Last updated: 10 October 2026. This is the privacy notice for the Comfort-in store at injectneedlefree.com. The English text is the controlling version. The site language control can display other languages, including Polish. A machine translation is a convenience only. If it differs from this text, this English text governs.

1. Who we are

The controller of personal information collected through this website and our orders is:

ASTS Enterprises (AUST) PTY LTD
2/11 Evans Street
Burwood, Victoria 3125
Australia

Email: [email protected]
Phone: +61 3 9888 8771

We trade as Comfort-in and Inject Needle-Free. We sell needle-free injection systems and related products and ship worldwide, including to Australia, New Zealand, the United Kingdom, the European Economic Area (including Poland), Switzerland, Canada, and the United States.

We have not appointed a separate data protection officer. Privacy requests go to the email address above.

If you are in the European Union and you want a privacy authority to look at a complaint, use the Polish authority named in the next section. That is the authority we have selected for the EU. You can also write to us first, at the email above.

2. What you can do

We ship worldwide. This notice is for you as a customer. The same choices apply if you are in Australia, the United Kingdom, Poland, anywhere else in the European Union, Switzerland, Canada, New Zealand, or the United States.

You can:

• shop without accepting analytics or advertising cookies;
• ask what we hold about you, and ask for a copy;
• ask us to correct it, or to delete it, except for records we must keep to finish an order, for tax or customs, or for a dispute;
• take back permission for analytics, advertising, or marketing email;
• complain to us, and then to the privacy authority for your region.

How to use those rights is in section 12. Cookie choices are in the footer, under Cookie preferences.

European Union. The privacy authority we have selected for the EU is the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. You can complain there in Polish or in English. This is the EU authority for this store, including if you live in another EU country.

United Kingdom. The Information Commissioner’s Office, ico.org.uk.

Australia. The Office of the Australian Information Commissioner, oaic.gov.au.

Switzerland. The Federal Data Protection and Information Commissioner, edoeb.admin.ch.

Canada. The Office of the Privacy Commissioner of Canada, priv.gc.ca. In Quebec, the Commission d’accès à l’information.

New Zealand. The Privacy Commissioner, privacy.org.nz.

United States. Email us to see, correct, or delete your information, or to opt out of advertising cookies. You can also use “Do not sell or share my personal information” in the footer. State attorneys general enforce those rights. In California, the California Privacy Protection Agency does as well.

3. Personal information we collect

We collect only what we need to run the store, complete an order, and, if you opt in, measure or advertise the site.

• Identity and contact details. Name, email address, phone number, billing address, and shipping address.
• Order details. Products, quantities, prices, currency, delivery method, and messages you send with the order. The product you buy may indicate a health condition. See section 4.
• Payment data. We do not store full card numbers. Stripe or PayPal collects and processes the payment. We may receive a payment status, a transaction identifier, and limited billing details from them.
• Account data. If you create an account, your login details and order history.
• Communications. Emails, contact-form messages, and live-chat messages you choose to send.
• Technical data. IP address, browser type, device type, language, pages viewed, and the time of the visit. Security logs may include the same information.
• Approximate location. We estimate your country from your IP address on our own server, using the IP2Location LITE database, so we can show a currency and relevant shipping information. We do not collect precise GPS location.
• Cookie and similar identifiers. Described in section 6. Analytics and marketing identifiers are not set unless you opt in.
• Affiliate referral data. If you arrive through an affiliate link, we store a referral so that partner can be credited. That record is about the referral, not a profile we sell.
• Preferences. Currency, language, cookie choices, and accessibility settings. Accessibility settings stay in your browser’s local storage. They are not sent to us as an account record.

We do not ask for government identity numbers, precise location, or biometric data. Please do not send us medical records, prescriptions, or clinical notes. We cannot use them, and we do not want them stored in a contact form.

If you do not give us the details an order requires, we cannot take payment or ship the goods. Browsing the site does not require an account. Refusing analytics or marketing cookies does not stop you from buying.

4. Health-related information

Some products are used for conditions such as diabetes or hormone therapy. An order for those products can reveal information about health. We treat that as:

• sensitive information under the Australian Privacy Principles, and health information under the Health Records Act 2001 (Vic) where that Act applies;
• data concerning health under Article 9 GDPR and Article 9 UK GDPR;
• sensitive personal information or sensitive data under the US state laws that use those terms, including California, Colorado, Connecticut, Virginia, Texas, Oregon, Delaware, Maryland, and the other state laws listed in section 12 that regulate sensitive data.

We use health-related order details only to supply the product you asked for, to handle a return or a product-safety question, and to meet tax, customs, and record-keeping duties. We do not use them to advertise to you, to build a health profile, or to share them with advertising partners.

