Privacy policy

Last updated: 1 October 2026

In brief

Vestige makes 3D-printed terrain tiles of routes you have run, ridden, hiked or swum. To do that we need your route, and a route is personal information: it shows where you went and when. This summary says what we collect, why, who sees it, how long we keep it and what you can choose. The full policy follows.

  • Who we are. Vestige is the brand of Vestige Athletic, the registered business name of the partnership B.O Boulton & A.R O'Connor (ABN 47 403 980 322), based in New South Wales, Australia. We run the store at vestigeathletic.com.au (formerly vestige.studio). Write to us at info@vestige.studio.
  • What we collect. Your name, contact and delivery details and what you order (and, if you use our optional customer account, the addresses you save in it); the route you give us (a GPX file, the standard route file your watch or app exports, or a Strava activity) and the design of your tile; your messages to us; and the usual website information such as cookies and your IP address. We never see your full card number or your Strava password.
  • Why. To make, deliver and support your tile; to show you your own Strava activities so you can pick one; to take payment; to answer you; to keep the store secure; and, only if you opt in, to send you marketing emails.
  • Who sees it. The two Vestige partners, and the services that run our store and studio for us: Shopify and the apps installed in our store, Cloudflare, our payment providers and delivery services, Bambu Lab if our printer uses its cloud printing, and, for the map area you are viewing only, the map and elevation services named in this policy. Strava sees that you connected Vestige Studio and the requests we make for your activities; it learns nothing about your order. We never sell personal information, and never use routes or Strava data for advertising or analytics, or to train AI. We never publish routes, or use your design, your route or photos of your tile in our marketing, without your permission.
  • How long. Your route stays in your browser while you design; a saved design you have not returned to for 30 days is deleted the next time you open the studio. The print file that contains your route is kept for 120 days after it is uploaded so we can reprint or replace a tile, then deleted (until our automatic deletion is running, we delete it on request). Order records are kept for about 5 years, for tax. Strava access lasts at most 24 hours, or until you disconnect.
  • Your choices. Check out as a guest, or use an optional customer account. Design with the sample route without giving us anything beyond the usual website information. Trim a GPX file before you upload it. Disconnect Strava at any time. Ask us for a copy of your information, for a correction, or for your print file to be deleted. Complain to us first, then to the Office of the Australian Information Commissioner (see "Complaints" for what it can do).

Who we are and how to reach us

Vestige is the brand of Vestige Athletic, the registered business name of the partnership B.O Boulton & A.R O'Connor (ABN 47 403 980 322), based in New South Wales, Australia.

We run the online store at vestigeathletic.com.au and the Terrain Studio on it. The store was previously at vestige.studio; both addresses lead to the same store and this policy covers both.

Our store is hosted by Shopify Inc. Shopify processes your information on our behalf to run the store and checkout, and also for some purposes of its own, which are described in the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.

Australian privacy law and this policy

Vestige is an Australian business. We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). As a small business we may currently fall within the Act's small-business exemption, but we have chosen to follow the APPs anyway. This policy is written to meet them, and you can hold us to it.

If you live in the European Union, the European Economic Area or the United Kingdom, the GDPR or UK GDPR may apply to our handling of your information; see "If you live in the EU or the UK".

Personal information is anything that identifies you or could reasonably be used to identify you. Your route is personal information: see "Your route and the Terrain Studio".

What we collect

Contact and order details

Your name, email address, phone number, delivery and billing addresses, what you ordered, any note you add to your order, and the design details of each tile (described under "Your route and the Terrain Studio").

Customer account, if you use one

A customer account is optional; you can always check out as a guest. If you use one, Shopify hosts it for us, holds your name, email address and the addresses you save, and shows you your past orders. You sign in with a one-time code that Shopify emails to you each time, so there is no password. Your account does not store your Terrain Studio designs: a saved design stays only in your browser on that device, whether or not you are signed in, as described under "Your route and the Terrain Studio".

Payment details

The payment provider you choose at checkout (Shopify Payments, and others we may offer, such as Afterpay or PayPal) handles your payment, including your card or account details, under its own privacy policy. We see the payment method type, the last four digits of a card, and whether the payment succeeded. We never see or store full card numbers.

Your route and tile design

The route you upload, choose from Strava or take from our sample; the area your tile covers; your colours and features; and the print file (the file we print from; it contains a copy of your route). The full detail is under "Your route and the Terrain Studio".

