PRIVACY STATEMENTS

Last updated: 28 August 2026

1. About this policy

This Privacy Policy explains how Generation UCAN Ltd (“we”, “us”, “our”) collects, uses, stores and discloses your personal information when you visit generationucan.com.au or buy from us.

We are committed to protecting your privacy. We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), the New Zealand Privacy Act 2020 where applicable, and the UK General Data Protection Regulation.

2. Who we are

Generation UCAN Ltd is a company registered in England and Wales under company number 13974596. We trade in Australia as Generation UCAN Australia under Australian Reference Number (ARN) 3000 2265 9464.

3. What personal information we collect

When you place an order, sign up to our newsletter, leave a review or contact us, we may collect:

• Your name
• Email address
• Postal and delivery address
• Phone number, if you provide it
• Payment information. Card details are processed by our payment providers and are never stored on our servers or seen by us.
• Order history and product preferences
• The contents of your cart, including where you begin a checkout and do not complete it
• Your marketing preferences, including whether you have opted in to receive email from us
• Product reviews and ratings you choose to submit
• Referral or discount codes you use, including codes issued through our ambassador programme
• Communications you send us, such as emails and support requests
• Information about how you use our website, including IP address, browser type, device, pages visited and referring URL, collected through cookies and analytics tools

We do not knowingly collect personal information from anyone under 15 years of age. Our products are not suitable for children under 15 years of age and we do not market to minors.

4. How we collect it

We collect personal information directly from you when you:

• Place an order on our website
• Create an account
• Subscribe to our newsletter or sign up via a popup
• Tick the marketing opt-in checkbox at checkout
• Submit a product review
• Contact us by email or social media
• Respond to a survey or promotion

We also collect information automatically when you visit the site, through cookies and similar technologies. See Section 8 below.

5. How we use your information

We use your personal information to:

• Process and fulfil your orders
• Communicate with you about your order, including confirmations, dispatch and delivery
• Send you a reminder if you leave items in your cart without completing your purchase
• Invite you to review a product you have purchased
• Provide customer service and respond to your enquiries
• Administer discount codes and our ambassador programme
• Send marketing communications, but only if you have opted in
• Improve our website, products and services
• Detect and prevent fraud, abuse or security incidents
• Comply with our legal and tax obligations, including ATO and HMRC record-keeping

Lawful bases under the UK General Data Protection Regulation

• Performance of a contract, for processing and delivering your order and providing customer service
• Consent, for marketing emails, non-essential cookies and product review invitations
• Legitimate interests, for site security, fraud prevention, cart reminders and improving our products and website
• Legal obligation, for tax and accounting records

Automated decision-making

Our payment providers use automated systems to screen transactions for fraud, which may result in a payment being declined. We do not otherwise use automated decision-making that produces legal or similarly significant effects on you. If a payment is declined, contact us and we will help you complete your order another way.

6. Who we share it with

We share your personal information with the following categories of service provider, only to the extent necessary to operate our business:

• Our third party logistics provider, located in Victoria, Australia, for order fulfilment and warehousing
• Australia Post and other carriers engaged by us or by our logistics provider, for delivery
• Our payment providers, for payment processing and fraud screening
• Our email marketing provider, for newsletters and marketing campaigns
• Our transactional email provider, for order confirmations, dispatch notices and password resets
• Our cart recovery and post-purchase automation provider
• Our product review provider, for collecting and publishing reviews
• Our affiliate and referral tracking provider, for our ambassador programme
• Our website host and content delivery network, for hosting, site performance and security
• Google, for website analytics, tag management and reCAPTCHA anti-spam protection

We also share limited order and customer service information with our own personnel and contractors, who are described in Section 7.

We select service providers that are bound to protect your information under their own terms of service and applicable privacy laws.

We may also disclose your personal information:

• To comply with a court order, subpoena or other legal requirement
• To respond to a request from a government regulator, such as the ACCC, OAIC, ATO or TGA
• To enforce our Terms and Conditions or protect our rights, property or safety
• In the event of a sale, merger or restructure of our business, in which case the recipient must agree to handle your information in accordance with this Policy

We do not sell your personal information to third parties for their own marketing purposes.

