Our main policy is built around New Zealand law, because that is where we trade from. Shoppers in Europe and Britain are covered by a second set of rules on top of it, and rather than bury that in footnotes we keep it here. Everything on this page overrides the main policy for those shoppers; everything not mentioned here still applies.
We act as controller for the information described below. Write to , or to at .
Why each piece of processing is allowed
Getting a parcel to your door is simply the contract you entered into, and the same goes for handling a refund. Keeping the resulting invoice on file for years afterwards is not our choice at all — revenue law requires it. Checking an order for fraud, and keeping the site standing up, we do because any retailer sensibly must; we have weighed that against the intrusion it causes and think it is modest, but you are entitled to tell us you disagree.
Everything optional — a newsletter, an analytics cookie, an advertising tag — happens only when you have said yes, and stops when you say otherwise. Consent is never a condition of buying anything.
Invoices and order records stay with us for seven years because tax rules set that clock, not us. A support conversation is kept for three years so a later question about the same device has context. Security logs expire after twelve months. When you unsubscribe we keep only enough to remember not to contact you again.
You can ask to see what we hold and get a copy of it, and you can have anything inaccurate put right. You can ask us to delete it, and we will, except for the records tax law obliges us to retain — we will say plainly which those are. If something is in dispute you can have processing frozen rather than deleted while it is sorted out, and you can ask for your data in a portable file you can hand to someone else.
Two rights work as a simple veto: you can object to anything we justify by our own legitimate interests, and you can stop direct marketing outright, with no reason needed and no argument from us. Consent already given can be withdrawn whenever you like, which does not unpick what was lawfully done beforehand.
Nothing about you is decided by an algorithm acting alone. There is no profiling behind your order and no automated decision you would need a human to review.
Email us from the address the order was placed under and name the right you want to use — that is the whole procedure, and there is no form. A reply comes inside one month. Something genuinely tangled may take up to two months more, and if that happens we tell you before the first month is out rather than after. We do not charge, unless a request is plainly baseless or repeated to make a point.
We are a New Zealand business, so your information does travel out of the EEA and the UK to reach us. That transfer runs on the European Commission’s standard clauses, or the UK addendum to them, or an adequacy finding where one covers the route. Ask and we will tell you which one applies to your order.
Tell us first — it is faster, and most complaints are a misunderstanding we can clear up the same week. You never lose the right to go over our heads: in Britain that is the Information Commissioner’s Office at ico.org.uk, and in the EU it is the data protection authority where you live, where you work, or where the problem happened.