Strava details, if you connect

Your Strava account number (athlete ID), first and last name and profile picture (the studio shows only your first name); your activity list; and the activity or activities you choose to print. The full detail is under "Connecting Strava".

Messages

What you send us by email, through our contact page or on social media, and the address or account you send it from.

Device and website use

Your IP address, browser and device type, the pages you view and how you move through the store, collected through cookies and similar technologies set by Shopify. Opening the Terrain Studio also contacts Cloudflare, which hosts our studio servers and the Turnstile bot-check script, so Cloudflare receives your IP address whenever you open the studio, connect Strava or add a tile to your cart. The Turnstile check itself runs only when you add a tile to your cart; it receives technical signals from your browser to tell people from bots.

What we do not collect

Our customer accounts sign you in with a one-time code sent to your email instead of a password, so we hold no passwords or security questions. We never take heart rate, power or other body data from Strava. A GPX file you upload is stored exactly as you give it to us; see "What we collect" under "Your route and the Terrain Studio". We do not hold your full card number.

Using our store anonymously

You can browse the store and design a tile with the sample route without giving us anything beyond the usual website information described under "Device and website use". We need your name, contact and delivery details only to take an order. A customer account is optional: you can check out as a guest.

Where we get it

  • Directly from you, when you order, use your customer account, upload a route, design a tile or write to us.
  • Automatically from your device, through Shopify's cookies, our Cloudflare servers and Cloudflare Turnstile.
  • From Strava, only when you choose Connect with Strava and approve Vestige Studio on Strava's own page.
  • From our service providers, for example the payment status from our payment provider and tracking updates from the delivery service.

Why we use it

  • To make, deliver and support your tile. We turn your route into a print file (the file we print from; it contains a copy of your route), print the tile, pack and post it, and keep the print file so we can reprint or replace a tile if something goes wrong. This is the reason we collect your route.
  • To show you your own Strava activities so you can choose the one you want printed. That is the only thing we do with your Strava access.
  • To take payment and send order updates, including the order confirmation and dispatch emails that Shopify sends for us.
  • To answer you when you contact us and to keep a record of what we agreed.
  • To send marketing emails through Klaviyo, only if you opt in at checkout or by signing up, and you can unsubscribe in any email. Our marketing emails never include your route or activity details.
  • To share your posts about your tile, only if you give us permission when we ask, as described under "Who else can see your route".
  • To keep the store secure: to detect bots, fraud and misuse, and to protect our systems.
  • To meet our legal obligations, including tax record-keeping and our obligations under Australian Consumer Law (refunds, repairs and replacements), and to respond to lawful requests from authorities.

No computer makes a decision about you on its own. We never cancel an order for fraud risk without a partner reviewing it. Our payment providers may decline or challenge a payment automatically under their own rules; that is their decision, not ours.

Your route and the Terrain Studio

Your route is personal information. A GPS route shows where you went and when. It can reveal where you live, work or train and your habits. We treat every route as personal information and we collect it only because you ask us to print it.

How you give it to us. In the Terrain Studio you can upload a GPX file (the standard route file your watch or app exports), choose an activity from your Strava account, or try our sample route. The sample route is ours and reveals nothing about you.

What we collect. The points in your GPX file or Strava activity (latitude, longitude, elevation and time), the route's name, and for a Strava route its sport, date and Strava activity ID or IDs. When you add a tile to your cart we also record the design details listed under "When you add a tile to your cart" below. We store a GPX file exactly as you give it to us. If it contains heart rate, cadence, power or temperature, remove them before uploading; we do not read or use them. We never take heart rate or other body data from Strava, and we do not read the GPS track of any activity you do not choose; to show you your activity list we read only the summary details listed under "Connecting Strava".

In your browser while you design. Your route and your design choices stay in your browser on this device, in your browser's own storage for this website (like a cookie, but larger, and not sent to us), so you can come back to your design later without an account. They are removed when you choose Start fresh or Change route, and once the design is in your cart (a copy stays in that browser tab until you close it). If you have not returned for 30 days, the saved design and route are no longer offered and are deleted the next time you open the studio. Clearing your browser's site data also removes them. Until you add a tile to your cart we do not store your route on our servers. While you design, your browser does ask the map services below for the map area around your route (never the route itself); one of them is our own map cache, so we receive that map area and your IP address. If you choose a Strava activity, its track passes through our Strava server on its way to your browser and is not stored there, and your activity list is held on that server for up to 5 minutes, as described under "Connecting Strava".

