Privacy policy

We only collect what we need to sell you something, deliver it, service your pool, or run your account.

Enquiries and service requests

• Your name, and an email address or phone number so we can reply — at least one is required, because a request we can't answer is no use to either of us.
• The address the work is at, when you tell us, plus whatever you describe in the message.

Orders and deliveries

• Contact email and phone, delivery address and postcode, and any delivery notes.
• What you ordered, the amounts, and the status of the order.
• Card details never reach us. Payment is taken by Stripe inside the checkout on this site; we receive the result (paid or not) and a Stripe reference, not your card number.

Gas — LPG and BOC

• For LPG delivered to a property, the gas compliance certificate number recorded against that delivery address. We keep this because gas can only lawfully be supplied to a compliant installation, and we have to be able to show which address it was supplied to.
• For BOC cylinder orders: contact details, the delivery address, your BOC account reference if you have one, the cylinders requested and the day you want them.

Account holders and service customers

• Your login (email address and a password we never see in plain text), your name, and the role your account holds.
• The pools, plant rooms or units we look after for you, and their addresses.
• Service visit records: dates, the technician, water-test readings, chemicals used, and notes.
• For accounts that manage their own equipment: asset records, and any manuals, warranty certificates or invoices you upload against them.
• For accounts that run their own stock or letting units: stock counts and movements, and the occupancy dates you record against a unit.
• Your orders, quotes and account history with us.

Technical information

• Standard web server logs from our hosting provider, including IP address, browser and the pages requested.
• Error reports, if something breaks. These are sent to our monitoring service with personal information switched off by default, and no session recording.

We don't buy contact lists, and we don't collect sensitive information (health, racial or ethnic origin, political or religious beliefs, and so on) in the ordinary course of business. Water-test readings are about your pool, not about you.

We don't run advertising or analytics trackers on this site. The only cookies we set are ones the site needs to work:

• A sign-in session cookie, once you log in.
• A cookie that remembers which store you're viewing, if you reach us on a branded store address.
• A short-lived cookie that remembers you asked to see the price on a “contact for price” item.

Your shopping cart lives in your own browser's local storage until you check out — it isn't sent to us and there's no record of it on our side until you place the order.

• To quote, take, pick, deliver and invoice your order.
• To schedule and carry out pool service, and to keep the service and water-quality record we're asked for.
• To meet gas supply and safety obligations, including compliance certificates.
• To run your account: sign-in, order history, quotes, and the tools your account has access to.
• To contact you about an order, a booking or a service visit.
• To keep the tax and business records the law requires us to keep.
• To keep the site working and secure — diagnosing errors, and preventing fraud and abuse.

We only send marketing if you've asked for it, and every marketing message will have a way to stop it. Messages about an order, a booking or your account aren't marketing and will keep coming while you're dealing with us.

We do not sell personal information. We share it only where it's needed to run the business:

• Our suppliers, where an order goes through them — Elgas for LPG, BOC for industrial and medical gases — limited to what they need to supply and deliver.
• Our service providers, who process data on our behalf under contract: our database and file storage host (Supabase, on servers in Sydney), our website host (Vercel), our payment processor (Stripe), our email sender (Resend) and our error-monitoring service (Sentry).
• Our accountant and professional advisers, and our bank, for invoicing, payment and tax.
• Anyone we're required to disclose to by law, or to prevent a serious threat to someone's life, health or safety.

Some of those providers are based overseas or store backups overseas, mainly in the United States. By using the site and buying from us you agree that we may disclose your personal information to them for the purposes above. We choose providers that commit to protecting it, but we can't guarantee that overseas privacy laws are the same as Australia's.

• Our database is hosted in Sydney and encrypted at rest; everything travels over HTTPS.
• Access is enforced in the database itself, not just in the app: your account can only read its own customer's records, and staff access is limited by role.
• Documents you upload against your equipment go into a private store. They aren't reachable by guessing a link — we mint a link that works for five minutes, and only after checking the item belongs to you.
• Backups are encrypted, and we can restore the database to a point in time.

No system is perfectly secure. If a data breach happens that's likely to cause you serious harm, we will assess it promptly and notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

We keep financial and tax records for at least five years, as the Australian Taxation Office requires. Gas supply and compliance records are kept for as long as the relevant safety and supply obligations require. Service and water-quality history is kept for the life of the account, because it's the record of what was done to your pool — you can ask us to close your account and remove what we aren't required to keep.

Signed-in customers can see much of it directly — orders, quotes, service history, water-test results and bookings are all in your account area. For anything else, ask us and we'll give you access to the personal information we hold about you, or correct it if it's wrong. We'll ask you to verify who you are first.

We'll respond within a reasonable time — usually within 30 days. There's no charge for asking, though we may charge a reasonable cost for a large request. If we refuse access or a correction, we'll tell you why in writing.

Accounts here are set up by us rather than self-registered, so if you need a login, a password reset, or an account closed, contact us and we'll do it.

If you think we've mishandled your personal information, tell us first — email hello@h2oplus.au or call 07 4099 3345. We'll acknowledge your complaint and aim to resolve it within 30 days.

If you're not satisfied with our response, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We'll update this page when what we do changes, and the date at the top will change with it. The version on this page is the current one.

H2O Warehouse Pty Ltd, trading as H2O+ — Craiglie, Douglas Shire QLD 4877.
Email hello@h2oplus.au · Phone 07 4099 3345 · send us a message.

See also our terms of sale.