When you use Normal, you are trusting us with your information. We take your privacy seriously. Normal collects a range of information, including personal information about you. Personal information includes information that identifies you or from which you are reasonably identifiable.

Please take a moment to read this privacy policy as it describes what happens to your personal information that is collected through our website at www.itsnormal.com (Website) or as a result of you using our products or services. This policy outlines the types of information we collect, why we collect it and how you can manage, update and delete the information we hold.

Privacy Policy

Last updated: 2 September 2026

When you use Normal, you trust us with information about you. We take your privacy seriously.

This Privacy Policy explains how Lova (Normal) Pty Limited ACN 693 563 236, trading as Normal (Normal, we, us or our), collects, uses, holds, discloses and protects personal information, and the choices and rights available to you.

This Privacy Policy applies when you:

• visit www.itsnormal.com or another website or digital service operated by Normal;

• purchase or enquire about our products or services;

• create or use an account with us;

• participate in a quiz, survey, research activity or product-development activity;

• subscribe to email or SMS communications;

• interact with us through social media;

• contact our customer support team; or

• otherwise provide personal information to us.

Normal is an Australian company and is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you are located outside Australia, including in the United States, additional privacy laws may apply depending on where you live and the circumstances in which we process your personal information.

1. What personal information we collect

The types of personal information we collect depend on how you interact with Normal.

Contact and account information

We may collect:

• your name;

• email address;

• telephone or mobile number;

• postal, billing and delivery addresses;

• date of birth or age information;

• account information and login details; and

• communication and marketing preferences.

Purchase and transaction information

We may collect information about:

• products you purchase, return or enquire about;

• orders and transactions;

• billing and shipping;

• payments and payment status;

• discounts and promotions used;

• returns, refunds and exchanges; and

• communications relating to an order.

Payments may be processed by third-party payment providers. Normal does not necessarily receive or store your complete payment-card details.

Device and website information

When you visit our website, we and our service providers may automatically collect information including:

• IP address;

• device identifiers;

• browser and device type;

• operating system;

• pages viewed;

• links selected;

• referring pages;

• date and time of visits;

• shopping-cart and checkout activity; and

• information about how you interact with our website and communications.

Communications

We may collect information contained in communications you send to us, including:

• emails;

• customer-service enquiries;

• forms;

• reviews;

• survey responses;

• social-media communications; and

• other correspondence.

Marketing information

If you subscribe to our marketing, we may collect:

• your email address;

• mobile number;

• subscription and consent information;

• communication preferences; and

• information about your engagement with our messages.

Quiz, survey, research and sensitive information

If you voluntarily participate in a Normal quiz, survey, research activity or similar experience, you may choose to provide information about your preferences, experiences, body, relationships, sexuality or sexual practices.

Some of this information may be considered sensitive information under Australian law or sensitive personal information under laws in other jurisdictions.

Participation in quizzes, surveys and research is voluntary.

Where required by law, we obtain consent before collecting sensitive information.

Quiz and survey responses may be stored in Normal's customer relationship management systems together with other information associated with your customer profile. We use this information for the purposes explained to you when it is collected, which may include:

• providing relevant product or educational recommendations;

• understanding customer preferences and experiences;

• improving our products, services and educational content;

• conducting research and product development; and

• personalising communications where you have agreed to receive them.

We will not use sensitive information for a materially different purpose unless permitted by law or we obtain any consent required by law.

Employment information

If you apply for a role with Normal, we may collect personal information relevant to your application and potential employment.

Information from other sources

We may also receive information from:

• service providers;

• suppliers and contractors;

• business partners;

• recruitment agencies;

• social-media platforms where you interact with us;

• publicly available sources; and

• other third parties where permitted by law.

We may also create aggregated or de-identified information that does not reasonably identify an individual.

2. How we collect personal information

Where reasonably practicable, we collect personal information directly from you.

This may occur when you:

• place an order;

• create an account;

• subscribe to our email or SMS communications;

• complete a quiz or survey;

• contact us;

• interact with our website;

• communicate with customer support;

• enter a promotion;

• provide feedback or a review; or

• otherwise use our products or services.

We may also collect personal information automatically through cookies and similar technologies, or from third parties as described in this Privacy Policy.