Map, elevation and terrain-detail services. To show the map and build the terrain, your browser asks these services for data covering the area around your route:

  • OpenFreeMap, for the background map (servers in Europe);
  • Amazon Web Services Terrain Tiles, for elevation (United States);
  • Vestige's own map cache, hosted on Cloudflare, for water, forests, roads and buildings, and for elevation if the AWS service fails (United States and Cloudflare's global network). Our cache keeps the public map data for the area you asked for until it is refreshed. The copy holds only public map data, never your route, and is refreshed from OpenStreetMap from time to time so the studio keeps working when OpenStreetMap is unavailable.
  • OpenStreetMap's Overpass servers in the European Union (Germany and Austria), for water, forests, roads and buildings when our cache is slow (more than about three seconds) or cannot answer (the servers are overpass-api.de and overpass.private.coffee).

The three outside services receive the map area requested and your device's IP address, not your name, your account or the route itself, and we do not control their logs. Map data is © OpenStreetMap contributors.

When you add a tile to your cart. Cloudflare Turnstile first checks that you are a person. Your browser then builds the print file for your tile: a 3MF file (the format our printer reads) that includes a copy of your route (as GPX) and your design settings. It uploads the file to our server, which runs on Cloudflare, and the file is kept in Cloudflare storage so we can produce your order. Only Vestige can open the print file. The link to it is stored with your order, but opening it also needs a password that only the two partners hold, and that password is never shown to you or to anyone else; without the password the link opens nothing. Your design details are stored with your order in Shopify, as notes attached to the order and to the tile in it: the route's name; where it came from (upload, sample or Strava, with the activity ID or IDs); the distance of your route; the centre point and width of the area your tile covers; your colours, features and the print material for each of your colours; and the link to your print file. The route's name appears on your cart line, at checkout and in your order confirmation. Order details are visible to the apps we have installed to run our store, listed under "Who we share it with". To print your tile we download a copy of the print file to our workshop computer and printer and delete those copies within 30 days of dispatch.

Who else can see your route. Nobody outside Vestige, apart from the services listed under "Who we share it with" that store or handle it for us. Cloudflare stores the print file and Shopify holds the route's name and centre point, but only as our storage; the two Vestige partners are the only people who open the file. If our printer uses Bambu Lab's cloud printing, the print job for your tile passes through Bambu Lab's servers. We never sell or share routes. We disclose a route only if the law requires it, and we never publish one without your permission. We never use your design, your route or photos of your tile in our marketing without your permission. If you post about your tile and we would like to share it, we will ask you first, and you can say no or change your mind later. We do not use routes in advertising, we do not analyse them for insights about where our customers go, and we do not use them to train any AI system.

How long we keep your route. The print file, with your route inside it, is kept for 120 days after it is uploaded (which happens when you add the tile to your cart) so we can reprint or replace a tile, then deleted. Until our automatic deletion is running, we delete print files on request. We keep it so we can reprint a tile that is faulty, or lost or damaged before it reaches you; by ordering you ask us to keep it for that time. You can ask us to delete it sooner, and we will unless we still need it to make or remake your tile or the law requires us to keep it; see "Deleting sooner" under "How long we keep it" below. The order record itself is kept for 5 years after the end of the financial year in which you ordered, as tax law requires; see the list under "How long we keep it" below.

Your choices. Trim a GPX file before you upload it if you would rather your tile did not begin at your front door; the tile shows exactly the route you give us. Choose Start fresh or Change route to remove a route from this device. Email info@vestige.studio to have your print file deleted or to receive a copy of your route (the GPX file inside your print file).

Connecting Strava

If you choose Connect with Strava, Strava's own page asks you to allow Vestige Studio (our registered Strava app) to view your activities, including private ones. The permission is read-only. We use it only to show you your own activities in the Terrain Studio and to read the activity you choose to print (for a triathlon, up to three legs).

What we read from Strava.

  • When you connect: your Strava account number (athlete ID), first and last name and profile picture, so the studio can show that you are connected. We show only your first name.
  • Your activity list: for each activity, its ID, name, sport, date, distance, elevation gain, moving time, whether it was recorded with GPS, and a low-detail outline of its map, so you can find the one you want. We keep only those details; anything else Strava sends is discarded as it arrives.
  • The activity or activities you choose: the GPS track (latitude and longitude), elevation, time and distance data, and the name, sport, date, distance and elevation gain. That becomes the route for your tile and is then handled as described under "Your route and the Terrain Studio".

