Collected, and why
| Information | Purpose | Retention |
|---|---|---|
| Name, delivery address, email, phone | To take, pack and deliver the order | 7 years (tax records) |
| Order and payment confirmation — never the full card number | Sales, refunds and chargebacks | 7 years |
| Emails you send support | To answer you and keep a case history | 3 years |
| IP address, browser and device type | Security, fraud checks, basic traffic counts | 12 months |
| Marketing email address, where you opt in | To send the offers you asked for | Until you unsubscribe |
Full card numbers, security codes and banking credentials go straight to the payment processor and never reach us. We do not buy contact lists, we do not sell your information, and we do not knowingly collect information from children.
What is set, and when
This article and its policy pages are plain static files. Cookies that are strictly necessary may be set once you reach the checkout, so your basket and session stay together. Anything used for analytics or advertising is set only with your consent, and you can withdraw that at any time by clearing cookies and declining next time.
- Payment processor — to take payment and process refunds.
- Warehouse and couriers — name, address and phone number, to deliver the parcel.
- Email and helpdesk providers — to send order mail and store support threads.
- Advisers and authorities — only where the law requires it.
Each may use the information only to provide that service to us.
Some of those providers hold data outside New Zealand. Where that happens we require comparable safeguards to those in the Privacy Act 2020, and for customers in the EU or UK we rely on Standard Contractual Clauses or an equivalent mechanism.
Access, correction, deletion
You may ask what we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, and unsubscribe from marketing at any time. Email from the address used on the order; we respond within 20 working days. If you are unhappy with the outcome you may complain to the Office of the Privacy Commissioner at privacy.org.nz. EU and UK residents have further rights set out on the EU & UK rights page.
Traffic is encrypted in transit and access to order records is restricted to staff who need it. No system is perfectly secure; if a breach is likely to cause serious harm we will notify you and the Privacy Commissioner as the Act requires.