IVORAL QESSANIQUE · INFORMATION
Privacy Policy
Last updated: 22 October 2026
This notice explains how information may be handled when you read our café and patisserie website, the limited data handling performed by the current frontend, and the privacy rights that may apply to you.
1. Who operates this website
The business identified in the contact information below is responsible for the content of the Ivoral Qessanique café and patisserie website and for handling enquiries about the way this website processes personal information. We are based in Victoria, Australia.
This policy explains the handling of information relating to visits to this informational website. It does not purport to describe separate point-of-sale systems, employment processes, loyalty programmes or other services that are not available on the published site.
2. What the website currently provides
Visitors can read our story, menu, pastry descriptions, contact details and the legal notices. No account registration, online checkout, booking engine, contact submission form, newsletter registration, live chat or user-generated content area is implemented on these static pages.
The site is built to serve its visual resources from its own directories. It does not intentionally load advertising tags, social-media widgets, remote font services, analytics pixels or tracking scripts from external providers.
3. Information that may be processed
Simply loading a website involves technical requests to the host. Depending on the hosting configuration, a web server or infrastructure provider may process an IP address, time of request, requested page, approximate browser and operating-system information, a referrer if provided, security events, and error or access logs.
The application code itself does not request a name, postal address, telephone number, payment-card number or email address from visitors and does not store website submissions. If you voluntarily send us an enquiry outside the website, the contents of that communication are handled through the channel you choose and are not generated by an on-site form.
4. Purposes of technical processing
Technical request data may be used as needed to deliver requested pages, maintain website availability, diagnose faults, detect abuse and investigate security incidents. We do not use the current application to build advertising audiences, profile individual visitors, or personalise prices.
Information sent in a separate enquiry may be used to respond to that enquiry, resolve a concern, clarify a menu question or manage a related business communication. We do not claim to use website tracking for these purposes.
5. Australian privacy framework
Where the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to the operator and a particular activity, we handle personal information consistently with those obligations, including reasonable measures to protect it and appropriate responses to requests for access or correction.
Applicability can depend on an organisation’s circumstances and activity. We do not describe this policy as a substitute for rights available under applicable Australian privacy or consumer legislation.
6. GDPR lawful bases where applicable
For visitors whose data is subject to the GDPR or UK GDPR, the processing of essential technical request information may be justified by legitimate interests in operating and securing the website under Article 6(1)(f), assessed against the visitor’s interests and rights. Where processing is strictly necessary for a requested service, Article 6(1)(b) may apply in an appropriate case.
If law requires consent for a future optional feature, that feature should not be activated without an appropriate consent mechanism and further information. The current site does not implement optional advertising or analytics tracking that requires such consent.
7. Cookies, local storage and tracking
The site’s own frontend code does not deliberately create tracking cookies, advertising identifiers, analytics storage, browser fingerprints or comparable persistent visitor profiles. We have not implemented a cookie preference system because those optional trackers are not present in the current static application.
Hosting providers may maintain operational infrastructure independently of the application. The Cookie Policy describes how to check cookies in your browser and what should be reviewed if the hosting setup changes.
8. Hosting and service providers
When the site is deployed, a hosting company, domain provider, content delivery or security infrastructure, or support contractor may be involved in delivering the website and maintaining servers. These providers can have access to technical request data where needed for those functions.
We do not identify a particular host or log-retention period here because neither is established by the supplied static files. Operators must assess and document actual hosting arrangements and applicable data-processing agreements before publication. The site itself has no embedded third-party services.
9. Cross-border access and disclosure
Technical requests may be routed or hosted outside the visitor’s country depending on the eventual deployment. If applicable law restricts an international transfer, the operator must ensure a lawful mechanism and appropriate safeguards are in place before such processing occurs.
We do not sell personal data, share it for behavioural advertising or exchange visitor lists with marketing partners through the current website. Disclosure may occur if legally required or necessary to protect against fraud or security incidents, subject to applicable law.
10. Retention and deletion
The static application does not maintain a visitor database. Server and security logs, if enabled by the hosting platform, should be retained only for a period proportionate to the security, operational or legal purpose, then deleted or anonymised according to the host’s actual configuration.
Separate correspondence is retained only while reasonably required to handle the request, satisfy applicable record-keeping duties or resolve a legitimate dispute. There is no fixed retention period stated for unidentified hosting services, and this notice should be updated when an actual retention schedule is documented.
11. Information security
The website uses local presentation resources, reducing unnecessary disclosures to third-party script or font services. Reasonable operational controls for hosting, access management, software updates, backup integrity and incident response should be applied by the operator and its service providers.
No internet transmission or system is perfectly secure. Do not include payment card details, passwords or sensitive medical information in unsolicited general enquiries.
12. Access, correction and Australian complaints
Subject to applicable law, you may ask whether we hold personal information about you, request access or correction, or make a complaint about our handling of your information. Describe the information or communication involved so that we can locate it, and contact us at the address or email shown below.
We may need to verify your identity before disclosing data. If an eligible privacy complaint cannot be resolved directly, you may have a right to contact the Office of the Australian Information Commissioner (OAIC), subject to its jurisdiction and complaints process.
13. EEA and UK data-protection rights
Where the GDPR or UK GDPR applies, rights may include access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent where consent is the basis. Some rights depend on circumstances and legal exceptions.
You may also complain to a competent supervisory authority in the applicable jurisdiction. We will respond to qualifying requests within the time frames provided by relevant law, including any lawful extension.
14. Children and sensitive information
The website is a general café information service, not directed at children for data collection, and has no membership or interactive registration feature. The application does not solicit sensitive information such as health conditions, identity documents or financial credentials.
A visitor with an allergen or dietary concern should discuss it directly with qualified café staff before ordering; avoid submitting unnecessary medical details through general correspondence.
15. Updates and contact
We may change this policy when site features, hosting practices or relevant legal duties change. The date at the top identifies the current version. A material introduction of forms, payment processing, cookies or third-party tracking would require review and an updated notice.
For information requests and privacy complaints, contact the operator using the business details set out below. Please state the nature of the request, and avoid including unnecessary sensitive information.
Operator and contact details
Business: Ivoral Qessanique Pty Ltd
Address: 206 State Route 19, Malvern VIC 3144, Australia
Email: info@ivoralqessanique.com