Skip to content

Privacy

How we handle your information.

We work with things that matter to you: photographs, letters, voices, stories. The care we take with that material extends to the information you share when you contact us or commission a project.

Last updated: to be confirmed at launch.

1. Who we are

This website is operated by Bricolage Studios (“Bricolage”, “we”, “our”, “us”), a creative heritage studio based in New Zealand.

  • Email: hello@bricolage-studio.com
  • Postal address: Auckland, New Zealand (full address available on request)
  • Privacy enquiries: hello@bricolage-studio.com

We are the “agency” for the purposes of the New Zealand Privacy Act 2020.

2. What we collect

We only collect personal information that is necessary for us to do our work. That falls into three categories:

(a) Information you give us when you contact us. When you use our contact form, book a consultation, or email us, we collect your name, email address, and whatever you choose to include in your message. If you provide a phone number, we collect that too.

(b) Information you share during a commissioned project. If you engage Bricolage to produce a project, we may receive photographs, letters, audio and video recordings, documents, and other personal or family materials. We may also record interviews, collect biographical information, and handle correspondence about third parties mentioned in your story. This material is governed by the written engagement agreement between us, not by this public privacy policy.

(c) Technical information from our website. When you visit this site, basic technical information is collected automatically: the pages you view, rough geographic region, device type, and referring source. This is handled via Cloudflare Web Analytics, which is privacy-first and does not use cookies or fingerprinting to identify individual visitors.

We do not use advertising trackers, third-party ad pixels, or retargeting tools.

3. Why we collect it

We collect and use personal information only for the purposes it was given to us:

  • To respond to enquiries and set up consultations.
  • To scope, produce, and deliver commissioned projects.
  • To maintain our business records (invoicing, legal, tax).
  • To improve the performance and content of this website.

We do not sell personal information. We do not share it with third parties for their own marketing purposes. Ever.

4. How we store and protect it

Enquiry data received through the contact form is delivered by email via Resend (our transactional email provider) and arrives in our business inbox, which is routed through Cloudflare Email Routing. We may migrate to a managed email provider (such as Google Workspace) in the future; this policy will be updated if that happens.

Project materials (photographs, recordings, documents) are held on encrypted drives with access limited to the named Bricolage team members working on that engagement. We use reputable cloud providers for backup and delivery, and the terms of those providers bind them to appropriate confidentiality and security standards.

We take reasonable steps to protect personal information against loss, misuse, unauthorised access, alteration, or disclosure. No system is perfectly secure, but where we host sensitive client materials we use encryption at rest and in transit, access controls, and regular backup verification.

5. How long we keep it

  • General enquiry emails:we retain these for up to 24 months from last contact, then delete them unless there’s an active or likely engagement.
  • Client project files: handled under the terms of the individual engagement agreement. Unless you instruct otherwise, our default is to return originals on final delivery and to destroy our working digital copies 12 months after project sign-off.
  • Business records (invoices, signed agreements): retained for 7 years to comply with New Zealand tax and business law.
  • Website analytics:Cloudflare Web Analytics retains aggregated data at Cloudflare’s discretion. We do not hold individually-identifiable visitor data.

6. Who we share it with

We share personal information only in the following limited circumstances:

  • Service providers who help us run the business: for example, our email provider (Resend), our hosting provider (Cloudflare), our analytics provider (Cloudflare Web Analytics), and our accountant. These parties only access what they need, and only for the purpose we hired them for.
  • Specialist collaborators on your project (a specific editor, archivist, bookbinder, printer, or audio engineer), where that collaboration is necessary to deliver the work. Where a collaborator will see sensitive material, they sign a confidentiality agreement before receiving it.
  • Regulators or law enforcement, if we are legally required to disclose information (for example, by court order).
  • With your express consent, in any other case. For instance, if you agree to let us feature an excerpt of your project in our portfolio.

7. Your rights under the Privacy Act

Under the New Zealand Privacy Act 2020, you have the right to:

  • Request access to the personal information we hold about you.
  • Request correction of personal information that is inaccurate, incomplete, or out of date.
  • Withdraw consent for any use of your information that is based on consent (for example, removal from our portfolio).
  • Complain to us directly and, if you are not satisfied, to the Office of the Privacy Commissioner (privacy.org.nz).

To exercise any of these rights, please email us at hello@bricolage-studio.com. We will respond within 20 working days as required by the Act.

8. Children

Our website and services are intended for adults. We do not knowingly collect personal information from anyone under 16 through our website. Commissioned projects may include material about minors (family photographs, interviews with children, etc.), in which case we rely on the commissioning adult to have the appropriate authority to share that material, as set out in our engagement agreement.

9. Overseas disclosure

Some of our service providers (Cloudflare, Resend, Google) are based outside New Zealand, which may mean your personal information is stored on servers overseas. We only work with providers that are subject to privacy regimes comparable to or stronger than New Zealand’s, or that are bound by equivalent contractual protections.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll update the “Last updated” date at the top of this page and, where appropriate, give direct notice to active clients. We will not apply changes retrospectively to material we have already received under an earlier policy.

11. How to contact us

For any question about this policy or how we handle your information:

We aim to respond to privacy enquiries within 5 working days.