For people in the EEA and the United Kingdom, the personal data needed to take payment and ship an order is processed to perform the contract (Article 6(1)(b)). Where the order reveals data concerning health, we rely on explicit consent under Article 9(2)(a) for that health data, given when you submit the order after this notice. Article 9(2)(b) (employment and social protection) does not apply to this store. Records a tax, customs, or product-safety law requires us to keep are processed under Article 6(1)(c). You may withdraw consent for any further use that is not required to finish the order or to keep a legally required record. Withdrawing consent does not affect an order we have already shipped, and it does not require us to delete a record the law tells us to keep.

We do not sell sensitive personal information. We do not use it for cross-context behavioural advertising.

5. Why we use personal information, and the legal basis

Purpose	EEA and UK basis	What this covers
Take and fulfil an order, including payment, delivery, and returns	Contract (Article 6(1)(b))	Name, address, email, phone, order contents, delivery
Tax, customs, product-safety, and accounting records	Legal obligation (Article 6(1)(c))	Invoices and records we must keep
Run the cart, checkout, currency, language, security, and the source of an order	Contract where you are buying; otherwise legitimate interests (Article 6(1)(f)) in running a secure store. You can object.	Necessary cookies, fraud prevention, country-level currency, and the referrer recorded on an order
Answer a message you send us	Contract if it is about an order; otherwise legitimate interests in responding to you	Contact form, email, and chat you start
Analytics	Consent (Article 6(1)(a)), and PECR or the local ePrivacy rule for the cookie	Google Analytics. Off until you opt in
Advertising and the Facebook pixel	Consent (Article 6(1)(a)), and PECR or the local ePrivacy rule	Google Ads, Meta, and affiliate measurement of ads. Off until you opt in
Health information inside an order	Explicit consent (Article 9(2)(a)) for the health data, plus contract and legal obligation for the rest of the order	See section 4. Not used for advertising

Legitimate interests, where we rely on them, are limited to securing the site, preventing fraud, understanding a message you sent, and keeping ordinary business records that a contract or a statute does not already require. They are not the basis for analytics or advertising cookies. You may object to legitimate-interest processing. If you object to security logging while an attack or a fraud review is open, we may refuse where the law allows us to keep that log.

Under the Australian Privacy Principles we collect personal information that is reasonably necessary for these functions. We collect it from you, from your browser, and from payment and delivery providers. We do not buy personal information.

6. Cookies and similar technologies

If you are in the European Union, the United Kingdom, or Switzerland, analytics and advertising cookies stay off until you opt in. Accept and refuse are shown as equal choices. If you are in Australia, the United States, or anywhere else, those cookies are on unless you turn them off. The main button on that notice acknowledges them. Manage preferences on that notice, and “Do not sell or share my personal information” in the footer, are how you turn analytics and ads off. Live chat stays on in either case.

You can accept all, reject all non-essential cookies, or set categories. You can change that choice at any time from “Cookie preferences” or “Do not sell or share my personal information” in the footer. Consent is stored for six months and then we ask again. A record of the choice may be kept longer so we can show what was agreed. See section 8.

• Necessary. Cart and checkout, security, live chat, the currency you select, the language you select, spam protection on forms (Google reCAPTCHA), and WooCommerce order attribution. Order attribution records the referrer and campaign of the visit that placed an order. These stay on so you can buy, ask us a question, and so we can see where an order came from. Live chat is Tawk.to. It keeps the conversation connected. reCAPTCHA sends a check to Google. It is used to block abuse of the form, not to advertise.
• Analytics. Google Analytics, including the measurement we send through Google Site Kit. This helps us see which pages are used. It does not run until you opt in.
• Marketing. Google Ads, the Meta (Facebook) pixel and related shop tools, and affiliate tracking. These can share online identifiers with those providers for advertising. They do not run until you opt in. We do not sell personal information for money. If you opt in, that sharing can be a “sale” or “share” under California law and “targeted advertising” under other US state laws. Leave this category off to opt out.

If your browser sends Global Privacy Control (Sec-GPC), we treat that as an opt-out of sale, sharing, and targeted advertising. Marketing cookies stay off unless you later turn that category on yourself in Cookie preferences. We honour that signal everywhere, including in the US states that require it and in places that do not.

Accessibility choices are stored in local storage on your device. They are not advertising cookies.

7. Who receives personal information

We do not sell personal information. We disclose it to the providers below so they can perform a task for us, or because the law requires the disclosure. Advertising providers receive identifiers only if you opt in to marketing cookies.

