LEGAL
Privacy Policy
Last updated: 15 October 2026 · Applies to sirius.kiwi and all work by Sirius Digital
1. Who we are
Sirius Digital (“Sirius Digital”, “we”, “us”) is a web design, graphic design and photography studio based in Christchurch, New Zealand.
| Trading name | Sirius Digital |
|---|---|
| Operated by | Jake Stamper, Christchurch, New Zealand |
| Privacy contact | Jake Stamper |
| [email protected] | |
| Telephone | 027 430 1191 |
We are an agency under the New Zealand Privacy Act 2020. Where we handle personal information about people in the United Kingdom, we act as a controller or processor under UK GDPR and the Data Protection Act 2018, depending on the circumstances described in section 6.
2. Scope
This policy covers personal information we collect through:
- the sirius.kiwi website;
- enquiries made by phone, email or our contact form;
- the services we provide: web design and development, hosting and email, graphic design and print, and photography;
- websites, email and systems we build, host or manage for clients.
It does not cover third-party websites we link to, or the privacy practices of our clients.
3. What we collect
3.1 Website visitors
When you visit sirius.kiwi, our hosting provider and content delivery network automatically record technical information, including your IP address, approximate location derived from it, browser and device type, the page that referred you, the pages you view and timestamps. This is standard server logging, used for security, fraud prevention and diagnostics.
We also measure how the site is used with Google Analytics 4. What is set, by whom and for how long is explained in our Cookie Policy.
3.2 Enquiries
When you contact us we collect what you give us: your name, business name, email address, phone number and the details of your project, such as what you need, your timeframe and budget. We use this to reply and to work out whether we are the right studio for the job.
3.3 Clients
During a project or ongoing service we collect and hold:
- contact details for the people we work with;
- the content you supply for your website or print work, such as copy, images, logos, product information and brand guidelines;
- access details for accounts we need to work on, such as your domain, hosting, website or Microsoft 365 administration, held under the process described in section 9;
- correspondence, proposals, briefs, proofs and project records;
- billing information, invoices and payment records.
We do not collect, process or store payment card details. Clients pay by direct bank transfer, or by card through an online invoice, in which case the card details are handled by the invoicing provider's payment processor and never reach us.
3.4 Photography
Product and commercial shoots sometimes include identifiable people, such as your staff, models or members of the public at a location. We photograph people only as part of a brief agreed with the client, we obtain a model release from any model we engage, and we store original files securely. How the images may be used is set out in our Terms of Service.
3.5 Personal information on websites we build or host
The websites we build and host often collect personal information from their own visitors, for example contact form submissions, customer accounts and online orders. That information belongs to and is controlled by our client, not by Sirius Digital. Section 6 explains how that relationship works.
3.6 What we do not collect
We do not seek or knowingly collect sensitive information such as health, ethnicity, religious belief, political opinion or biometric data. We do not run behavioural advertising, and we do not sell personal information to anyone, in any circumstance.
4. Why we use it, and our lawful basis
| Purpose | New Zealand: Privacy Act 2020 | United Kingdom: UK GDPR lawful basis |
|---|---|---|
| Responding to enquiries | Collected for a lawful purpose connected with our work (IPP 1) | Legitimate interests, or steps before entering a contract |
| Delivering the services you have engaged us for | As above | Performance of a contract |
| Managing accounts and invoicing | As above | Contract and legal obligation |
| Securing our systems and website | As above | Legitimate interests |
| Meeting record-keeping and tax obligations | As above | Legal obligation |
| Analytics and improving the website | As above | Consent, where required |
| Occasional service updates to existing clients | As above; opt-out provided | Legitimate interests; opt-out provided |
We do not use personal information for automated decision-making that has legal or similarly significant effects.
5. Who we share it with
We share personal information only where it is needed, and only with these kinds of recipient:
- Hosting and infrastructure: Hosting.com for website and email hosting, and Cloudflare for DNS, content delivery and security filtering.
- Analytics: Google, for website analytics.
- Software providers: Microsoft, where we set up or manage Microsoft 365 for a client, and domain registrars, who are required to hold registrant details for each domain.
- Print and production suppliers: printers and sign makers, who receive the artwork and delivery details needed to complete a print job.
- Creative collaborators: specialist developers, designers or photography assistants engaged on a specific project, who receive only what they need for their part of the work and are bound to confidentiality.
- Accounting and professional advisers: our accounting and invoicing provider, our accountant, and legal advisers where required.
- Regulators, law enforcement or courts: where we are legally required to disclose information, or disclosure is permitted under the Privacy Act 2020 or UK GDPR.
