Effective Date: 5 July 2026

MystiBox ("we", "our", "us") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, store and protect your personal information when you use our website, purchase products online, interact with our mystery box vending machines, or otherwise engage with our business.

​

1. Who We Are

Business Name: MystiBox

Website: www.mystibox.com.au

Email: info@mystibox.com.au

​

2. What Personal Information We Collect

Depending on how you interact with us, we may collect the following information:

• Full name

• Email address

• Shipping and billing address

• Phone number (if voluntarily provided)

• Payment information (processed securely by third-party payment providers)

• Purchase history

• Order details

• IP address

• Device and browser information

• Website usage information through cookies and analytics

• Customer service enquiries and correspondence

• Marketing preferences

When using one of our vending machines, we generally do not collect personal information unless you voluntarily provide it (for example, by scanning a QR code, entering a competition, registering a warranty, contacting customer support or making a cashless payment).

​

3. How We Collect Your Information

We collect personal information when you:

• Purchase products through our website

• Create an online account

• Subscribe to newsletters or promotions

• Contact us via email or online forms

• Participate in competitions or giveaways

• Complete surveys

• Interact with our website

• Make purchases using our vending machines where electronic payment or customer details are required

• Scan QR codes displayed on our vending machines

We may also collect technical information automatically through cookies and similar technologies.

​

4. Why We Collect Your Information

We collect your information to:

• Process and fulfil orders

• Deliver purchased products

• Process payments

• Provide customer support

• Respond to enquiries

• Improve our website and services

• Maintain our vending machine network

• Prevent fraud and unauthorised transactions

• Send order confirmations and shipping updates

• Send promotional communications where you have consented

• Meet legal and regulatory obligations

• ​

5. Payment Information

MystiBox does not store your full credit card or debit card details.

Payments made through our website or vending machines are securely processed by trusted third-party payment providers. These providers collect and process payment information under their own privacy policies.

​

6. Cookies and Website Analytics

Our website uses cookies and similar technologies to:

• Improve website functionality

• Remember user preferences

• Measure website performance

• Analyse visitor behaviour

• Deliver relevant marketing

You can disable cookies through your browser settings, although some features of the website may not function correctly.

​

7. Marketing Communications

If you subscribe to our mailing list, we may send you:

• Promotions

• New product announcements

• Competitions

• Special offers

• Business updates

You may unsubscribe at any time by clicking the unsubscribe link in our emails or contacting us.

​

8. Disclosure of Personal Information

We may disclose your personal information to trusted third parties where reasonably necessary, including:

• Payment processors

• Shipping and courier providers

• Website hosting providers

• Cloud storage providers

• IT service providers

• Marketing platforms

• Professional advisers

• Government or regulatory authorities where required by law

We do not sell or rent your personal information to third parties.

​

9. Overseas Disclosure

Some of our technology providers or service providers may store or process information outside Australia.

Where this occurs, we take reasonable steps to ensure your personal information receives appropriate protection consistent with Australian privacy laws.

​

10. Data Security

We take reasonable technical and organisational measures to protect personal information from:

• Loss

• Misuse

• Unauthorised access

• Modification

• Disclosure

While we take reasonable precautions, no internet transmission or electronic storage method can be guaranteed to be completely secure.

​

11. Accessing or Correcting Your Information

You may request access to the personal information we hold about you or request corrections if it is inaccurate or incomplete.

To do so, please contact us at:

Email: info@mystibox.com.au

We will respond within a reasonable timeframe.

​

12. Retention of Information

We retain personal information only for as long as necessary to:

• Provide our services

• Comply with legal obligations

• Resolve disputes

• Enforce our agreements

When information is no longer required, it is securely deleted or de-identified where practicable.

​

13. Children's Privacy

MystiBox does not knowingly collect personal information from children under the age of 16 without appropriate parental or guardian consent.

If you believe a child has provided us with personal information, please contact us so we can remove it where appropriate.

​

14. Mystery Box Purchases

Mystery boxes contain randomly assorted products.

Images used in advertising, promotional material or on our website are illustrative only and may represent examples of potential prizes.

Unless expressly stated otherwise, purchasing a mystery box does not guarantee receipt of any specific product, item or prize.

​

15. Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for the privacy practices or content of those websites and encourage users to review their privacy policies before providing personal information.

​

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Any changes will be published on our website with an updated effective date.

Continued use of our website, services or vending machines after changes are published constitutes acceptance of the updated Privacy Policy.

​

17. Contact Us

If you have any questions, concerns or complaints regarding this Privacy Policy or the handling of your personal information, please contact us:

MystiBox

Website: www.mystibox.com.au

Email: info@mystibox.com.au

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Website: https://www.oaic.gov.au