• Payments. Stripe and PayPal. They are separate controllers of the card or wallet data they collect to take the payment.
• Delivery. Australia Post and the international carrier used for your destination. Customs and border authorities receive the shipping data the law of the destination requires. Duties and import taxes, if any, are the buyer’s responsibility.
• Hosting and email. The provider that hosts this website, and the provider that delivers our email. Messages you send through the contact form are stored on this website.
• Google. Analytics, Ads, and reCAPTCHA, only as described in section 6.
• Meta. The Facebook pixel and catalogue tools, only if you opt in to marketing.
• Tawk.to. Live chat, so you can ask a question. It is on whether or not you accept advertising cookies. Messages you type are stored so we can reply.
• Affiliates. If a partner referred the order, we record that referral so the partner can be paid. We do not give the partner your full order file for their own marketing.
• Professional advisers and authorities. Accountants, insurers, or a court, regulator, or law-enforcement body, where we have a legal duty or a dispute requires it.

Each service provider that acts on our instructions is required to protect the information and to use it only for the task we set. Payment providers and carriers also have their own legal duties and their own privacy notices.

8. How long we keep it

• Orders, invoices, and tax records. At least five years after the order, which is the Australian tax record period we follow. Longer if a warranty, a dispute, or a legal claim is still open.
• Health-related order details. For the same period as the order record they form part of, and no longer for any other purpose.
• Contact and chat messages. Up to three years after the last message, unless a longer period is needed for a dispute.
• Cookie consent. The choice itself expires after six months. A record that you made a choice may be kept for up to three years so we can demonstrate consent.
• Security logs. Up to twelve months, unless an incident means we must keep a log longer.
• Marketing. Until you withdraw consent or unsubscribe, and then only a suppression record so we do not email you again.

When a period ends, we delete the information or de-identify it so it can no longer be linked to you.

9. International transfers

We are in Australia. Personal information is stored in Australia and is also processed in other countries by the providers in section 7, including the United States.

Australia does not have an adequacy decision from the European Commission or from the United Kingdom. Switzerland has not issued an adequacy decision for every onward transfer these providers make. Where we transfer personal information from the EEA, the United Kingdom, or Switzerland to Australia or to a country without an adequacy decision, the transfer is made under:

• the European Commission’s Standard Contractual Clauses, for the EEA;
• the UK International Data Transfer Addendum or the UK International Data Transfer Agreement, for the United Kingdom;
• the Swiss amendments to those clauses, or the Swiss Federal Council’s recognised clauses, for Switzerland;
• supplementary measures where a transfer assessment shows they are needed.

You may email us for a summary of the safeguards that apply to a particular transfer. Under APP 8 we take reasonable steps to require an overseas recipient to handle Australian personal information in accordance with the APPs, except where the Act allows a disclosure without those steps.

Quebec’s Law 25 requires a privacy impact assessment before a transfer outside Quebec and a written contract with the recipient. Canadian privacy law requires a comparable level of protection. We apply the contractual safeguards above to those transfers as well.

10. Security and breach notice

We use access controls, encryption in transit (HTTPS), and hosting controls to protect personal information. No online system is perfectly secure.

If a breach is likely to cause serious harm, we will notify the Office of the Australian Information Commissioner and affected people as the Notifiable Data Breaches scheme requires. If a breach affecting people in the European Union is a notifiable personal-data breach, we will notify the Polish Personal Data Protection Office without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will notify affected people where the breach is likely to result in a high risk. We will notify the UK Information Commissioner’s Office on the same timetable for a breach affecting people in the United Kingdom. We will also give breach notice where New Zealand, Canadian, Quebec, or a US state breach-notification law requires it, including the New York SHIELD Act.

11. Marketing messages

We send marketing email or messages only where the law allows it: with your consent, or, where a law such as the Australian Spam Act allows it, as a commercial message to an existing customer with a working unsubscribe. Every marketing message has an unsubscribe link. Service messages about an order you placed are not marketing.

In the EEA, the United Kingdom, and Poland, electronic marketing uses the consent rules in the ePrivacy rules and PECR, including Poland’s rules on commercial information by electronic means. In Canada we follow CASL. Unsubscribing does not cancel an order.

12. Your rights

Email [email protected]. Say which right you want to use and the country you live in. We may need to confirm your identity before we release or change information. We will not charge a fee unless a request is manifestly unfounded or excessive, and we will tell you before any fee. We will not discriminate against you for exercising a right. Refusing analytics or marketing cookies does not change the price of an order.

Australia

You may ask for access to, or correction of, personal information we hold about you, including health information. We will respond within a reasonable period, ordinarily within 30 days. If we refuse, we will say why, unless the law prohibits that, and how to complain to the Office of the Australian Information Commissioner (oaic.gov.au).