We do not share client information with marketing partners or advertising networks.
6. Client websites and our role
Personal information collected through a website we build or host, such as enquiry form messages, newsletter sign-ups, customer accounts and orders, is our client's to control. The client decides why it is collected and how long it is kept. In UK GDPR terms the client is the controller and Sirius Digital is a processor. Under the Privacy Act 2020 we hold that information as an agent of the client.
In practice this means:
- We access a client's website data only to build, maintain, fix or support the site, at the client's request or under an agreed care plan.
- We do not use client website data for our own purposes, and we do not contact our clients' customers.
- Backups of hosted websites are kept only for the period set out in section 8.
- Administrator access and credentials belong to the client. We hand them over on request and at the end of an engagement, and we do not hold access back as a commercial lever.
- When a hosting agreement ends we provide an export of the website and its data, then delete our copies within 30 days.
We can advise clients on what their own website privacy policy needs to cover. That advice is practical guidance, not legal advice, and each client remains responsible for their own compliance.
7. Where your information is held
Sirius Digital is based in New Zealand and works with clients in New Zealand, the United Kingdom and elsewhere. Some of our service providers store data outside New Zealand.
| Function | Provider | Location |
|---|---|---|
| Website hosting | Hosting.com | Sydney, Australia |
| Content delivery, DNS and security | Cloudflare | Global edge network |
| Hosting.com (cPanel mail) | Sydney, Australia | |
| Analytics | Various | |
| Project files and photography originals | Sirius Digital, with encrypted offsite backup | New Zealand |
| Accounting and invoicing | Our accounting provider | New Zealand and Australia |
Where personal information is sent to a provider outside New Zealand, we take reasonable steps to make sure it will be protected by comparable safeguards, as required by information privacy principle 12 of the Privacy Act 2020. For transfers involving UK personal data we rely on adequacy or standard contractual clauses as applicable.
8. How long we keep it
| Category | Retention |
|---|---|
| Enquiries that do not go ahead | 24 months, then deleted |
| Client records and correspondence | For the length of the engagement and 7 years afterwards, to meet New Zealand tax and record-keeping requirements |
| Website source files and design artwork | For as long as we work together, and 3 years afterwards so we can supply files on request |
| Delivered photographs | At least 3 years after delivery |
| Raw files and images not selected for delivery | 12 months after delivery, then they may be deleted |
| Backups of hosted websites | Rolling 30 days |
| Financial records | 7 years, as required by the Tax Administration Act 1994 |
| Website server logs | 30 days |
| Analytics data | 14 months. See the Cookie Policy |
When a retention period ends, the information is securely deleted or de-identified.
9. How we protect it
- multi-factor authentication on every business system that supports it;
- encrypted connections for all web traffic, and encrypted storage for business data and backups;
- passwords and client access details kept in a dedicated password manager, never in plain text, spreadsheets or email;
- access limited to what each task needs;
- up-to-date software and security patches on the websites we host and the devices we use;
- large files and photographs delivered through secure, expiring download links;
- confidentiality obligations on everyone we work with.
No system is perfectly secure, and we do not claim otherwise. What we commit to is responding properly if something goes wrong.
10. Privacy breaches
If a privacy breach happens that we believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as required under Part 6 of the Privacy Act 2020. Where UK personal data is involved, we will notify the Information Commissioner's Office within 72 hours where the threshold under UK GDPR is met.
If a breach affects a client's website or data, we will tell the client without delay so they can meet their own obligations.
11. Your rights
In New Zealand
Under information privacy principles 6 and 7 of the Privacy Act 2020 you can ask what personal information we hold about you, ask for access to it, and ask us to correct it if it is wrong. We will respond within 20 working days.
If you are not satisfied with how we have handled your information or your request, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.
In the United Kingdom
Under UK GDPR you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. We will respond within one month.
If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.
Making a request
Email [email protected]. We may need to confirm your identity before releasing information. There is no charge for a reasonable request.
12. Children
Our services are for businesses and adults. We do not knowingly collect personal information directly from children through this website.
Where we photograph or build websites for schools and other education clients, images and information about students are controlled by the school. We work with the school on consent, image use and access before any student is photographed or published.
13. Cookies
See our Cookie Policy.
14. Changes to this policy
We may update this policy as our services, systems or legal obligations change. The current version is always at sirius.kiwi/privacy-policy/ with the last-updated date at the top. If a change materially affects how we handle information about existing clients, we will tell them directly rather than relying on this page.
15. Contact
Questions, requests or complaints about privacy:
Jake Stamper, Sirius Digital
[email protected]
027 430 1191
Christchurch, New Zealand