Privacy Policy

Last updated: September 26, 2026

This Privacy Policy describes how Pep Brands Pty Ltd ("Pep", "we", "us", "our") collects, uses and discloses your personal information when you visit eatpep.com or make a purchase, whether you're in Australia, New Zealand, the United States, or elsewhere (collectively, the "Services"). "You" and "your" means you as a user of the Services, whether a customer, website visitor, or another individual whose information we've collected under this policy.

Please read this Privacy Policy carefully.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal or regulatory reasons. The "Last updated" date above shows when this policy was last revised. Changes take effect when we post the revised policy on the Site.

What Personal Information We Collect

The personal information we collect depends on how you interact with our Site and Services.

Information you give us directly, which may include:

• Basic contact details — name, address, phone number, email

• Order information — billing and shipping address, payment confirmation, email, phone number

• Account information — username, password, security questions

• Shopping information — items you view, add to cart or wishlist

• Customer support information — anything you include in messages to us

Some features may require this information; you may choose not to provide it, but that may prevent you from using those features.

Information we collect automatically. We automatically collect certain information about your interaction with the Services ("Usage Data"), using cookies, pixels and similar technologies — see Cookies, below. This can include device and browser information, network and IP information, and how you navigate and interact with the Site.

Information we obtain from third parties, including from vendors and service providers who collect information on our behalf, such as:

• Companies who support our Site and Services, including Shopify

• Our payment processor(s), who collect payment information to process your order. If you make a payment through the Services, your payment data is collected directly by the third-party payment processor and is subject to their privacy policy, not this one

• Third parties we work with when you visit our Site, open or click our emails, or interact with our ads, who may automatically collect information using cookies

We are not responsible for the accuracy of information provided to us by third parties, or for their policies or practices. See Third-Party Websites and Links, below.

How We Use Your Personal Information

• Providing our products and services. Processing payments, fulfilling orders, arranging shipping, handling returns and exchanges, managing your account, and enabling reviews.

• Marketing and advertising. Sending marketing, advertising and promotional communications by email, text or post, and showing you advertisements for our products, including on other websites.

• Security and fraud prevention. Detecting, investigating and acting on suspected fraudulent, illegal or malicious activity. If you register an account, you're responsible for keeping your login details safe.

• Communicating with you and providing support.

• Complying with applicable law.

• Business purposes. Data analysis, audits, identifying usage trends, measuring the effectiveness of our marketing, and developing and improving our Site and Services.

We may aggregate and/or anonymise personal information so it's no longer identifiable, and use or disclose that data for any purpose.

Cookies

We and our service providers automatically collect information through cookies, pixels and similar technologies, including your browser/device information (used to ensure the Services function properly) and cookies that track browsing, time spent on pages, content viewed, and similar usage data.

We currently use:

• Shopify's own cookies, which power the store itself — see shopify.com/legal/cookies

• Meta (Facebook/Instagram) Pixel, for advertising and retargeting

• Google Analytics, to understand Site usage — see google.com/policies/privacy and the opt-out browser add-on

• Klaviyo, for email and SMS marketing

• Appstle, for subscription management

Cookies also help us track items in your cart, including abandoned carts, which we use to decide when to send cart-reminder messages. We will not share your SMS opt-in status with third parties except those who help us deliver our messaging services (e.g. platform providers, phone companies).

We do not currently respond to browser do-not-track signals.

Most browsers let you decline cookies or choose which to accept — see allaboutcookies.org. If you decline cookies, some parts of the Site may not work as intended, and you may see ads that are less relevant to you.

How We Disclose Personal Information

We may disclose your personal information:

• To vendors and service providers who help us run our business — including Shopify, our payment processor(s), and our shipping and fulfilment providers

• To marketing and advertising partners, including Shopify, to advertise to you — they use your information under their own privacy policies

• When you direct or consent to disclosure — for example, to ship you a product

• To our affiliates, within our corporate group

• As required to comply with law, respond to government or law enforcement requests, enforce our Terms of Service, or protect our rights, privacy, safety or property, or that of others

• In connection with a proposed or actual reorganisation, merger, sale, or transfer of our business or assets

Hosting

Our Site is hosted on Shopify. Shopify provides the e-commerce platform that lets us sell our products and services to you. Your data may be stored through Shopify's data storage, databases and applications, on secure servers behind a firewall.

Payment Security

All direct payment gateways offered through Shopify and used by us adhere to the standards set by PCI-DSS, managed by the PCI Security Standards Council — a joint effort of brands including Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure secure handling of credit card information by our store and its service providers.

User-Generated Content

The Services may let you post reviews or enter competitions that involve public submissions. If you submit content to any public area of the Services, that content is public and accessible by anyone. We're not responsible for the privacy or security of information you make publicly available, or for how others use it.

Third-Party Websites and Links

Our Site may link to websites or platforms operated by third parties. We're not responsible for the privacy or security practices of sites we don't control — please review their policies before engaging with them. A link from our Site doesn't imply our endorsement of the linked site.

Children's Personal Information

Our Services are not intended for use by children under 13, and we do not knowingly collect personal information from children under 13. If you're the parent or guardian of a child under 13 who has provided us with their personal information, please contact us using the details below to request its deletion.

Security and Retention

No security measures are perfect, and we cannot guarantee "perfect security." Information you send us may not be secure in transit — please avoid unsecure channels for sensitive information.

How long we retain personal information depends on factors including whether we need it to maintain your account, provide our Services, comply with legal obligations, or resolve disputes.

Your Choices

Marketing emails: unsubscribe using the link in any marketing email from us. You may still receive important administrative messages.

SMS/text messages: reply STOP to any message from us, or contact hello@pepbrands.co.

Updating your information: contact us at hello@pepbrands.co.

Additional privacy rights: We do not sell your personal information. If this changes, or if our business grows such that additional privacy rights (such as under the California Consumer Privacy Act) apply to you, we will update this policy accordingly.

Third-Party Advertising

We use third-party advertising companies to serve ads about products that may interest you when you use our Site or other websites. These companies may place or recognise cookies (including pixel tags) on your browser, and use them, along with information about your online activity, to recognise you across your devices.

To learn more or opt out in your desktop and mobile browsers, visit optout.aboutads.info and optout.networkadvertising.org.

We use Shopify's advertising services, such as Shopify Audiences, to help personalise the ads you see on third-party websites. To restrict this use of your personal information, visit privacy.shopify.com/en.

Cross-Border Transfer

Your personal information may be stored and processed in any country or region where we or our service providers have facilities, including Australia, the United States, and elsewhere. By using our Site or Services, you understand your personal information may be transferred to countries with different data protection rules than your own. In some cases, courts, law enforcement, regulatory or security authorities in those countries may be entitled to access your personal information.

Contact

Questions about our privacy practices or this Privacy Policy can be sent to hello@pepbrands.co.

Pep Brands Pty Ltd PO Box 286, Fairfield VIC 3078, Australia