3. How we use personal information

We may collect, hold, use and disclose personal information to:

• provide and fulfil products and services;

• process orders and payments;

• arrange shipping and delivery;

• manage returns, exchanges and refunds;

• maintain customer accounts;

• provide customer support;

• communicate with you about orders and services;

• provide product or educational recommendations;

• administer quizzes, surveys and research;

• understand customer preferences and experiences;

• develop and improve products and services;

• personalise your experience where appropriate;

• maintain, operate and improve our website;

• understand website usage and performance;

• prevent and detect fraud, misuse, security incidents or unlawful activity;

• send marketing communications where permitted by law;

• send transactional and abandoned-cart communications;

• administer promotions and competitions;

• consider employment applications;

• comply with legal, accounting and regulatory requirements;

• establish, exercise or defend legal claims;

• protect the rights, property and safety of Normal, our customers and others; and

• manage and develop our business.

If we intend to use personal information for a materially different purpose, we will provide any additional notice or obtain any consent required by applicable law.

4. How we disclose personal information

We may disclose personal information to third parties where reasonably necessary for the purposes described in this Privacy Policy.

These recipients may include:

• Shopify and other ecommerce providers;

• payment processors;

• parcel, logistics and delivery providers;

• cloud-hosting and technology providers;

• customer relationship management providers;

• email and SMS service providers;

• customer-support platforms;

• website analytics providers;

• fraud-prevention and security providers;

• survey and research providers;

• review platforms;

• professional advisers, including lawyers, accountants and insurers;

• companies within the Normal group;

• regulators, courts, law-enforcement bodies or government agencies where required or authorised by law; and

• parties involved in a proposed or completed merger, acquisition, financing, restructuring or sale of all or part of our business.

Where service providers process personal information on our behalf, we expect them to protect it appropriately and use it only for authorised purposes.

We do not disclose personal information to third parties for their own unrelated marketing purposes without consent or another lawful basis.

5. Cookies and similar technologies

Normal uses cookies and similar technologies to operate and improve our website.

These technologies may be used to:

• keep our website functioning;

• maintain security;

• remember your preferences;

• remember items placed in your shopping cart;

• support checkout functionality;

• identify abandoned carts or checkouts;

• understand website traffic and performance; and

• help us improve the customer experience.

Normal does not currently use advertising pixels on its website for cross-site behavioural advertising.

We may use analytics and service technologies that process device, browser and website-usage information on our behalf.

You can manage certain cookies through your browser settings and any cookie-preference tools we make available.

If our use of advertising or tracking technologies materially changes, we will update this Privacy Policy and provide any choices or notices required by law.

6. Email marketing

If you have subscribed to receive promotional emails from Normal, we may send you information about:

• products;

• promotions;

• offers;

• events;

• educational content; and

• other Normal news that may interest you.

You may unsubscribe from promotional emails at any time using the unsubscribe link contained in the email or by contacting us.

Opting out of marketing will not prevent us from sending communications that are necessary to fulfil or service a transaction, such as order confirmations, shipping information or customer-service messages.

7. SMS marketing and abandoned-cart messaging

If you provide your mobile number and opt in to receive SMS communications from Normal, we may send transactional and promotional text messages.

These messages may include:

• order and delivery notifications;

• customer-service communications;

• abandoned-cart or abandoned-checkout reminders;

• feedback or review requests;

• product updates; and

• promotional offers.

Consent to receive marketing SMS messages is not a condition of purchasing a Normal product.

We may use information about your cart or checkout activity to determine whether to send an abandoned-cart or abandoned-checkout reminder.

You may opt out of promotional SMS messages at any time by following the unsubscribe instructions in the relevant message, including by replying STOP where that functionality is supported.

Message and data rates may apply.

We may disclose your mobile number, message-consent information and information necessary to deliver these communications to service providers that operate our SMS program on our behalf.

8. Sensitive personal information

Normal recognises that information about sexuality, sexual practices and other intimate matters can be particularly sensitive.

Where we collect sensitive information through quizzes, surveys, research or other interactions, we:

• explain the relevant purpose when the information is collected;

• obtain consent where required by law;

• limit use of that information to the purposes explained to you or otherwise permitted by law;

• restrict access to people and service providers who reasonably need it;

• use reasonable safeguards to protect it; and

• retain it only for as long as reasonably necessary or required by law.

You may withdraw consent to future processing where applicable law gives you that right.

9. Research, surveys and product development

We may invite customers or other individuals to participate in voluntary research, surveys, quizzes or product-development activities.

We may use information collected through those activities to:

• understand customer needs and experiences;

• improve existing products and services;

• develop new products;

• improve educational content;

• provide product recommendations;

• conduct research and analysis; and

• contact participants about future research opportunities where they have agreed to this.

Where appropriate, we may analyse information in aggregated or de-identified form.

