CartStart a Design

Privacy Policy

Last updated: 30 July 2026

This privacy statement explains how R&R Gallery handles personal information when you browse our website, contact us, submit photos or artwork, create an account, or place an order.

Who we are

R&R Gallery Ltd, trading as R&R Gallery, is the agency responsible for the personal information described in this statement. Our address is 11 Para Close, Fairview Heights, Auckland 0632, New Zealand.

Our Privacy Officer can be reached at customerservice@rnrgallery.com or +64 21 023 48948.

What information we collect

If an online payment service is available, the payment provider processes your payment credentials. R&R Gallery generally receives the payment status and transaction reference, rather than your complete card number.

How we collect personal information

We collect information directly from you when you use this website, create an account, upload files, place an order, request a quote, approve a proof, or contact us by phone, email, Messenger or WhatsApp.

We may also receive limited information indirectly, including information about people shown in files you submit, delivery updates from service providers, payment confirmation from a payment provider, and website referral or order-attribution information.

Why we use your information

We use personal information to:

We do not sell personal information. We do not place customer photos or artwork in the Design Gallery, advertising or social media unless we have separate permission to do so.

Information you need to provide

You can browse the website without placing an order. Information marked as required during checkout is needed to process and fulfil an order. If you do not provide it, we may be unable to accept, prepare, deliver or support the order. Optional design notes and account information can be left blank, although this may limit the instructions available to our artists.

Information about other people

Personalised files often contain information about people other than the customer. Before submitting a photo, name or other personal information, you must have permission or another lawful basis to provide it to us and should make the person aware of this statement where appropriate. Files involving a child must be submitted by, or with the authority of, a parent or guardian.

We use submitted files to assess, design, print and fulfil the requested order. We may crop, enhance or post-process a photo to improve print quality. Tell us in your design instructions if you want to retain the original photo look.

Cookies and order attribution

The website uses essential cookies and browser storage to remember cart contents, keep checkout working and maintain a customer session. It may also record the referring website, campaign information, device type and pages viewed in the current session so we can understand how an order reached us. This information is not intended to track you across separate browsing sessions or create advertising profiles.

You can restrict cookies in your browser, but blocking essential cookies may prevent the cart or checkout from working correctly.

Who we share information with

We disclose only the information reasonably needed for the relevant service. Recipients may include:

We require service providers to handle personal information only for the service they provide and with appropriate confidentiality and security.

Overseas service providers

Some technology, communications, storage or payment providers may process information outside New Zealand. Where New Zealand law requires it, we take reasonable steps to confirm that an overseas recipient provides comparable privacy safeguards, is covered by an approved binding scheme, or we obtain your informed authorisation before disclosure.

Security

We use reasonable administrative and technical safeguards designed to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. Access to order files is limited to people who need them to prepare, produce or support the order. No internet or storage system can be guaranteed completely secure.

How long we keep information

Temporary website uploads that are not attached to an order are normally deleted after seven days. Files attached to an order may be kept while the order is active and afterwards only for as long as reasonably needed for production, customer support, reorders, dispute handling and record-keeping.

Order, invoice and tax records are generally kept for at least seven tax years where required. Other information is deleted, anonymised or securely disposed of when it is no longer reasonably required. You may request earlier deletion, subject to any legal, accounting, fraud-prevention or dispute-related reason that requires us to retain it.

Access, correction and deletion

You may ask whether we hold personal information about you and request access to or correction of that information. You may also request deletion where we do not need to retain it. Contact our Privacy Officer using the details above. We may need to verify your identity and may refuse or limit a request only where the Privacy Act 2020 permits us to do so.

Privacy breaches and complaints

If a privacy breach is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as required by the Privacy Act 2020.

If you have a privacy concern, please contact us first so we can investigate and respond. You may also make a complaint to the Office of the Privacy Commissioner.

Changes to this statement

We may update this statement when our services, providers or legal obligations change. The current version and its update date will remain available on this page.