP address, browser type, cookies, device identifiers, and how you use our website and app.

• App-specific data: device information, crash logs, and analytics to improve stability and performance.

• Location data (if enabled).

• Any other information you provide directly (e.g. surveys, competitions, customer care). We do not collect sensitive information such as health, political opinions or criminal history.

How We Collect Information

• Directly from you when you make a purchase, create an account, download or use our app, join our loyalty program, subscribe to marketing or contact us.

• When you interact with our website, app, marketing emails or push notifications, or engage with us on social media.

• Automatically through cookies, SDKs and tracking tools.

• Through re-identification technology provided by Klaviyo, our marketing platform. This includes (i) a cookie we serve directly from a subdomain of our own website to keep you recognised for longer, and (ii) cross-referencing first-party identifiers already placed by other tools we use on our site (such as Shopify, Google, Meta, or TikTok). Neither method creates a new profile from information gathered on other websites - they only extend recognition of visitors who already have an existing VRG GRL profile (for example, from a previous purchase, account signup, or newsletter subscription).
• Via partners such as Microsoft Clarity for behavioural metrics and site optimisation (see the Microsoft Privacy Statement), Yotpo for loyalty program functionality, and TripleWhale for marketing analytics and advertising attribution.

• From trusted third-party partners such as payment processors, shipping carriers, marketing and data partners.

How We Use Your Information

• Process, fulfil and deliver your orders.

• Send transactional updates about your orders, returns or account.

• Provide customer support.

• Personalise your shopping experience across our website, app and marketing channels.

• Send marketing via email, SMS and push notifications, where you have opted in.

• Send cart reminders (with consent and in compliance with relevant laws such as the US TCPA).

• Show you relevant VRG GRL advertisements on social platforms and other websites through advertising partners.

• Analyse and improve our website, app and services.

• Detect and prevent fraud.

• Comply with legal and tax obligations.

We may also use your information for advertising and profiling with partners such as Meta, Google, TikTok and Pinterest, solely to display VRG GRL’s own advertisements to you and audiences similar to you, in line with your cookie choices and applicable laws.

Sharing Your Information

We do not sell your personal information. We may share data with:

• Service providers that support our business operations (Shopify, Klaviyo, Yotpo, TripleWhale, payment gateways, shipping carriers, analytics providers). Our use of Klaviyo's re-identification features (see Cookies and Tracking) does not involve sharing your information with any new third party beyond those already listed in this policy. The subdomain used to serve one of these cookies is configured by us and operated by Klaviyo on our behalf - it is not a separate company receiving your data. To measure and improve the performance of our advertising, Triple Whale may share a hashed (non-readable) version of your contact details with Meta, Google, TikTok and Pinterest, solely so that we can better understand which of VRG GRL's own ads led to your visit or purchase. This is not used by those platforms for their own independent purposes.

• Advertising and social media platforms (such as Meta, Google, TikTok and Pinterest) solely to display VRG GRL advertisements to you and audiences similar to you, based on your consent and applicable law. We do not transfer your personal information to these platforms for their own independent marketing or commercial purposes.

• Professional advisers, auditors and legal authorities where required by law.

• A purchaser or successor in the event of a business sale.

No Sale or Independent Use of Your Data

We do not sell, rent, or share your personal information with any third party for that third party’s own independent advertising or commercial purposes. Where we share data with advertising platforms, this is solely to facilitate the display of VRG GRL’s own advertisements and is subject to your consent choices. SMS and RCS opt-in data is never used for third-party advertising, profiling, or sold to any party under any circumstances.

International Data Transfers

Your information may be transferred outside Australia, including to the US, UK, EU and Canada, with appropriate safeguards (e.g. Standard Contractual Clauses).

Cookies and Tracking

We use cookies and similar technologies for the following purposes:

Essential — required for core site functions such as your shopping cart and checkout. These cannot be disabled through our cookie settings.

Functional — remember your preferences (such as region or currency) and recognise you across visits for longer than a standard browser session. Some browsers (notably Safari) limit how long a website can remember you - in some cases to as little as 24 hours. To reduce how often you appear as a "new" visitor when you're not, we use two features of our marketing platform, Klaviyo: a cookie Klaviyo serves directly from a subdomain of our own website, to refresh your recognition without relying on your browser alone; and cross-referencing other first-party identifiers already present in your browser from tools we use on our site (such as Shopify, Google Analytics, or TikTok). Together these can extend recognition for up to 24 months, depending on your browser. Neither feature uses device fingerprinting, IP address, or device/browser "guesswork" matching; neither can create a profile for you if one doesn't already exist with us; and neither tracks you across unrelated companies, devices, or browsers.