We will not use an identifiable quote, testimonial or research response in public advertising or marketing without obtaining appropriate permission.

10. Information security

We take reasonable administrative, technical and physical measures designed to protect personal information from:

• misuse;

• interference;

• loss;

• unauthorised access;

• modification; and

• unauthorised disclosure.

These measures may include access restrictions, technical security controls, internal procedures and contractual requirements for relevant service providers.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

If a data breach occurs, we will assess and respond to it in accordance with applicable law.

11. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required by law.

When deciding how long to retain information, we may consider:

• why the information was collected;

• whether we continue to need it;

• the nature and sensitivity of the information;

• legal, tax, accounting and regulatory requirements;

• security and fraud-prevention needs; and

• relevant limitation periods.

When personal information is no longer required, we will take reasonable steps to delete, destroy or de-identify it, subject to applicable legal obligations.

12. Overseas and cross-border processing

Normal is based in Australia, but some of our service providers may operate or store information outside Australia.

As a result, personal information may be stored or processed in other countries, including the United States and other jurisdictions in which our service providers operate.

Privacy and data-protection laws in those countries may differ from Australian law.

Where Australian privacy law requires us to take particular steps before disclosing personal information overseas, we will take those steps.

We will otherwise handle international transfers and disclosures in accordance with applicable law.

13. Your Australian privacy rights

If Australian privacy law applies to you, you may contact us to:

• request access to personal information we hold about you;

• ask us to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading;

• withdraw consent where applicable;

• opt out of direct marketing; or

• make a privacy complaint.

We may need to verify your identity before processing a request.

We will respond within the timeframe required by law or, where no specific timeframe applies, within a reasonable period.

There may be circumstances in which applicable law permits or requires us to refuse an access or correction request. Where required, we will explain the reason for our decision.

If you are dissatisfied with the way we have handled an Australian privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

14. United States privacy information

Normal sells products to customers in the United States and recognises that U.S. privacy laws may provide additional protections depending on where a customer lives and whether a particular law applies to Normal.

Normal does not currently meet the thresholds that make it a “business” subject to the California Consumer Privacy Act (CCPA).

Accordingly, the consumer-rights provisions of the CCPA do not currently apply to Normal solely because an individual is a California resident.

Other U.S. state privacy laws may also have applicability thresholds and exemptions. We monitor the privacy laws applicable to our activities and will update our practices and this Privacy Policy if additional legal obligations become applicable to Normal.

Regardless of whether a particular U.S. state privacy law applies, you may contact us if you would like to:

• ask what personal information we hold about you;

• request that inaccurate information be corrected;

• request deletion of information; or

• ask a question about how we use your personal information.

We will consider and respond to reasonable requests in accordance with applicable law and our legal and operational obligations.

15. Sale of personal information and targeted advertising

Normal does not currently use advertising pixels on its website for cross-site behavioural advertising.

Normal does not sell personal information for monetary payment.

We may disclose personal information to service providers that process it on our behalf for purposes such as ecommerce operations, payments, shipping, communications, customer relationship management, analytics and customer support.

If our practices change in a way that gives rise to additional rights under applicable U.S. privacy laws, we will update this Privacy Policy and provide any required mechanisms for exercising those rights.

16. Children and minors

Normal's website and products are intended for adults.

You must be at least 18 years old to purchase our products or use portions of our services that are restricted to adults.

We do not knowingly collect personal information online from children under 13 in circumstances governed by the U.S. Children's Online Privacy Protection Act.

If you believe a child has provided personal information to us contrary to this Privacy Policy, please contact us so we can investigate and take appropriate action.

17. Third-party websites and services

Our website may contain links to websites, platforms or services operated by third parties.

Normal is not responsible for the privacy practices of those third parties. Their handling of personal information is governed by their own privacy policies and terms.

We encourage you to review those policies before providing personal information.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our business;

• changes to our technology or service providers;

• changes to how we handle personal information; or

• changes to applicable law.

The current version will be made available on our website and the Last updated date will be revised when changes are made.

Where required by law, we will provide additional notice or obtain consent before materially changing how previously collected personal information is used.

19. Contact us and privacy complaints

If you have a question about this Privacy Policy, wish to make a privacy request or would like to make a complaint about how we handle personal information, please contact:

Privacy Officer
Lova (Normal) Pty Limited trading as Normal
ACN 693 563 236
Email: admin@itsnormal.com

We will endeavour to respond to privacy enquiries and complaints within a reasonable period.

If you are in Australia and are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).