Legal documents and protections an Australian ecommerce business actually needs

An Australian ecommerce business is, legally speaking, three things at once: a retailer dealing with consumers, a website operator collecting personal information, and an owner of brand and product assets that competitors can copy. Each of those identities pulls in a different body of law, and each one expects you to have certain documents and processes in place before something goes wrong.

This article works through the core legal protections that an online store operating in Australia should have, what each one is for, and where the legal weight behind it sits. The areas covered are:

• Website terms of use and online sale terms
• Privacy policy and personal information handling
• Consumer guarantees and refund obligations under Australian Consumer Law
• Electronic marketing consent under the Spam Act
• Brand protection through trade mark registration
• Supplier, contractor, and employment agreements
• Confidentiality protection for product, supplier, and pricing information

Website terms of use and online sale terms

A common mistake is treating "terms and conditions" as one document. For an ecommerce business there are really two: a set of website terms of use that govern how visitors interact with the site, and a separate set of sale terms that govern the contract formed when a customer places an order.

Sale terms are where most of the commercial risk sits. They set out when a contract is formed (typically on order acceptance, not order placement), pricing and payment, delivery and risk of loss, returns beyond what the law requires, dispute resolution, and the boundaries of any warranty you offer voluntarily. Sale terms cannot override the consumer guarantees in the Australian Consumer Law, but they can sit alongside them and clarify the parts the law leaves to the parties — delivery times, change-of-mind returns, and the scope of any extended warranty.

Website terms of use cover the broader site: acceptable use, intellectual property in the site content, links to third-party sites, account creation, and limitation of liability for information published on the site (blog posts, product descriptions, guides).

Privacy policy and personal information handling

If an ecommerce business has annual turnover above $3 million, or trades in personal information, or provides a health service, it is an "APP entity" under the Privacy Act 1988 (Cth) and must comply with the 13 Australian Privacy Principles. Businesses below the $3 million threshold are not automatically covered, but can opt in under s 6EA, and increasingly customers and platform partners expect a privacy policy regardless of turnover.

The Australian Privacy Principles require an APP entity to have a clearly expressed and up-to-date privacy policy describing what personal information is collected, how it is collected, the purposes of collection, how it is held and secured, how individuals can access or correct it, and whether it is disclosed overseas. For an ecommerce site that runs on Shopify, uses an email marketing platform hosted in the US, and ships through a third-party logistics provider, the overseas-disclosure point is rarely trivial.

The Notifiable Data Breach scheme adds a second layer: an APP entity that suffers a data breach likely to result in serious harm must notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable.

Consumer guarantees and refund obligations

The most misunderstood part of online retail is what the law requires you to refund. The Australian Consumer Law, contained in Schedule 2 of the Competition and Consumer Act 2010 (Cth), imposes a set of consumer guarantees on every sale of goods or services to a consumer. The key guarantees for goods are acceptable quality, fitness for any disclosed purpose, matching description, and matching sample.

Three points trip up online sellers:

• The guarantees apply automatically. They cannot be excluded, restricted, or modified by your terms. A "no refunds" or "all sales final" sign or website notice does not displace them.
• Whether the customer is entitled to a refund, replacement, or repair turns on whether the failure is "major" or "non-major". For a major failure the customer chooses the remedy; for a non-major failure the supplier chooses.
• Statements like "refunds at our discretion" or "store credit only" can themselves breach the misleading representation provisions of the Australian Consumer Law, exposing the business to ACCC action.

Change-of-mind returns are a separate matter — the law does not require them, so your sale terms decide whether you offer them and on what conditions.

Electronic marketing consent

If the business sends order confirmations, abandoned-cart emails, newsletters, or SMS promotions, it is sending "commercial electronic messages" within the meaning of the Spam Act 2003 (Cth). The Spam Act requires three things for every commercial electronic message: consent from the recipient (express or inferred), clear identification of the sender, and a working unsubscribe facility.

Express consent is the cleanest path: a separate, unticked checkbox at checkout or signup that explicitly invites marketing emails. Inferred consent — based on an existing customer relationship — is narrower than businesses tend to assume, and does not extend indefinitely after the last transaction.

Brand protection through trade marks

A registered trade mark with IP Australia gives the owner the exclusive right to use the mark in the registered classes of goods and services across Australia, and a clear basis for infringement action against copyists. Registration lasts 10 years from the filing date and can be renewed indefinitely.