Analytics — help us understand site traffic and customer behaviour so we can improve our website and app. Includes Google Analytics and Triple Whale, which measures how well our advertising performs.

Advertising — used to deliver relevant VRG GRL advertising and promotions on platforms such as Meta, Google, TikTok and Pinterest, and to measure how well they perform.

You can manage tracking through your browser's cookie settings, device permissions, and, where applicable based on your location, our cookie consent banner. 

Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of the sale or sharing of your personal information, consistent with your rights under the California Privacy Rights section below.

Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. Measures include encryption, firewalls and secure server environments.

Phishing and fraud awareness: We’ll never ask you to share sensitive details by email, SMS or social direct message. If you receive a suspicious message, forward it to info@vrggrl.com.

Data Retention

• Order and payment records: kept as required under tax and accounting laws (generally 7 years in Australia).

• Account data: retained while your account is active and for a reasonable period after closure.

• Marketing preferences: kept until you withdraw consent.

• Analytics and usage data: retained for shorter periods unless needed for security or fraud prevention.

• Extended recognition cookies: where enabled, may be retained and refreshed for up to 24 months (varying by browser) to keep your visits recognised as belonging to the same profile, consistent with the Cookies and Tracking section above.
  

Children’s Privacy

Our services are not directed to children under 16 (or under 13 in the US). We do not knowingly collect personal information from children. If you believe your child has provided information, contact us to delete it.

Automated Decision-Making and Profiling

We use limited profiling to personalise recommendations, marketing and advertising. We do not make decisions with legal or similarly significant effects based solely on automated processing.

Marketing Preferences

• Email: use the unsubscribe link in our emails.

• SMS: use the opt-out link included in our texts or reply STOP (see our Terms of Service).

• Web push notifications: update permissions in your browser settings.

• App push notifications: adjust notification settings in your device or app preferences.

Links to Other Websites

Our site and app may link to third-party websites or services that we do not control. Their privacy policies govern their handling of your data.

Your Rights

• Access the personal information we hold about you.

• Correct or update your information.

• Request deletion of your personal information.

• Restrict or object to certain processing activities.

• Withdraw consent for marketing communications at any time.

• Request a copy of your information in portable format (EU/UK customers).

We may ask you to verify your identity before acting on your request.

Complaints Handling

• Australia: Office of the Australian Information Commissioner (OAIC) – www.oaic.gov.au

• UK: Information Commissioner’s Office (ICO) – https://ico.org.uk/make-a-complaint/

• EU: Your local Data Protection Authority.

• Canada/US: Your local privacy authority.

• All other locations: Your local privacy authority.

California Privacy Rights

• Access the personal information we hold about you.

• Request correction of inaccurate data.

• Request deletion of your data.

• Opt out of the sale or sharing of your data (including cross-context behavioural advertising).

To exercise these rights, submit a request here. We will respond within 45 days.

EU & UK GDPR Privacy Rights

• Access – Obtain confirmation of whether we process your personal data and receive a copy.

• Rectification – Request correction of inaccurate or incomplete personal data.

• Erasure (“Right to be Forgotten”) – Ask us to delete your personal data where there is no overriding legal reason to keep it.

• Restriction – Request that we limit the processing of your data in certain circumstances.

• Data Portability – Receive your personal data in a structured, machine-readable format and transmit it to another controller.

• Object – Object to processing of your personal data based on our legitimate interests or for direct marketing.

• Withdraw Consent – If we rely on consent, you can withdraw it at any time without affecting prior processing.

To exercise these rights, use our Privacy Centre or email info@vrggrl.com.

Your Consent

By using our website, app, or services, you consent to the collection, use and disclosure of your personal information in line with this Privacy Policy.

Updates to This Policy

We may update this policy from time to time. Updates will be posted on our website and app with a revised effective date.

Manage Your Privacy Choices

Manage your privacy choices through our Privacy Center.

Contact Us

Privacy Officer (for privacy matters):
Email: info@vrggrl.com
Address:
VRG GRL Privacy Officer
12 Byres Street,
Newstead QLD 4006,
Australia

Customer Service: info@vrggrl.com | +61 7 3063 4242

Store enquiries:
Warringah Mall
warrinaghmall@vrggrl.com | Shop 1204, Cnr Condamine St & Pittwater Rd, Brookvale NSW 2100, Australia

Bondi
bondi@vrggrl.com | 3/82-92 Gould Street, Bondi Beach, NSW 2026, Australia