Privacy Policy

1.1. This Privacy Policy explains how OnlinePhotoPrinting NZ Ltd ("we", "us") collects and uses personal information through OnlinePhotoPrinting.co.nz (the "Site"). For the purposes of the Privacy Act 2020, OnlinePhotoPrinting NZ Ltd is the agency responsible for your personal information.

1.2. Registered office: 128 City Road, London EC1V 2NX, United Kingdom. NZBN: TODO_NZBN.

1.3. We follow a data-minimisation approach: we only collect the personal information we need, and we delete the photographs you upload for an order within 30 days of that order being completed.

1.4. Privacy queries: hi@onlinephotoprinting.co.nz. Please mark the subject line "Privacy" so we can route it promptly.

2.1. Account & profile. Name, email, password (hashed), phone, optional date of birth.

2.2. Order & billing. Delivery and billing address, order history, payment confirmation token (we do not store full card details — these are handled by our PCI-DSS-compliant payment provider).

2.3. Uploaded content. Photographs and any text or design choices you submit for printing.

2.4. Communications. Emails, chat transcripts and call records (calls may be recorded for training; you will be told before any recording).

2.5. Technical & usage data. IP address, device and browser information, referral URLs, pages visited, cookies and similar identifiers (see our Cookie Policy).

2.6. We do not knowingly collect sensitive personal information, and we do not intentionally collect information from children under 16.

3.1. The table below summarises why we use your information, consistent with the Information Privacy Principles of the Privacy Act 2020.

4.1. We will send marketing emails about our products in two situations: (i) you have consented (e.g. ticked a marketing box at sign-up or in the dashboard); or (ii) the "soft opt-in" under the Unsolicited Electronic Messages Act 2007 applies — you bought from us, we are emailing about similar products, and you can opt out in every email.

4.2. You can withdraw consent or stop the soft opt-in at any time using the unsubscribe link in every marketing email, or by emailing hi@onlinephotoprinting.co.nz.

5.1. We use strictly necessary cookies without consent (these are required to make the Site work). For all other cookies (analytics, marketing, preferences) we rely on your prior consent given through our cookie banner. See our Cookie Policy.

6.1. We share data only where necessary and on the basis described:

• Payment processors (e.g. Stripe) — to take payment.
• Delivery and fulfilment partners (NZ Post, courier services) — to deliver your order.
• Cloud hosting and email providers — to host the Site and send transactional email.
• Analytics and marketing providers — only with your cookie consent.
• Professional advisors (accountants, lawyers) — where reasonably necessary.
• Authorities — where required by law (e.g. Inland Revenue (IRD), police on lawful request).
• A buyer of our business — in the event of a sale, merger or reorganisation, subject to confidentiality and equivalent protection.

6.2. We do not sell personal information.

7.1. Some of our processors operate outside New Zealand. Where personal information is transferred overseas, we rely on one of:

• transfer to countries whose privacy laws provide safeguards comparable to the Privacy Act 2020;
• binding contractual protections (such as model contractual clauses) requiring the overseas provider to protect your information to a standard comparable to the Privacy Act 2020;
• another basis permitted under Information Privacy Principle 12 of the Privacy Act 2020.

7.2. A list of countries and safeguards is available on request to hi@onlinephotoprinting.co.nz.

8.1. Retention can be longer where required to establish, exercise or defend legal claims.

9.1. Under the Privacy Act 2020 you have the right to:

• be informed about how we use your data (this policy);
• access a copy of the personal information we hold about you;
• have inaccurate personal information corrected;
• have your personal information erased in certain circumstances;
• restrict how we use your personal information;
• data portability (receive certain data in a machine-readable form);
• ask us to stop using your information for direct marketing or profiling;
• withdraw consent at any time where we rely on consent;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not carry out such processing).

9.2. To exercise any right, email hi@onlinephotoprinting.co.nz. We will respond within one month and may extend by up to two further months for complex requests, telling you why.

9.3. You can complain to the Office of the Privacy Commissioner — the New Zealand privacy regulator — at privacy.org.nz or call 0800 803 909. We would appreciate the chance to address your concern first.

10.1. We use appropriate technical and organisational measures including encryption in transit (TLS), encrypted backups, role-based access, password hashing, and PCI-DSS-compliant payment processors. No system is 100% secure; please use a strong unique password and contact us immediately at hi@onlinephotoprinting.co.nz if you suspect unauthorised account access.

11.1. The Site is intended for adults aged 18 or over. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

12.1. We may update this policy from time to time. Material changes will be notified by email or on next sign-in. The "Last updated" date is at the foot of this page.