European Economic Area, including Poland

You have the rights in Articles 15 to 22 GDPR:

• access to your personal data and a copy of it;
• correction of inaccurate data;
• erasure, including where you withdraw consent and we have no other legal basis;
• restriction of processing;
• portability of data you provided, where the basis is contract or consent and processing is automated;
• objection to processing based on legitimate interests, and an absolute right to object to direct marketing;
• withdrawal of consent at any time, without affecting processing that was lawful before withdrawal;
• not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects. We do not make that kind of decision. Advertising cookies, if you opt in, can result in profiling by Google or Meta. That is not a decision by us about your legal rights.

We respond within one month. We may extend that by two further months for a complex or numerous request, and we will tell you within the first month if we do.

If you are in the European Union, complain to the authority we have selected for the EU: the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can write to them in Polish or in English.

United Kingdom

The same rights exist under the UK GDPR. Complain to the Information Commissioner’s Office, ico.org.uk. Cookie consent is also governed by PECR. Non-essential cookies stay off until you opt in.

Switzerland

You may ask for access, correction, deletion, and a copy, and you may object to processing, under the FADP. You may complain to the Federal Data Protection and Information Commissioner, edoeb.admin.ch.

Canada, including Quebec

You may ask for access and correction, and you may withdraw consent subject to legal or contractual limits. You may complain to the Office of the Privacy Commissioner of Canada, priv.gc.ca. In Quebec you may also complain to the Commission d’accès à l’information, and you may ask us to cease disseminating your information or to de-index a link, as Law 25 provides. We will answer an access request within 30 days, or tell you if we need the extension the statute allows.

New Zealand

You may ask for access and correction under the Privacy Act 2020. You may complain to the Office of the Privacy Commissioner, privacy.org.nz.

United States

If you live in a state listed below, you may ask us to:

• confirm whether we process your personal information and to access it;
• correct inaccurate personal information;
• delete personal information, subject to records we must keep for tax, security, or a legal claim;
• obtain a portable copy where that state’s law requires portability;
• opt out of sale, sharing, and targeted advertising. Use Cookie preferences, the “Do not sell or share my personal information” link, or Global Privacy Control. We do not sell personal information for money. Marketing cookies, if you turn them on, are the only sharing that these opt-out rights are aimed at;
• opt out of profiling used for a decision that produces legal or similarly significant effects. We do not do that profiling;
• appeal a refusal. See below.

The state laws we mean are those in effect on the date of this notice: California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Florida (FDBR, where its narrow scope applies), Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee (TIPA), Minnesota, Maryland (MODPA), Indiana, Kentucky, and Rhode Island. Thresholds differ. We give these rights to residents of those states even where a revenue or volume threshold might not force us to. Maryland’s minimisation rule is met by collecting only the information in section 3, and by not selling sensitive data.

We will respond within 45 days. We may extend that once, by another 45 days, if the request is complex, and we will tell you why within the first 45 days. California’s rules on verifying a request and on household requests apply to California residents.

California. Categories we collect are identifiers, commercial information, internet or network activity, approximate geolocation derived from an IP address, and professional or health-related information only to the extent an order reveals it. We collect these to fulfil orders and, with consent, for analytics and advertising. We do not sell personal information for money and we do not sell the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes other than those the CCPA allows without an extra opt-out. You may use an authorised agent if you give the agent signed permission and we can verify you. We do not offer a financial incentive for personal information.

Appeal. If we refuse a request, you may appeal by replying to that refusal within 45 days. We will answer the appeal within 45 days. If we deny the appeal, we will tell you how to contact the attorney general or other authority of your state where that state gives you that step. Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Tennessee, Indiana, Kentucky, and Rhode Island provide an appeal in one form or another.

New York. The SHIELD Act requires reasonable security and breach notice. New York has not, as of this notice, enacted a comprehensive consumer privacy statute of the California type. We still honour access, correction, deletion, and the opt-out of sale or sharing for New York residents, by the same email and the same cookie control.

13. Children

This site is not directed at children. We do not knowingly collect personal information from anyone under 16. The GDPR consent age in Poland is 16. The UK age for an information-society consent is 13, and the US children’s online privacy rule is aimed at under 13. We use 16 as the single rule. If you are a parent buying a product for a child, you are the customer and you provide your own details. If you believe we have collected information directly from a child, email us and we will delete it.

14. How to complain

Contact us first at [email protected]. If you are in the European Union, the privacy authority for this store is the Polish Personal Data Protection Office, uodo.gov.pl. The other authorities are named in section 2. We will not retaliate against you for complaining.

15. Changes to this notice

We will post a new version on this page and change the date at the top. If a change requires fresh consent, we will ask for it before we rely on it. The version you can read here is the version that applies.