7. Overseas disclosure

We are a UK-registered company with a small international team and global service providers. Your personal information will be transferred to, stored in, or accessed from countries outside Australia and New Zealand, including:

• The United Kingdom, where Generation UCAN Ltd is registered and where our accounting and payment records are held
• Thailand and Indonesia, where our directors, personnel and contractors are located and where they access order and customer service information in the course of running the business
• The United States and the European Union, where our payment, email, analytics, hosting and content delivery providers operate
• Other countries in which our service providers or their subcontractors maintain data processing operations

By providing us with your personal information, you consent to this overseas transfer. We take reasonable steps to ensure that overseas recipients handle your information consistently with the Australian Privacy Principles. Personnel and contractors who access customer information are bound by confidentiality obligations and are given access only to what they need to do their work.

You should be aware that overseas recipients may be subject to different privacy laws. The United Kingdom and European Union have privacy laws broadly equivalent to or stronger than Australia’s. Other recipients are bound by contractual data protection terms.

8. Cookies and tracking

Our website uses cookies and similar technologies. We use:

• Strictly necessary cookies, required for the site to function, such as keeping items in your shopping cart, processing checkout, caching pages and protecting our forms from spam. These cannot be disabled.
• Analytics cookies, which help us understand how visitors use the site. Data is collected and reported in aggregate.

We do not currently use advertising or retargeting cookies. We do not run advertising pixels on this website and we do not track you across other websites.

You can control cookies through your browser settings. If you disable non-essential cookies, parts of the site may not work as intended.

We do not currently respond to “Do Not Track” browser signals, as no common industry standard exists for how to interpret them.

9. How we protect your information

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps include:

• Storing data on secured servers
• Restricting access to authorised personnel on a need-to-know basis
• Processing all payments through PCI DSS compliant payment providers, so that card details never reach our systems
• Using SSL encryption for all data transmitted to and from our website

No method of transmission over the internet is completely secure. While we use reasonable efforts to protect your information, we cannot guarantee absolute security.

10. Data breach response

If we become aware of a data breach likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). For New Zealand customers, we will notify the Office of the Privacy Commissioner where required under the New Zealand Privacy Act 2020. Where the UK General Data Protection Regulation applies, we will notify the UK Information Commissioner’s Office without undue delay and, where required, within 72 hours.

11. How long we keep your information

We retain your personal information only for as long as we need it for the purposes set out in this Policy, or as required by law:

• Order and transaction records: 7 years, to meet ATO and HMRC tax record-keeping requirements
• Marketing list data: until you unsubscribe. Your email address is then retained on a suppression list so we can continue to honour your unsubscribe request, as required by the Spam Act 2003 (Cth).
• Abandoned cart data: retained only for as long as needed to send reminder emails, then deleted
• Product reviews: retained while published, or until you ask us to remove them
• Customer service correspondence: up to 3 years from your last interaction
• Website analytics data: anonymised and retained per Google Analytics defaults, currently 14 months

12. Your rights

Under Australian, New Zealand and UK law, you have the right to:

• Access the personal information we hold about you
• Ask us to correct any inaccurate information
• Ask us to delete your personal information, subject to our legal obligation to retain transaction records
• Withdraw consent for marketing at any time, including by clicking “unsubscribe” in any marketing email
• Make a complaint about how we handle your information

Where the UK General Data Protection Regulation applies to your information, you also have the right to:

• Ask us to restrict how we use your information
• Object to our use of your information where we rely on legitimate interests
• Receive a copy of the information you gave us in a portable, machine-readable format, or ask us to transfer it to another provider

To exercise any of these rights, email us at sales@generationucan.com.au. We will respond within 30 days.

If you are not satisfied with our response, you can lodge a complaint with:

• Office of the Australian Information Commissioner (OAIC), oaic.gov.au
• Office of the Privacy Commissioner New Zealand, privacy.org.nz
• UK Information Commissioner’s Office (ICO), ico.org.uk

13. Changes to this policy

We may update this Policy from time to time. The “Last updated” date at the top of the page shows when it was last revised. We encourage you to review this page from time to time.

14. Contact us

For any privacy-related questions or to exercise your rights: