Privacy Policy

Last updated: 25 October 2026

1. Who we are

James Hancox - New Zealand Fine Art Prints is a trading name of Pinya Holdings Ltd (NZBN 9429051294960), a company registered in New Zealand.

Registered address: Worcester Street, Christchurch CBD, Christchurch 8011, New Zealand
Email: james@jameshancox.nz
Phone: +64 27 204 1060
Website: jameshancox.com

Pinya Holdings Ltd is the agency that collects and holds your personal information for the purposes of the Privacy Act 2020 (New Zealand).

Privacy officer: James Hancox, james@jameshancox.nz. The Privacy Act requires us to have a privacy officer, and you can contact that person directly about anything in this policy.

This policy applies to everyone who visits our store or buys from us, wherever you live. Your rights under this policy are the same whether you are in New Zealand, Australia, the United Kingdom, the European Union, the United States or anywhere else.

2. What we collect

Information you give us

Name, email address, phone number
Billing address and shipping address
Order notes and any message you send through our contact form
Reviews, comments or photographs you choose to send us
Your marketing preferences

Information about your order

What you bought, including format, size and print finish
The amount paid, the currency, and the delivery method
Order and tracking history

Payment information

Card and payment details are handled by our payment providers. We receive confirmation that a payment succeeded, and limited details such as the last four digits of a card and the billing country. We do not receive or store your full card number.

Device and usage information

IP address and approximate location derived from it
Browser type, device type and operating system
Pages you viewed, how you reached the store, and how long you stayed
Interactions such as adding to cart or starting checkout

Cookies and similar technologies

See section 7.

2A. Do you have to give us this information?

It is your choice. We do not require you to give us any personal information, and no law makes it compulsory for you to do so.

Some of it is necessary to complete an order. If you choose not to provide your name, email address and delivery address, we cannot process your order, take payment, produce your print or deliver it. If you do not provide a phone number, the carrier may be unable to contact you about delivery. If you do not agree to necessary cookies, checkout will not work.

Marketing emails are entirely optional. Declining them does not affect your ability to order.

Where we collect information because a law requires it - for example tax records - we will tell you the specific law at the point of collection.

3. Why we collect it

What we use it for	What we use	Legal basis (NZ)	Legal basis (EU/UK)
To take payment, produce your order and deliver it	Name, addresses, email, phone, order details	Necessary to perform our contract with you (IPP2, IPP10)	Performance of a contract
To answer your questions and resolve problems	Name, email, phone, message contents, order history	Necessary to perform our contract, and our legitimate interest in helping customers	Contract, legitimate interests
To detect and prevent fraud and misuse	Device information, IP address, order and payment signals	Our legitimate interest in protecting the business and our customers	Legitimate interests
To measure and improve the store	Device and usage information, analytics cookies	Our legitimate interest in running and improving the store	Legitimate interests, or consent where required
To measure advertising and reach the right customers	Device and usage information, advertising cookies	Consent, or our legitimate interest where consent is not required	Consent
To send you marketing emails	Name, email, purchase history	Your consent, which you can withdraw at any time	Consent
To meet tax, accounting and legal obligations	Order and payment records	Legal obligation	Legal obligation

We do not use your information for automated decision-making that produces legal or similarly significant effects about you.

4. Who we share it with

We share personal information only where it is needed to run the store, and only with parties who are bound to protect it.

Shopify Inc. Our store platform. Hosts the store, processes payments, screens orders

for fraud, and provides the cookie and privacy-choices banner.

Printful Inc. Our print and fulfilment partner. Receives your name, shipping address,

email address and the details of what you ordered, because it prints and ships your order. Printful produces from facilities in the United States, Europe, the United Kingdom and Australia, so your order may be manufactured and shipped from outside New Zealand.

Payment providers. To process your payment and handle refunds and chargebacks.
Delivery carriers and customs brokers. To deliver your parcel and clear it through

customs.

Google LLC. Google Analytics 4 and Google Ads measurement tags, so we can see how the

store is used and whether our advertising works.

Professional advisers. Accountants, insurers and lawyers, where necessary.
Authorities. Where we are required by law, a court order, or a lawful request from a

public authority.

We do not sell your personal information. We do not share it with data brokers.

5. Sending information overseas

Because we use Shopify, Printful and Google, your information may be stored or processed outside New Zealand, including in the United States, Canada, the European Union and the United Kingdom.

Under the Privacy Act 2020 we may send personal information overseas only if the recipient is subject to the Privacy Act, or is subject to privacy laws with comparable safeguards, or is bound by an agreement that gives comparable protection, or you have expressly authorised the disclosure after being told your information may not have the same protection.

