Age verification and your privacy

Australian law requires us to confirm you are 18 or over before we supply shisha tobacco. This page explains when we ask, how the check works, and what happens to your information.

When we ask for ID

Only in two situations:

• Your order contains shisha tobacco.
• Your payment is flagged for review by our payment provider.

Orders for hardware and accessories are not affected.

How the check works

1. You upload a photo of your driver licence, passport or proof-of-age card.
2. An independent provider, Real ID, confirms your date of birth.
3. Your account is recorded as verified. You will not be asked again.

An expired document is still accepted. We are confirming your date of birth rather than whether the document is current. It does not pass automatically, though. One of our staff views it and approves it by hand.

If a check cannot be completed, we cancel the order and refund it in full. If the problem is a blurred photo or glare, you can resubmit, or contact us and one of our staff will review the document by hand.

What we can see

Your ID image is not stored on our website. We receive a pass or fail result, a reference token, and the name and date of birth needed to process your order.

Where the check passes automatically, we do not receive your licence number or the address shown on your ID. Where it does not pass automatically, because the document has expired or the check is flagged for an error, our authorised staff view the document through Real ID to approve or decline it by hand, and can see those details. We use them only to confirm your identity and age.

We do not sell, rent or share your information with advertisers.

Where your information is held

Real ID stores identity data on Amazon Web Services, encrypted in transit and at rest.

How long we keep it

Identity data is held for a limited period and deleted automatically at the end of it. You can ask us to delete it sooner at any time.

We keep records of age checks and refused sales for our own audit and licensing obligations. Those records do not contain your ID image.

Who can see it

Access is limited to the people who need it to process an order, review a payment, or answer a query from you. It is not used for marketing and never for profiling.

Your rights

• Ask what personal information we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete your verification data.
• Withdraw your consent — though we then cannot supply age-restricted products.
• Make a complaint about how we have handled your information.

We respond within 30 days, as required by Australian Privacy Principle 12.

If something goes wrong

If a data breach occurs that is likely to cause serious harm, we will notify the Office of the Australian Information Commissioner and the people affected, as required under the Notifiable Data Breaches scheme. We require Real ID to tell us promptly of any breach affecting data held on their systems.

In store and Click & Collect

Our staff ask for photo ID where they cannot be confident a customer is over 18, and are trained to ask rather than assume.

For Click & Collect orders containing shisha tobacco, the person collecting must be 18 or over and will be asked for ID.

Orders we cannot fill

We may hold, cancel or refuse an order where:

• age cannot be confirmed;
• identification appears altered or inconsistent;
• a payment is declined for fraud reasons; or
• we believe the purchase is being made for someone under 18.

A cancelled order is refunded in full to the original payment method.

Delivery

Orders containing shisha tobacco are sent with delivery controls intended to reduce the risk of a parcel reaching someone under 18, including signature on delivery where available.

Contact us

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner or Consumer Affairs Victoria.