In short
This is a small studio. We collect only what we need to reply to you, take your order, and get it to your door. We don't run advertising trackers, we don't sell or rent your details to anyone, and we don't send marketing unless you've asked for it.
This policy explains what that means in practice. It applies to this website, craigspencerceramics.com, run by Craig Spencer, a sole trader trading as Craig Spencer Ceramics (ABN 79 175 440 300), with studios in Australia + New Zealand ("we", "us"). We handle personal information in line with the New Zealand Privacy Act 2020 and, where it applies, the Australian Privacy Act 1988.
What we collect
When you send a message
The contact form asks for your name, email address, what your message is about, and the message itself. The form is processed by Netlify (our website host) and sent to our studio inbox. We use it only to reply to you.
When you place an order
Checkout is handled by Shopify. To take and deliver an order we need your name, email address, delivery address, phone number (for the courier), and the pieces you've bought. Payment details are entered directly into Shopify's secure checkout and processed by Shopify Payments or your chosen payment provider. We never see or store your full card number.
When you browse
This site does not use analytics or advertising cookies. If you add a piece to your cart, the cart is kept in your own browser's storage so it's still there when you come back; that information stays on your device and is not sent to us until you check out. Shopify's checkout sets the cookies it needs to complete your order. Our web fonts are loaded from Google Fonts, which means your browser requests those font files from Google's servers.
What we don't collect
We don't ask for or store dates of birth, government identifiers, or anything beyond what's needed to reply and to ship. We don't knowingly collect information from anyone under 16; if you think a child has sent us their details, email us and we'll delete them.
Why we use it
To answer your enquiries, to process and deliver your orders, to send you order confirmations and shipping updates, to handle any damage or delivery issue, to keep the sales records New Zealand tax law requires, and to run and protect this website. That's the list.
If you tell us you'd like studio news, we'll add you to that list and you can leave it at any time using the link in any email.
Who we share it with
Only the people and services needed to do the things above:
Shopify, which runs our shop, checkout and payment processing. Netlify, which hosts this site and delivers contact-form messages. Our email provider, which stores our inbox. Couriers (NZ Couriers, DHL, FedEx) who receive your name, address and phone number to deliver your order. Our accountant, who sees sales records but not your contact details beyond what appears on an invoice.
Some of these services store data outside New Zealand (Shopify and Netlify use servers in several countries, including the United States and Australia). Each is bound by its own privacy commitments and by our agreement with them to use your information only to provide their service to us.
We will disclose information if the law requires it. We don't sell personal information, and we don't share it with advertisers.
How long we keep it
Order records, including your name and delivery address, are kept for seven years because New Zealand tax law requires it. Contact-form messages are kept for as long as we're in conversation with you and then for a reasonable period in case you come back to it. Cart contents live in your browser until you clear them.
Your rights
Under the Privacy Act you can ask us what personal information we hold about you, and ask us to correct it. You can also ask us to delete it, and we will unless we're required to keep it (for example, a tax record). Email shop@craigspencerceramics.com and we'll respond within 20 working days, usually much sooner.
If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Security
This site is served over HTTPS. Payments are processed by Shopify, which is certified to the PCI DSS standard for handling card data. Our inbox and Shopify admin are protected by strong passwords and two-factor authentication. No system is perfectly secure, but we take reasonable care, and if we ever became aware of a breach affecting your information we would tell you and the Privacy Commissioner as the law requires.
Changes
If we change how we handle information, we'll update this page and the date at the top. If a change is significant and you've ordered from us, we'll email you.
Questions about any of this: shop@craigspencerceramics.com, or write to Craig Spencer Ceramics, Australia + New Zealand.