How we read it. Through Strava's developer connection (its API), after you approve Vestige Studio on Strava's own authorisation page. We never see your Strava password. We never post activities or anything else to Strava. The only change we make to your Strava account is removing our own access when you disconnect.

Where your Strava access is held. Strava gives our server (which runs on Cloudflare) two keys for your account: an access key, and a renewal key that lets our server renew the access key while your session lasts. Both stay on our server and are never sent to your browser; your browser holds only a random session code, which is deleted when you close the tab. We hold the keys for up to 24 hours so the activity list keeps working during your visit, then they expire and are deleted. Our server keeps a copy of your activity list for no more than 5 minutes from the moment it is first fetched, however many pages of it you load, then asks Strava for it again.

Withdrawing your permission. Press Disconnect in the Terrain Studio: our server deletes your session and any cached activity list straight away and asks Strava to remove our access. If our server cannot be reached at that moment, your session expires on its own within 24 hours and the cached list within 5 minutes. If Strava cannot be reached, our app may stay listed on your Strava account: remove Vestige Studio under Settings > My Apps (strava.com/settings/apps) to be sure. You can also remove Vestige Studio there at any time; our access then stops working and anything held for your session expires within 24 hours. Either way, nothing about your Strava account remains on our server after that, apart from anything already attached to an order, described next.

After you order. The track of the activity or activities you chose is inside your print file, and the name and Strava activity ID or IDs are stored with your order. They are kept as described under "How long we keep your route". If you delete the activity on Strava after ordering, or simply want our copy gone, ask us: for a Strava route we delete the print file within 48 hours of hearing from you, and remove the rest as described under "Deleting sooner". If we still need the file to make or remake your tile, we will tell you. You can also ask us for a copy of your route (the GPX file inside your print file).

What we never do with Strava data. Your Strava data is shown only to you. We never show it to anyone else, sell it, license it or share it. We never use it in advertising. We never analyse it or pool it with other customers' data, even with names removed. We never use it to build or train any AI system. Once you order, the activity's name and ID are part of your order details, which Shopify and the apps listed under "Who we share it with" hold for us.

Strava's own records. Strava records how our app uses its developer connection, such as the number of requests it makes, and may use that information for its own purposes. Strava's handling of your account is governed by Strava's privacy policy at https://www.strava.com/legal/privacy.

Vestige is not affiliated with or endorsed by Strava.

Who we share it with

We share personal information with the services that run our store and studio for us, so they can do that job, and in the few other cases listed below. We never sell personal information.

  • Shopify (Shopify Inc., Canada, with data centres in Canada and the United States) hosts our store, checkout and customer accounts, processes payments through Shopify Payments and sends our order emails and account sign-in codes. Shopify also processes some information for its own purposes, described in the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.
  • Apps installed in our Shopify store that can read orders, including the design details of your tile: Simple Bundles & Kits (bundles; Freshly Commerce, Canada), Essential Cart Drawer (cart; Essential Apps, Lithuania) and Klaviyo (email, United States). These apps process order data only to run our store. Our marketing emails never include your route or activity details.
  • Cloudflare (United States, with a global network) runs the servers behind the Terrain Studio, stores your print file, provides our map cache and runs the Turnstile bot check.
  • Bambu Lab (China and the United States), the maker of our printer, only if our printer uses its cloud printing: the print job for your tile then passes through its servers.
  • Strava (United States), only if you connect. Strava receives your approval of our app and the API requests our server makes on your behalf.
  • Amazon Web Services Terrain Tiles (United States), OpenFreeMap (Europe) and OpenStreetMap Overpass servers (European Union) receive the map area you are viewing and your IP address while you design, as described above.
  • Google Workspace (Google, United States and global) hosts our email, so any message you send to info@vestige.studio is stored there.
  • Payment providers receive what they need to take your payment, and delivery services receive your name, address, phone number and email so they can deliver your order and send tracking updates.
  • Professional advisers, such as an accountant, where our order records are needed for tax or legal purposes.
  • Authorities, where the law requires us to disclose information or a court or regulator lawfully asks for it.
  • A new owner, if we turn the partnership into a company, restructure or sell the business, in which case your information transfers to the new owner under this policy.

We do not share your browsing or purchase information with other merchants or advertising networks for personalised advertising.

