1. Who does what
CTC Surfcraft supplies the craft and manages customer enquiries and orders. CTC Surfcraft handles the agreed balance invoice. The seller and receiving business are identified in the quotation and payment documents. Swellix provides the website as CTC’s digital service provider. Stripe provides hosted payment services. Each organisation remains responsible for its own handling of information and its legal obligations.
Online deposits are currently unavailable while the receiving Stripe account is connected and tested. The description below explains the intended checkout flow; this website is not currently taking payments.
2. Designing on this website
The craft studios have no fields for names, email addresses, phone numbers, street addresses, rider age, sex or free-text notes. The racing-board studio includes a user-weight slider from 50 to 100 kg. Your selected weight stays in your browser and is included in your downloaded summary; it is not saved to our server, included in colour links or sent to Stripe. An optional delivery postcode is used only in your browser to calculate an approximate freight range. It is not saved, sent to our server or Stripe, or included in design summaries or shared links. There are no customer file uploads. Craft options and colours are used to display your design in your browser. This website does not send a customer order form to the team portal or FormSubmit.
You can copy a colour-only link or download a craft summary. Those files are saved on your device and anyone you share them with can read them. When Stripe checkout is enabled, a reference containing only fixed craft options and colour-chart numbers is passed to Stripe to help CTC identify your concept. A reference is not proof of payment, identity or order acceptance.
This change does not delete earlier order records, emails or copies held by CTC, its team portal or other recipients. Contact CTC about existing information. This notice applies to the website, not every separate service used by CTC.
3. Stripe checkout and invoices
When enabled, checkout opens on buy.stripe.com. Enter your contact, billing, delivery and payment information on Stripe, not on this website. Stripe processes that information under its privacy policy. The receiving merchant can access checkout and transaction information in Stripe to contact you, reconcile the deposit, arrange delivery and invoice the balance.
This website does not copy Stripe customer profiles, addresses or payment information into its own order database. It does not receive card numbers or security codes. CTC and authorised personnel may still need customer information for fulfilment, accounting, support, refunds and legal obligations. Using Stripe reduces collection through this website; it does not remove the merchant’s privacy responsibilities.
Provide only information requested for a legitimate order. A parent or guardian must handle a child’s purchase. Do not submit children’s names, health information, identity documents, banking passwords or login codes to the craft studio.
4. Technical information and external services
Web hosting, delivery and security providers, including OpenAI Sites and Cloudflare, necessarily process technical information such as IP addresses, browser information, request times and requested pages. Security and operational logs may contain that information. If you use owner or team sign-in, the authentication provider processes account information. This is why we do not claim that browsing is anonymous or that no personal information is ever processed.
The craft studio does not use customer form details for advertising or keep customer form drafts in browser storage. Hosting and sign-in services may use cookies necessary for security and access. Downwind Rush, social links, email links and other external sites have their own practices. The embedded game loads from play.downwindrush.au only after you press Play. That service then receives technical information such as your IP address and browser details. You can also open the game in a separate tab. Emailing CTC or Swellix sends information through your and the recipient’s email services.
Stripe and infrastructure providers may process information outside Australia. Their privacy notices describe their operations and safeguards. Applicable privacy and overseas-disclosure obligations continue to apply; choosing a service provider does not transfer every responsibility to that provider.
5. Use, access and retention
Customer information available to CTC is used for enquiries, agreed orders, payment reconciliation, delivery, customer support, fraud prevention and legal record keeping. A purchase does not automatically subscribe you to marketing. Customer information should be available only to people who need it for authorised work; it is not a general marketing or public customer list.
Records must be kept only for as long as reasonably needed for those purposes or required by law, and then securely deleted or de-identified where appropriate. Transaction providers have their own retention obligations. Contact CTC to ask what information it holds, request access or correction, or discuss deletion. Legal record-keeping duties may prevent immediate deletion of every transaction record.
6. Security and concerns
We reduce unnecessary collection, retire old form endpoints and use access controls for protected services. No internet service can guarantee complete security. Please report a suspected issue without accessing or disclosing another person’s information. We will assess the report and take appropriate steps, including notifications where required by law.
Contact CTC first about an order privacy concern, or Swellix about its website services. You can also obtain independent advice or contact the Office of the Australian Information Commissioner where its jurisdiction applies. This notice does not limit any rights or remedies available under law.