Legal

Privacy Policy

Last updated: 25 July 2026. Bound By Moments Limited.

Bound By Moments Limited ("we", "us", "our") recognises the importance of protecting your privacy. This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal information about individuals who interact with us, including visitors to our website (boundbymoments.co.nz) and purchasers of our goods and services. Personal information means information about an identifiable individual.

We collect two kinds of personal information:

Account and marketing information is information about our customers that we obtain when they use our website, purchase products from us, or contact us in relation to our goods and services.

Customer materials are the materials you provide to us in connection with our goods and services, such as photographs that we turn into colouring books. For how we collect, use, disclose, store and otherwise process personal information in customer materials, see our Terms of Trade.

We may request your consent to use customer materials in our marketing materials, for example posting a before-and-after image to our social media feeds. We will not use your customer materials in our marketing materials without your express permission.

We may also use customer materials to detect and prevent abuse, and to test our abuse detection mechanisms and thresholds.

The remainder of this Privacy Policy applies only to our processing of account and marketing information, and does not apply to customer materials.

We comply with the Privacy Act 2020 (New Zealand) and, where applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the equivalent United Kingdom law ("UK GDPR"), and any other applicable privacy or data protection law, when handling personal information. This Privacy Policy sets out how individuals may exercise their rights under these laws.

We may change this Privacy Policy from time to time, and the current version will always be published at boundbymoments.co.nz/privacy. Changes apply from the date they are posted. We encourage you to review this Privacy Policy regularly.

What personal information we collect

We may collect the following types of personal information as required for the operation of our business:

1. (a) Names.
2. (b) Contact details, including your email address, phone number, and residential or postal address.
3. (c) Payment information, including credit or debit card details and transaction records.
4. (d) Delivery and billing address information.
5. (e) Information provided when making an enquiry, support request, or any other communication with us.
6. (f) IP address, device and browser information, website usage data (including pages visited and links clicked), and information collected via cookies and similar tracking technologies.
7. (g) Any other information you voluntarily submit through our website or other interactions with us.

We do not knowingly collect personal information from children under 18 years of age without parental consent. If you believe a child under 18 has provided personal information to us, please contact us immediately at the details below.

How we collect your personal information

We may collect personal information:

1. (a) Directly from you, for example when you register an account, complete an online form, submit an order, or communicate with us by email, telephone, or other means.
2. (b) Automatically, through your use of our website (including cookies, analytics, and other tracking technologies — see "Cookies and tracking technologies" below).
3. (c) From third-party service providers that assist us in processing orders, payments, fulfilment, and customer support.
4. (d) From publicly available sources or lawful third-party sources, where necessary and permitted by law.

If you do not provide us with the personal information we request, we may be unable to provide you with the requested goods or services.

Purposes for collecting, using and disclosing your personal information

We collect, use, hold and, where necessary, disclose your personal information for the following purposes (and any other purpose permitted or required by law):

1. (a) To supply you with our goods and services.
2. (b) To process and manage orders, including payment processing, printing and shipment.
3. (c) To verify your identity and administer your account.
4. (d) To communicate with you regarding your order, account, feedback, support requests, or other enquiries.
5. (e) To personalise, improve, and develop our website, goods and services, including by analysing usage and user experience.
6. (f) To detect, investigate, and prevent fraud, unauthorised access, security breaches, and other prohibited or illegal activities.
7. (g) To comply with our legal obligations and regulatory requirements in New Zealand and, where applicable, overseas.
8. (h) To conduct marketing, promotional or advertising activities relating to our goods and services.
9. (i) For internal administrative, compliance, operational, audit and record-keeping purposes.
10. (j) For any other purpose, with your consent or as notified to you at the time of collection.

Who we may disclose your personal information to

To the extent necessary for the purposes stated above and in accordance with the Privacy Act and, where applicable, the GDPR and UK GDPR, and other applicable privacy and data protection laws, we may disclose your personal information to the following categories of recipients:

1. (a) Payment processors (Stripe, a company based in the United States, operating globally) to facilitate payments for your orders.
2. (b) Print production partners and delivery service providers (Peninsula Design for orders in New Zealand, or such other printing service provider we may engage from time to time) to fulfil and deliver your custom product.
3. (c) Cloud storage or website hosting providers (Supabase, located in Australia; Cloudflare and Expo/EAS, both located in the United States).
4. (d) IT service providers and other support vendors who assist us in operating our business (including OpenAI, Sentry, Google Places and Resend, all based in the United States, operating globally).
5. (e) Marketing, analytics, or promotional service providers, but only where you have consented or where permitted by law.
6. (f) Our professional advisers, including accountants, auditors and legal advisers (subject to confidentiality obligations).
7. (g) Our affiliates or related companies, and any actual or potential acquirer or successor in the event of a merger, sale, or transfer of any part of our business or assets (subject to confidentiality obligations).
8. (h) Government agencies, regulatory authorities, law enforcement bodies, or dispute resolution providers, where required by applicable law, regulation, court order or similar legal process.
9. (i) Any other third party where you have authorised or where permitted or required by law.

Overseas disclosure of personal information

As part of our operations, personal information, including contact and payment details, may be transferred to, stored in, or processed by suppliers, partners, or service providers located in countries outside New Zealand, including but not limited to Australia and the United States.

Some of these countries may not have privacy laws that provide comparable safeguards to New Zealand. Where required by law (including under Information Privacy Principle 12), we will obtain your express authorisation before disclosing personal information to recipients in countries that do not have comparable privacy safeguards, in the absence of other approved contractual or legal protections.