Overseas disclosure

Some of the services we use hold or process information outside Australia. These providers hold or handle your information in these places:

  • Shopify: Canada and the United States;
  • Simple Bundles & Kits (Freshly Commerce): Canada;
  • Essential Cart Drawer (Essential Apps): Lithuania, in the European Union;
  • Cloudflare: the United States and Cloudflare's global network of data centres;
  • Strava: the United States (only if you connect);
  • Amazon Web Services Terrain Tiles: the United States;
  • OpenFreeMap: Europe;
  • OpenStreetMap Overpass servers: the European Union (Germany and Austria);
  • Google Workspace: the United States and Google's global network;
  • Klaviyo: the United States;
  • Other payment providers we may offer at checkout, such as Afterpay or PayPal: Australia, the United States and the other countries where they operate;
  • Bambu Lab: China and the United States, if our printer uses cloud printing.

We remain responsible for personal information we send to these providers. Shopify, Cloudflare, Klaviyo and Google are bound by terms that require them to protect your information; Shopify and Strava also use some of it for their own purposes, under the policies linked above. The public map and elevation services (OpenFreeMap, Amazon Web Services Terrain Tiles and the Overpass servers) receive only the map area and your IP address, have no contract with us, and we do not control them. We do not send your route to anyone who does not need it to make your tile.

Cookies, analytics and storage on your device

  • Shopify cookies. Shopify sets cookies that are needed for the store to work (your cart, checkout, security and preferences) and analytics cookies that tell us how visitors use the store as a whole, such as which pages are viewed and where visitors came from. If the law in your country requires consent for non-essential cookies, we ask before setting them.
  • Advertising pixels. We do not run advertising pixels from Meta, TikTok, Google or others on the store.
  • Terrain Studio storage. The studio keeps your route and design in your browser's own storage for this website (like a cookie, but larger) so you can return to them, as described above. It is not a cookie, and your route is not sent to us until you add a tile to your cart; while you design, only the map area around your route reaches our map cache. The studio also keeps the public map data it fetched for the area around your route in your browser's cache for 24 hours. Start fresh and Change route do not remove that cached map data; clearing your browser's site data does.
  • Strava session code. If you connect Strava, a random session code is kept in your browser tab and deleted when you close it.
  • Turnstile. The Cloudflare Turnstile script loads when you open the Terrain Studio. The check itself runs when you add a tile to your cart and may set its own cookie to tell people from bots.

You can delete cookies and this website's storage in your browser settings at any time; the store will still work, but your saved design will be gone.

How we keep your information safe

  • Every connection to our store, our studio and our servers uses HTTPS.
  • Your print file is stored on Cloudflare and can be opened only with a password that the two Vestige partners hold. The link to the file is recorded on your order but is not displayed and cannot be used without the password.
  • Your Strava access and renewal keys stay on our server and are never sent to your browser. Our code does not write route coordinates to logs, and our analytics record no coordinates, file links or Strava identifiers.
  • Payments are handled by our payment providers under the card industry's security standards; card numbers never reach us.
  • Only the two Vestige partners have staff access to our Shopify admin and hold the download password for print files; the apps listed under "Who we share it with" read order data automatically to run the store.

No system is perfectly secure. If you have a concern about the security of your information, please tell us at info@vestige.studio.

How long we keep it

  • Your route and design while you work are kept in your browser, on this device only, until you choose Start fresh or Change route or add the tile to your cart (a copy stays in that browser tab until you close it). A saved design you have not returned to for 30 days is deleted the next time you open the studio.
  • Public map data for the area around your route is kept in your browser's cache for 24 hours, and in our map cache on Cloudflare until it is refreshed (only public map data, never your route).
  • Your Strava access and renewal keys are held on our Cloudflare server for up to 24 hours, or until you press Disconnect.
  • Your Strava activity list is held on our Cloudflare server for no more than 5 minutes after it is first fetched.
  • The print file for an ordered tile (it contains your route) is kept in Cloudflare storage, opened only by Vestige, for 120 days after it is uploaded so we can reprint or replace a tile; then deleted; sooner on request where we are not required to keep it.
  • The print file for a design added to a cart but never ordered is kept in Cloudflare storage and deleted 120 days after it is uploaded.
  • The copies we download to our workshop computer and printer to print your tile are deleted within 30 days of dispatch.
  • Order details (name, address, what you bought, tile design details) are kept in Shopify and the apps that run our store for 5 years after the end of the financial year in which you ordered, as tax law requires; then deleted or de-identified.
  • Your customer account (your profile and saved addresses), if you use one, is held by Shopify until you ask us to close it. When you ask us to close your account, we delete or anonymise your profile and saved addresses as far as Shopify allows; your order records stay until the tax-record period ends.
  • Emails and messages with us are kept in Google Workspace; we review and delete old correspondence at least every 2 years.

