Last updated:
1. Who we are
This policy explains how Kiwi Santa Photo ("we", "us" and "our") collects, uses, stores and discloses personal information when you visit our website, enquire, book a Christmas photography session, pay, or receive your photographs.
We are based in New Zealand and handle personal information in accordance with the Privacy Act 2020. For privacy matters, contact our privacy officer at support@kiwisanta.photo.
2. Information we collect
Depending on how you use our services, we may collect:
- Booking and contact details: your name, email address, phone number, session date, time, location, group size and any details you choose to include with your booking.
- Photographs: images of you and other participants, and information needed to organise, edit and deliver those images.
- Transactions: the amount paid, booking or transaction reference, payment status, refunds and limited payment-method information supplied by Stripe, such as card brand and last four digits.
- Communications: enquiries, booking changes, cancellation requests, feedback and correspondence.
- Technical information: information generated when you use the website or payment service, such as IP address, browser or device information, security logs and transaction-related information.
We generally collect information directly from you. We may also receive relevant information from a person booking on your behalf or from Stripe and the providers used to operate our services. If you book for other people, please share this policy with them and provide only information you are authorised to give us. We will take any further notification steps required by law.
Providing information is voluntary unless we tell you otherwise. Without the information needed to arrange a booking, take payment or deliver photographs, we may be unable to provide the service. Please do not send unnecessary sensitive information.
3. How we use information
We use personal information for our own business purposes connected with providing and managing Kiwi Santa Photo services, including to:
- Arrange and manage bookings, communicate session information and respond to enquiries.
- Process payments, cancellations, replacement sessions and refunds.
- Take, organise, edit, store and deliver photographs to the booking customer or an authorised recipient.
- Maintain business and accounting records, manage complaints and meet legal obligations.
- Keep our website and services secure, prevent fraud and resolve payment disputes.
We do not sell or rent personal information, trade customer lists, or provide customer information to other businesses for their unrelated advertising. Booking with us does not automatically sign you up to a marketing mailing list.
4. Service providers and necessary disclosures
We do not share personal information for unrelated purposes. However, providing our service involves limited processing by providers such as Stripe, website and booking-system hosts, email providers, and photo storage or delivery services. Our staff and photographers may access information where needed to carry out their work for us.
We limit access and disclosures to what is reasonably needed for those services and use reasonable safeguards. Stripe and other providers may also process information for their own legal, security or fraud-prevention obligations, as explained in their policies.
We may disclose information with your permission, where required or authorised by law, or where necessary to respond to a serious threat to health or safety as permitted by the Privacy Act. We do not promise that information will never be disclosed in these circumstances.
5. Payments through Stripe
Payments are processed through Stripe. When paying, you provide payment information to Stripe through its payment service. We do not store your full card number or card security code. We receive the transaction and limited payment information needed to manage your booking, payment, refund or dispute.
Stripe processes payment, device and transaction information to provide payment services, prevent fraud and meet its legal obligations. For details, read the Stripe Privacy Policy.
6. Photographs and children
Photographs can identify people, including children. We use session images to provide the photography service and deliver photographs to the booking customer or an authorised recipient. If you are arranging a session for a child, please ensure you have authority to do so and remain responsible for the child during the visit.
We will seek appropriate permission before using identifiable customer photographs publicly on our website, social media or advertising. Permission for promotional use is separate from booking a session and is not a condition of receiving the service. Please contact us if you have questions about an image or wish to withdraw permission for future promotional use. We will discuss what can be removed or stopped, recognising that already distributed materials or third-party copies may not be recoverable.
7. Storage, security and retention
We take reasonable steps to protect information against loss, misuse and unauthorised access or disclosure, and restrict access to people who need it for their work. No internet or storage system is completely secure.
Some providers may store or process information outside New Zealand. Where applicable, we take reasonable steps to meet the Privacy Act requirements for overseas disclosures. A provider that holds or processes information solely on our behalf does not remove our responsibility for that information.
We retain information only for as long as reasonably necessary for the purposes described here or as required by law. Booking and transaction records may need to be retained for accounting, tax, refunds or disputes. Photographs are retained as needed to deliver and administer the photography service; we do not promise indefinite archiving or re-download availability. When information is no longer needed, we take reasonable steps to delete it securely or anonymise it.
8. Website technology and external links
Our website, booking service and payment providers may use cookies or similar technology needed for functionality, security and fraud prevention. Browser settings can restrict cookies, although this may affect booking or payment features.
We do not sell browsing information or use it to build advertising profiles for other businesses. If we introduce optional analytics or advertising tools, we will update the relevant notices and obtain consent where required.
Links to Facebook, Stripe or other websites take you to services with their own privacy practices. Third-party resources loaded by a page, such as externally hosted fonts, may also receive technical information such as your IP address.
9. Access, correction and privacy concerns
You can ask whether we hold personal information about you, request access to it and ask us to correct it. Contact support@kiwisanta.photo with enough detail for us to locate the information. We may need to verify your identity or your authority to act for another person.
We will respond as soon as reasonably practicable and generally within 20 working days, subject to any lawful extension or exception. If we decline a request or do not make a requested correction, we will explain the applicable reasons and rights. You may also ask about deletion; we will consider your request, but may need to retain some information for lawful purposes.
Please raise privacy concerns with us first so we can try to resolve them. You can also contact the New Zealand Office of the Privacy Commissioner.
10. Changes to this policy
We may update this policy when our services or legal obligations change. The current version will be published on this page with its last-updated date. Where a material change requires further notice or consent, we will take the steps required by law.