The Crafty Moustache Limited

Version 1.0 effective 20/10/26

1. About this policy

1.1 This policy explains how The Crafty Moustache Limited ("TCM", "we", "us", "our") collects, uses, stores, shares and protects personal information when you ask us for a quote, place an order, visit our website, or contact us. It is written to meet our obligations under the Privacy Act 2020.

1.2 "Personal information" means information about an identifiable person. We are the agency responsible for the personal information described in this policy.

1.3 Our details are:

The Crafty Moustache Limited, NZBN 9429 0527 87751

Registered office: 24 Dixons Line, Bunnythorpe

Email: kurnzz@gmail.com

Postal address: 24 Dixons Line, Bunnythorpe

1.4 Our privacy officer is Ben Kearney, who can be contacted at thecraftymoustache.nz@gmail.com. They deal with questions, access and correction requests, and privacy complaints.

2. What we collect

We collect the following personal information, depending on how you deal with us:

Type Examples

Contact details Name, email address, phone number, business name

Billing and payment information Billing address, invoice details, payment confirmation details. We do not store full card numbers: payments are handled by our payment providers (see section 6).

Delivery details Delivery address, contact number, courier instructions

Job information Files, images and designs you send us, specifications, quotes, proofs and approvals, personalised text such as names and dates

Correspondence Emails, messages and other communications with us, including complaints

Account and order history Orders, transactions, repeat-order details, and for business customers, account application and payment history

Photographs Photos we take of completed work, which may show personalised details

3. How we collect it

We collect personal information directly from you when you fill in a form, check out online, email or message us, send us files, or open an account. We may also receive information from our online store platform, payment providers and couriers about your order, payment and delivery.

If you give us someone else's information (for example a name for engraving, or a gift recipient's address), we collect it from you and not from them. Please make sure you are entitled to give it to us (see section 10).

4. Why we collect it and how we use it

We collect and use personal information so that we can:

respond to your enquiries and prepare quotes;

check, prepare and produce your files and jobs;

complete and deliver your orders;

process payments, issue invoices and manage refunds;

communicate with you about your order, including proofs, approvals and delivery;

manage customer accounts and repeat orders;

investigate complaints, production issues and product safety problems, including contacting affected customers if a safety issue arises;

keep business and accounting records;

meet our legal and regulatory obligations;

photograph our completed work for our website, social media and marketing, in accordance with clause 5.8 of our Terms and Conditions; and

send you news and offers, but only if you have chosen to receive them (see section 5).

We will not use your personal information for a purpose that is unrelated to the above, unless you agree or the law allows it.

Marketing messages

We will only send you marketing emails or messages if you have agreed to receive them (for example by ticking a box at checkout or signing up to our mailing list). Each message will say who it is from and include a way to unsubscribe, and we will act on unsubscribe requests promptly. You can also ask us at any time to stop contacting you for marketing. This does not stop us sending messages about your order.

5. Who we share it with

We share personal information only where it is reasonably needed to provide our services or meet our obligations. This may include:

Payment providers (such as Shopify Payments, Afterpay and other providers we offer) to process payments and refunds;

Couriers and postal providers to deliver your order;

Our online store and website providers, to run our online shop and handle orders;

Accounting, invoicing and business software providers, to keep our records;

Cloud storage and email providers, to store files and correspondence;

Our professional advisers (such as accountants and lawyers) where needed; and

Government agencies, regulators or the courts where the law requires or permits it.

We do not sell your personal information to anyone. We do not use it for any purpose other than those in this policy, and we require the providers we use to handle your information appropriately.

6. Storing information overseas

Some of the providers listed in section 6 store or process personal information outside New Zealand.  Where we send personal information to a provider overseas, we do so only where we believe it is subject to privacy safeguards comparable to those in New Zealand (for example, because of the laws of that country or an agreement with the provider), or where you have been told about the position and agree.

7. Do you have to give us this information?

You do not have to give us personal information, but we usually cannot quote, produce or deliver a job without it. Contact details, a delivery address, payment information and your files are generally required to complete an order. Information such as marketing preferences and photography opt-outs is optional. If you do not give us required information, we may not be able to proceed with your job.

8. Retention. We keep personal information only for as long as we need it for the purposes in section 4 or as the law requires:

Customer-supplied files, working files and production files: generally 12 months after the job is completed, or for repeat customers up to 12 months after the most recent purchase.

Tax and accounting records: for the period required by law (currently seven years).

Job records showing what we supplied and to whom: for as long as we reasonably need them to deal with product safety issues, complaints and warranty or consumer-guarantee claims.

Correspondence about a job: as long as we keep the job record.

Marketing preferences: until you opt out or ask us to remove them.

After that, we delete or de-identify the information where it is no longer reasonably required. You may ask us to delete your files earlier. We will do so unless we are required, or have a genuine need, to keep them (for example for tax records or an unresolved complaint).

10. Security. We take reasonable steps to protect personal information against loss, unauthorised access, use, disclosure and misuse. These include password-protected accounts, access limited to those who need it, and secure cloud storage.

11. Privacy breaches. If we have a privacy breach that has caused, or is likely to cause, serious harm to affected people, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as the Privacy Act 2020 requires.

12. Information about other people

If you give us another person's personal information, you confirm that you are entitled to do so and that they would reasonably expect us to use it for your job. If we collect information about a person from you rather than from them, we will tell them how it is being used where the law requires it and it is practicable to do so. 

13. Photographs of completed work

We may photograph finished products and use the images on our website, social media and in advertising. We will not publish personal information that could identify a person (such as names, dates or messages engraved on a personalised item) unless you agree or the law permits it. You can opt out of photography at checkout, on the quote, or by telling us before production. See clause 5.8 of our Terms and Conditions.

14. Your rights: access and correction

You can ask us:

to confirm whether we hold personal information about you and to give you access to it; and

to correct personal information that you believe is wrong. If we do not agree that it needs correcting, we will, if you ask, attach a statement of your requested correction to the information.

14.1 To make a request, contact our privacy officer (section 1.4). We may ask you to prove who you are. We will respond to your request as soon as reasonably practicable, and no later than 20 working days after receiving it (the Privacy Act 2020 timeframe). We may refuse or limit access in the situations the Act permits, and if we do, we will tell you why and tell you about your right to complain.

14.2 We do not generally charge for access and correction requests. If we propose to charge for a request (which the Act allows in limited circumstances), we will tell you the amount first.

14.3 Complaints

If you have a concern about how we have handled your personal information, please contact our privacy officer first. We will acknowledge your complaint within [2] working days and respond within [10] working days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).