Until our automatic deletion is running, we delete print files on request.

Deleting sooner. Email info@vestige.studio from the address on your order and within 30 days we will delete your print file (after which the link on your order opens nothing) and remove the design details from your order's additional details where Shopify allows it, unless we still need the file to make or remake your tile or the law requires us to keep it. The details attached to the tile on your order (the route's name, where it came from including any Strava activity ID, the distance, and the centre point and width of the area your tile covers) are part of the order record and stay until the tax-record period ends. We will tell you in writing what we deleted and what we kept and why.

Your rights and choices

  • Access. Ask us and we will send you a copy of the personal information we hold about you, including a copy of your route (the GPX file inside your print file), within 30 days. Asking is free.
  • Correction. Ask us to correct anything that is wrong or out of date, and we will, free of charge. If we disagree, we will tell you why and, if you ask, attach a note recording your view. If you use a customer account, you can also change your name and saved addresses there yourself.
  • Deletion. Ask us to delete your print file and the route details from your order, as described under "Deleting sooner", or to close your customer account, as described under "How long we keep it". We will also delete other personal information when we no longer need it for the purposes in this policy or to meet a legal obligation.
  • Marketing. If you have opted in to our marketing emails, you can unsubscribe using the link in any email, and we will stop within 5 business days. If you gave us permission to share a post about your tile, you can withdraw it at any time by emailing us. Order and delivery emails are not marketing and continue for as long as your order needs them.
  • Strava. Disconnect in the Terrain Studio at any time, or remove Vestige Studio under Settings > My Apps on Strava.
  • Cookies. Manage cookies and this website's storage in your browser settings.

To exercise any of these rights, email info@vestige.studio. We may ask you to confirm your identity, usually by writing from the email address on your order or customer account, so that we do not give your information to someone else. We aim to answer within 30 days and will tell you if we need longer. If we refuse a request, we will tell you why in writing and how to complain.

If you live in the EU or the UK

We sell and deliver only within Australia, and we do not target people in the European Union, the European Economic Area or the United Kingdom. If the European or UK data protection laws (the GDPR or UK GDPR) nonetheless apply to you, you can use the same rights and contact routes described in this policy, and we will respond.

Children

The store and the Terrain Studio are for people aged 18 and over. A parent or guardian may order a tile of a child's route. We handle it as the child's personal information, given to us by the parent or guardian, with the same protections as any route. If you are under 18, please do not connect a Strava account; ask a parent or guardian to order for you. Strava sets its own minimum age for Strava accounts. If you believe a child has given us personal information without a parent's or guardian's consent, email info@vestige.studio and we will delete it.

Data breaches

If personal information we hold is lost, or accessed or disclosed without authorisation, we will assess the incident within 30 days. If the breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, and we will tell you what happened, what information was involved and what you can do. If Strava data is involved, we also notify Strava.

Complaints

If you think we have mishandled your personal information, email info@vestige.studio with "Privacy complaint" in the subject, or write to PO Box 115, Helensburgh NSW 2508. We will acknowledge your complaint within 7 days, look into it, and give you a written answer within 30 days. If we need longer we will tell you why.

If you are not satisfied with our answer, or we have not replied within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC). Complaints to the OAIC must be in writing, and the OAIC asks that you complain to us first.

Because Vestige is a small business that the Privacy Act may not yet cover, the OAIC may decline to investigate a complaint about us. You can still raise misleading conduct with NSW Fair Trading or the Australian Competition and Consumer Commission, and the courts can hear a claim for a serious invasion of privacy.

If you live in the EU or the UK, you may also complain to your local data protection authority or to the UK Information Commissioner's Office.

Changes to this policy

We review this policy at least once a year and whenever our practices change. We will post the new version here with a new "Last updated" date. If a change significantly alters how we handle your route or your Strava data, we will also say so in the Terrain Studio or by email to customers with open orders.

Contact

Vestige is the brand of Vestige Athletic, the registered business name of the partnership B.O Boulton & A.R O'Connor (ABN 47 403 980 322), based in New South Wales, Australia.