Privacy Policy
Last updated: 23 September 2026
Rachel Mataira ("we", "us", "our") sells fine art photographic prints from rachelmataira.com. This policy explains what personal information we collect, why we collect it, how long we keep it, who we share it with, and what rights you have over it.
We are the data controller for the information described here.
Contact
Rachel Mataira
25 Douglas Street, Ponsonby, Auckland 1011, New Zealand
hello@rachelmataira.com
We are based in New Zealand and comply with the Privacy Act 2020. Because we deliver to customers overseas, this policy also sets out the additional rights available to customers in the European Union and the United Kingdom under the GDPR and UK GDPR.
1. Information We Collect
Information you give us
- Your name, email address, billing and delivery address, and phone number;
- Anything you write to us by email, contact form or social media message.
Information created when you order
- Order and payment records, edition and framing choices, and delivery tracking;
- Payment information is entered directly into our payment providers' systems. We never see or store your full card number.
Information collected automatically
- IP address, approximate location derived from it, device and browser type, pages viewed, and the site you arrived from.
We do not collect special category information such as health, religious beliefs or biometric data, and we ask that you do not send it to us.
2. Why We Use It, and Our Legal Basis
For customers in the European Union and the United Kingdom, the GDPR requires us to identify a lawful basis for each purpose. They are set out below.
| Purpose | Legal basis |
|---|---|
| Taking, printing, framing and delivering your order | Performance of a contract (Article 6(1)(b)) |
| Answering enquiries and providing customer service | Performance of a contract, or our legitimate interest in responding to you (Articles 6(1)(b) and 6(1)(f)) |
| Sending marketing emails and newsletters | Your consent (Article 6(1)(a)) |
| Keeping tax and accounting records | Legal obligation (Article 6(1)(c)) |
| Preventing fraud and keeping the site secure | Our legitimate interest in protecting the business and our customers (Article 6(1)(f)) |
| Understanding how the site is used so we can improve it | Your consent, given through our cookie banner (Article 6(1)(a)) |
| Establishing or defending a legal claim | Our legitimate interest in protecting our legal position (Article 6(1)(f)) |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded that it is not. You can ask us for that assessment, and you can object to the processing at any time.
Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it.
3. Cookies and Analytics
Strictly necessary cookies, the ones that keep your cart working, sign you in and secure checkout, are set automatically, because the shop cannot function without them.
Everything else is set only after you agree. We use Google Analytics to understand how visitors use the site, which sets cookies in your browser. If you are visiting from the European Union, the United Kingdom or another region where consent is required, you will see a banner on your first visit. You can accept all, reject all, or choose. Rejecting is as easy as accepting.
You can change your choice at any time through the cookie preferences link in our footer, or by clearing cookies in your browser.
We do not use advertising or retargeting pixels.
4. Who We Share It With
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We share it with the suppliers who help us run the business:
| Recipient | What they do | Where |
|---|---|---|
| Shopify | Hosts the store, processes orders, and provides Shopify Payments and Shopify Email | Canada, United States, European Union |
| PayPal | Payment processing where you choose it | United States, European Union |
| Afterpay | Instalment payments, New Zealand customers only | Australia, New Zealand |
| Print lab and framers | Produce and frame your artwork, for orders shipping within New Zealand | New Zealand |
| International print fulfillment partner | Produces, frames and ships your artwork, for orders shipping outside New Zealand | United States |
| Courier and postal services | Deliver your order; chosen per order for the best rate to your address | New Zealand and your destination country |
| Google Analytics | Measures site usage, only where you have consented | United States |
We also disclose information where the law requires it, or to establish or defend a legal claim. Each of these suppliers is bound by contract to use your information only on our instructions and to keep it secure.
5. Sending Information Overseas
We operate from New Zealand, so if you order from outside New Zealand your information will be sent here.
If you are in the European Union or the United Kingdom: the European Commission has decided that New Zealand provides an adequate level of data protection (Commission Decision 2013/65/EU, confirmed on review in January 2024), and the United Kingdom recognises New Zealand on the same basis. Your information can therefore be transferred to us without further safeguards.