For an ecommerce business the practical points are:

• Register the brand name and the logo. They are separate marks and copyists usually copy one or the other.
• Register in the classes that match what is actually sold, plus class 35 (retail services) if the business is the retailer rather than the manufacturer.
• A business name registration and a domain name registration give no trade mark rights. They are administrative registrations, not protective ones.
• A common-law trade mark exists from use, but enforcing it requires proving reputation in the relevant market, which is expensive and uncertain compared with the certificate from IP Australia.

Supplier, contractor, and employment agreements

The contracts on the supply side of an ecommerce business carry their own risk. A supplier agreement should cover the specifications and quality standard for goods supplied, lead times and order acceptance, pricing and price-change mechanics, intellectual property in product designs and packaging artwork, indemnities for defective product and intellectual property infringement, and the conditions for ending the relationship.

For staff the right form of agreement turns on the relationship. Employees are engaged under written employment agreements that sit on top of any applicable modern award or enterprise agreement and the National Employment Standards in the Fair Work Act 2009 (Cth). Contractors — including virtual assistants, freelance designers, and developers — are engaged under contractor agreements that, among other things, assign or licence the intellectual property they create to the business. Without an express assignment, copyright in code, graphics, and copy generally stays with the contractor, not the business that paid for it.

Mis-characterising an employee as a contractor remains a high-cost mistake: the Fair Work Ombudsman and the Australian Taxation Office both apply a substance-over-form test, with back-pay, superannuation, and penalties available against businesses that get it wrong.

A worked example

Consider a homewares business selling Australian-made ceramics through its own Shopify store and Instagram. Annual revenue is $1.2 million, the founder is the only employee, and two virtual assistants in the Philippines handle customer service and content.

The legal stack the business needs:

• Sale terms and website terms of use, drafted to its actual fulfilment model (made-to-order pieces have different delivery and refund logic than off-the-shelf stock).
• A privacy policy. Turnover is below $3 million, so the business is not automatically an APP entity, but it collects names, addresses, and payment information through Shopify, uses Klaviyo for email marketing, and ships through a third party — opting in under s 6EA and publishing an APP-compliant policy is cleaner than relying on the small business exemption and explaining that to platform partners.
• Consumer guarantee compliance baked into the returns page, with no "no refunds" language and a clear major-failure / non-major-failure pathway.
• Express marketing consent collected at checkout and at newsletter signup, separate from the order confirmation.
• Trade marks for the business name and stylised logo in class 21 (ceramic homewares) and class 35 (retail services).
• Contractor agreements with both virtual assistants, with express copyright assignment for any content they produce, confidentiality terms covering customer lists and supplier identities, and clear payment and termination terms.
• Supplier agreements with the two kilns producing the stock, with quality specifications, IP ownership of the designs (which the business commissions), and indemnities for defective product.

That stack costs less than a single Australian Consumer Law dispute, a single privacy complaint, or a single trade mark opposition. The expense lives in setting it up; the value lives in the disputes that never start because the documents already answer the question.

How Artificer Legal helps

When a business comes to us with an ecommerce setup, the work usually runs:

• A short scoping session to map the business model, fulfilment, marketing channels, and staffing — the legal stack flexes against those facts, not against a generic template.
• A document audit: what is in place, what is missing, what was downloaded from a template site and no longer reflects the business.
• Drafting or refreshing the core documents — sale terms, website terms of use, privacy policy, supplier and contractor agreements — to match the actual business and Australian law.
• A trade mark search and, where the brand is clear, a filing strategy across the right classes.
• A short compliance briefing for the founder and any staff who handle returns, marketing, or data, so the documents are actually used rather than filed away.

The aim is a defensible legal position that does not get in the way of running the business.

In summary

An ecommerce business in Australia sits at the intersection of consumer law, privacy law, intellectual property, electronic marketing rules, and ordinary contract law. The protections worth having are not exotic; they are a tight set of documents and registrations that line up with the way the business actually operates.

The core stack is sale terms and website terms of use, a privacy policy, a returns policy that respects the Australian Consumer Law's consumer guarantees, express marketing consent under the Spam Act, registered trade marks for brand and logo, and written supplier, contractor, and employment agreements with clear intellectual property and confidentiality terms. Each item answers a specific risk the business is already running, whether or not the documents are in place.