Legal Notice – Last Updated: August 10, 2026

1. Our Commitment

We apply security measures proportionate to our business size, information sensitivity, system risk, and legal obligations under APP 11 of the Privacy Act 1988 (Cth).

2. Security Controls

• TLS encryption for all data transmitted between browsers and our servers.
• PCI DSS compliant payment processing – we do not store full card numbers or security codes.
• Multi-factor authentication for administrative access.
• Role-based access controls and least-privilege principles.
• Software patching, operating system updates, firewalls, and malware protection.
• Regular encrypted backups and disaster recovery procedures.
• Security logging, monitoring, and vendor security assessments.

3. Fraud Prevention

We use automated and manual fraud detection including real-time transaction risk scoring, IP and device analysis, billing inconsistency checks, account takeover detection, and unusual download activity monitoring. Flagged orders may be held briefly for verification. You may request human review of any fraud-related decision.

4. Notifiable Data Breaches

In the event of an eligible data breach under Part IIIC of the Privacy Act (Notifiable Data Breaches scheme), we will take immediate steps to contain the breach, notify the OAIC as required by law, notify affected individuals where there is a likely risk of serious harm, provide guidance on protective steps you can take, and conduct a post-incident review to prevent recurrence.

5. Vulnerability Reporting

Report security vulnerabilities responsibly to admin@ellemotional.com – Subject: Security Report. Include the affected page or system, steps to reproduce, and likely impact. We will not take legal action against good-faith vulnerability disclosures.