Some of our suppliers process information in the United States and elsewhere, including our international print fulfillment partner, which produces and ships orders outside New Zealand and receives your name and delivery address for that purpose. Where a supplier processes information outside New Zealand, the transfer is covered by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the supplier's certification under the EU–US Data Privacy Framework. You can ask us which applies to a particular supplier.
If you are in New Zealand: we comply with Information Privacy Principle 12 of the Privacy Act 2020, which permits disclosure overseas only where the recipient is subject to comparable safeguards.
6. How Long We Keep It
| Information | Kept for | Why |
|---|---|---|
| Order, invoice and payment records | 7 years from the end of the tax year of the sale | Required by section 22 of the Tax Administration Act 1994 |
| Customer account details | While your account is open, then 24 months | So you can reorder and see your edition history |
| Marketing list entry | Until you unsubscribe, then a suppression record indefinitely | To make sure we do not email you again |
| Customer service correspondence | 24 months from the last message | To resolve follow-up questions about an edition |
| Analytics data | 14 months | Sufficient for year-on-year comparison |
| Certificates of authenticity and edition numbering records | Indefinitely | The provenance of a limited edition must outlive the sale |
When a period ends we delete the information, or anonymise it so that it can no longer identify you.
7. Your Rights
Everyone may ask us to:
- Give you a copy of the personal information we hold about you;
- Correct anything that is wrong or out of date;
- Stop sending you marketing, at any time, either by clicking unsubscribe or by emailing us.
If you are in the European Union or the United Kingdom, you additionally have the right to:
- Erasure: ask us to delete your information where we no longer need it for the purpose we collected it (Article 17);
- Restriction: ask us to stop using your information while a dispute about it is resolved (Article 18);
- Portability: receive the information you gave us in a machine-readable format, or have us send it to another provider (Article 20);
- Objection: object to processing we base on legitimate interests (Article 21). If you object to direct marketing we will stop immediately and without question;
- Withdrawal of consent: at any time, for anything we do on the basis of consent (Article 7(3)).
Some rights have limits. We cannot delete an invoice we are legally required to keep, though we can restrict it to that purpose alone.
How to exercise them. Email hello@rachelmataira.com. We may ask you to confirm your identity, usually by replying from the email address on your order. We will respond within one month, as required by Article 12(3) of the GDPR. If a request is particularly complex we may extend this by up to two further months, and will tell you within the first month if we do. There is no charge unless a request is manifestly unfounded or excessive.
For customers in New Zealand, section 44 of the Privacy Act 2020 gives us up to 20 working days to respond, and we aim to be faster than that.
8. Security and Data Breaches
Your information is held on secure servers operated by Shopify and our other suppliers, protected by encryption in transit, access controls, and multi-factor authentication on our own accounts. No system is perfectly secure, and we cannot guarantee the security of information sent to us over the internet.
If a breach occurs that is likely to cause harm, we will notify you and the relevant regulator, within 72 hours where the GDPR applies (Article 33), and as soon as practicable under Part 6 of the Privacy Act 2020.
9. Automated Decision-Making
We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal or similarly significant effects.
10. Children
We do not sell to, or knowingly collect information from, anyone under 16. If we learn that we hold information about a child, we delete it.
11. Complaints
Please raise it with us first at hello@rachelmataira.com. Most things are quickly resolved.
If you are not satisfied, you may complain to:
- New Zealand: Office of the Privacy Commissioner, www.privacy.org.nz
- European Union: the supervisory authority in the member state where you live, where you work, or where you believe the problem occurred. The list is at edpb.europa.eu
- United Kingdom: Information Commissioner's Office, ico.org.uk
Going to a regulator does not affect any other legal remedy available to you.
12. Changes to This Policy
We may update this policy from time to time. The current version is always on this page, with the date it took effect shown at the top. If we make a change that materially affects your rights, we will tell subscribers by email.