Personal information transferred overseas may be accessible to courts, law enforcement and/or national security authorities in accordance with the laws of those jurisdictions. If you are located in the European Union or United Kingdom, see "GDPR / UK GDPR compliance" below for further provisions on international transfers.

Cookies and tracking technologies

Our website uses cookies, pixels, web beacons, and similar tracking technologies to provide website functionality, enhance your experience, and analyse usage and traffic data. Cookies may also be used for marketing and promotional purposes subject to your consent as required by law. You may decline cookies via your browser settings, but this may affect the website's functionality.

For further information about our use of cookies, or to adjust your cookie preferences, contact us at [email protected].

Data storage and security

We are committed to safeguarding your personal information. We implement appropriate technical and organisational measures to protect it against loss, unauthorised access, disclosure, alteration or destruction, including: encryption of data in transit and at rest; secure access controls and password policies; use of SSL/TLS for online transactions; and limiting access to personal information to authorised personnel only.

Personal information may be stored on servers located outside New Zealand (including Australia and the United States). If you require further information on specific storage locations, please contact us.

Data retention and destruction

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected (including any legal, accounting, or reporting obligations), or as otherwise required or permitted by law. Unless a longer period is required or permitted by law, we typically retain personal information for 90 days from the date of delivery of your order or your last interaction with us, unless we are required to retain it for legal or safety reasons.

After this period, personal information is securely destroyed or de-identified in accordance with our data destruction policies.

Your rights

You have the following rights with respect to your personal information, subject to the conditions and limitations set out in applicable law:

1. (a) To request access to your personal information held by us.
2. (b) To request correction of your personal information if you believe it is inaccurate, incomplete, or out of date.
3. (c) To request erasure of your personal information (the "right to be forgotten"), in certain circumstances.
4. (d) To request that we restrict how we process your personal information, or to object to certain uses.
5. (e) To obtain a copy of your personal information in a portable, machine-readable format, where applicable.
6. (f) To withdraw your consent where processing is based on consent.

You may exercise these rights by contacting us using the details below. We may require you to verify your identity before processing your request. We will respond within 20 working days or as otherwise required by law.

There may be circumstances where we are permitted or required by law to refuse your request, in which case we will provide you with the reasons for the refusal and information on how you can lodge a complaint.

Opting in and opting out

Where you have provided consent for us to use your personal information for marketing or other non-essential purposes, you may withdraw this consent or opt out of future communications at any time by following the unsubscribe instructions in the communication, or by contacting us at [email protected]. Withdrawing your consent does not affect any processing carried out before the withdrawal.

GDPR / UK GDPR compliance

If you are located in the European Union or United Kingdom, the following additional terms apply to the processing of your personal information.

Lawful basis for processing

We collect and process your personal information only where we have a lawful basis, including:

1. (a) The performance of a contract with you (for fulfilment of your order and provision of our services).
2. (b) Compliance with a legal obligation to which we are subject.
3. (c) Our legitimate interests, such as managing and improving our services, provided that such interests are not overridden by your rights and interests.
4. (d) Your consent, where required (e.g. for certain direct marketing activities or non-essential cookies and tracking).

Further details on the legal bases relied upon in any given context are available on request.

Additional GDPR / UK GDPR rights

In addition to rights available under New Zealand law, you may:

1. (a) Object to processing of your personal information at any time on grounds relating to your particular situation.
2. (b) Request that we do not carry out automated decision-making (including profiling) that produces legal effects or otherwise significantly affects you, unless required by law or necessary for performance of a contract.

International transfers

Where your personal information is transferred from the EU or UK to countries outside the European Economic Area or United Kingdom, we will ensure appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, or your explicit consent, in accordance with GDPR and UK GDPR requirements. Please contact us for further information or a copy of the relevant safeguards.

Complaints under GDPR / UK GDPR

If you are located in the EU or UK, you may lodge a complaint with the data protection authority in your country of residence or work, the place of the alleged infringement, or with the Office of the New Zealand Privacy Commissioner.

Third party sites and links

Our website may contain links to third-party sites and services. We are not responsible for the content or privacy practices of such third parties. We encourage you to review the privacy policies of any third party before providing personal information to them.

Changes to this policy

We may revise this Privacy Policy from time to time in response to changes in our practices, technology, or legal obligations. If we make significant changes, we will take reasonable steps to notify you (such as by posting a notice on our website or sending an email notice). The date of the most recent revision is shown at the top of this Policy. Your continued use of our website or services indicates your acceptance of the current Privacy Policy.

Complaints and disputes

If you have any questions about this Privacy Policy, your personal information, or wish to make a complaint or exercise your rights, please contact our Privacy Officer using the details below. We will acknowledge and respond to your query or complaint within 20 working days or as otherwise required by law.

If you are not satisfied with our response, you may refer your complaint to the Office of the New Zealand Privacy Commissioner (privacy.org.nz, +64 4 474 7590 or +64 9 302 8680, [email protected], PO Box 10094, Wellington 6143, New Zealand). If you are located in the European Union or United Kingdom, contact details for your local data protection authority can be provided on request.

Business transitions

If Bound By Moments Limited undergoes a business transition such as a merger, acquisition, restructuring, or sale of all or part of its assets, personal information may be among the assets transferred. In such circumstances, your personal information remains subject to the obligations in this Privacy Policy unless otherwise notified.

Definitions

1. Personal information has the meaning given in the Privacy Act 2020 (NZ): information about an identifiable individual.
2. Goods and services the products and/or services provided by Bound By Moments, including but not limited to the transformation of customer photos into custom printed colouring books.