Printful processes order, name, delivery address and artwork-file information as our processor, and its Data Processing Terms (version 1.1, last updated 12 March 2026) incorporate the European Commission Standard Contractual Clauses, specifically Module 2 (controller to processor), together with the equivalent UK standard contractual clauses. We rely on those clauses for transfers to Printful.

Shopify hosts the store and processes order and customer data as our processor under its data processing agreement.

Google processes analytics and advertising data under its data processing terms.

Where a provider relies on the Standard Contractual Clauses, those clauses require it to apply the protections set out in them, including in relation to any onward transfer to its own sub-processors.

European Union and United Kingdom. New Zealand holds an adequacy decision from the European Commission, which means personal data can be sent to us from the EU without any further safeguard. Where we then send data onwards to a provider in a country without an adequacy decision, we rely on that provider's contractual safeguards or its certification under an approved framework.

6. How long we keep it

Order and payment records: 7 years, because New Zealand tax law requires us to keep

business records for that period.

Enquiries, quotes and contact form messages: up to 2 years, so we can pick up a

conversation where it left off.

Marketing subscriptions: until you unsubscribe, plus a short period to record that you

did.

Analytics data: up to 14 months in Google Analytics, which is the longest retention

period the property can be set to. The property is configured to that maximum.

Fraud screening records: as long as needed to defend against chargebacks and fraud.

Where we no longer need information, we delete it or make it anonymous.

7. Cookies and tracking

Cookies are small files stored on your device. We use them for four purposes.

Necessary. Keeping your cart, keeping you signed in, remembering your checkout details, and remembering your privacy choices. The store does not work without these.

Analytics. Google Analytics 4 tells us which pages are visited, how people find us, and where they leave. It uses cookies and records a shortened IP address.

Advertising measurement. Google Ads and Google Merchant Center tags tell us whether our advertising produced a sale. They may set cookies and, where you have consented, share conversion signals with Google.

Social links. The Instagram, Facebook, Pinterest and YouTube links in our footer are plain links. They do not load tracking scripts unless you click them.

Your choices. Our cookie banner, provided through Shopify, lets you accept or reject non-essential cookies when you first visit. To change your choice later, clear the site data for jameshancox.com in your browser and reload the store, and the banner will appear again. You can also email james@jameshancox.nz and ask us to record your preference.

We do not currently respond to "Do Not Track" browser signals, because there is still no agreed standard for what that signal should mean. If your browser sends a Global Privacy Control signal, ask us and we will tell you how we have treated it.

You can also block or delete cookies in your browser settings. Blocking necessary cookies will stop checkout from working.

8. Your rights

These rights apply to everyone, not only to customers in particular countries.

Access. Ask what personal information we hold about you and receive a copy.
Correction. Ask us to fix information that is wrong, out of date or incomplete.
Deletion. Ask us to delete your information. We will do so unless we are required to

keep it, for example for tax records or to defend a legal claim.

Objection and restriction. Ask us to stop using your information for a particular

purpose, including marketing and analytics.

Withdraw consent. Where we rely on consent, withdraw it at any time. Withdrawing

consent does not affect anything we did before you withdrew it.

Portability. If you are in the EU or the UK, ask for a copy of the information you gave

us in a structured, machine-readable format.

No detriment. We will not treat you differently or refuse service because you exercised

a privacy right.

Complaint. Complain to us first, and to a regulator if we do not resolve it.

To exercise any of these, email james@jameshancox.nz. We may need to verify your identity, and we will respond within 20 working days.

Regulators

New Zealand: Office of the Privacy Commissioner, privacy.org.nz, 0800 803 909
Australia: Office of the Australian Information Commissioner, oaic.gov.au
United Kingdom: Information Commissioner's Office, ico.org.uk
European Union: the supervisory authority in the country where you live

You can complain to a regulator at any time. We would appreciate the chance to fix it first.

9. Security

We protect your information with encryption in transit, access controls on our accounts, and two-factor authentication on the accounts that hold customer data. Our store and payment providers apply industry-standard security controls and are certified against recognised security standards.

No system is perfectly secure. If a breach occurs that is likely to cause serious harm, we will notify affected people and the Privacy Commissioner as the Privacy Act 2020 requires, and we will notify a regulator in the EU or UK where GDPR requires it.

10. Children

Our store is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.

If you are under 16, please do not use the store or send us any information.

11. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change materially affects how we use your information, we will tell you by email if you have an account or a marketing subscription, or with a notice on the store.

12. Contact

Questions, requests and complaints: james@jameshancox.nz

James Hancox - New Zealand Fine Art Prints A trading name of Pinya Holdings Ltd (NZBN 9429051294960) Worcester Street, Christchurch CBD, Christchurch 8011, New Zealand