Privacy
You send us photographs, which is a more personal thing than most orders involve. This page says exactly what happens to them, what else we hold, who else can see any of it, and how to have it deleted. We do not sell your information to anyone, ever.
The short version
| What we hold | Why, and for how long |
|---|---|
| Your photographs | To build your model. Stored in Cloudflare, kept 12 months, deleted sooner on request. |
| Name, email, delivery address | To make and send your order and to answer you. Kept 7 years as tax records require. |
| Payment details | Handled entirely by Shopify’s checkout. We never see your card number. |
| Order notes and correspondence | To do the job and to sort out anything that goes wrong. |
| Basic website usage | Pages visited and device type, so the site keeps working. See “Cookies and tracking” below. |
Who is responsible for it
ModelWorks Railway, trading as ModelWorks Railway Limited, of Christchurch Central, Christchurch 8011, is the agency responsible for the personal information described here, under the New Zealand Privacy Act 2020.
For anything on this page — a copy of what we hold, a correction, a deletion, or a complaint — email lmc263@uclive.ac.nz.
Your photographs
A photograph of a person is personal information about that person, so we treat uploads carefully.
- Where they go. Straight from your browser into our storage bucket at Cloudflare. They are not posted to social media, not attached to a public order, and not shared with any other customer.
- What we use them for. One thing: building the model you ordered. We do not use them to train machine-learning models and we do not license them to anyone.
- Who can see them. The person modelling your commission, and the storage provider holding the file. The link to a photograph is attached to your order in our shop admin so we can match it to the job.
- Public use is opt-in. Nothing you send appears on this site or in our advertising unless you tell us in writing that we may — and you can change your mind later.
- How long we keep them. 12 months after your order, so we can reprint or fix a model. Ask us at any time and we delete them sooner.
What else we collect, and why
We collect what an order actually needs: your name, email address, delivery address, the scale and count you chose, any notes you write for the workshop, and the record of what you paid.
We collect it to make and deliver your order, to answer your questions, to meet our tax and consumer law obligations, and — if you have opted in — to send you occasional news about the workshop. Every marketing email has an unsubscribe link that works.
Giving us this information is voluntary, but without it we cannot make or send you anything.
Payments
Checkout and payment are handled by Shopify. Your card details go directly to them and their payment processors — we never see, hold or store a card number, and neither does this website.
Shopify holds your order and customer record on our behalf. Their privacy policy is at shopify.com/legal/privacy.
Information held overseas
Shopify, Cloudflare and Vercel store data on servers outside New Zealand, including in Australia, Singapore, the European Union and the United States. Under the Privacy Act 2020 we only use providers who protect your information to a standard comparable with New Zealand law, and their contracts with us require it.
How long we keep things
- Photographs: 12 months after the order, or sooner if you ask.
- Finished model files: 12 months, so we can resend or reprint yours.
- Order, invoice and payment records: 7 years, which is the period New Zealand tax law requires.
- Emails with you: as long as they are useful for the job, then deleted.
Your rights
Under the Privacy Act 2020 you may ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong. Email lmc263@uclive.ac.nz and we will reply within 20 working days, which is the statutory limit.
You can also ask us to delete your photographs and your customer record. We will do it, except where tax law obliges us to keep the invoice itself.
If you are not happy with how we have handled your information, you can complain to the Office of the Privacy Commissioner, who will look at it for free.
Keeping it safe
Uploads travel over an encrypted connection and land in storage that is not publicly listed. Access to the shop admin is limited to the people who run the workshop and is protected by two-factor authentication.
No system is perfect. If a breach ever put you at risk of serious harm, we would tell you and the Privacy Commissioner, as the Act requires.
Children
This shop is meant for adults, and you must be 18 to order. We do not knowingly collect information from children. If you believe a child has sent us a photograph, email us and we will delete it.
Changes to this policy
When this policy changes, the date at the top of the page changes with it. If a change materially affects what happens to information we already hold about you, we will email you about it rather than rely on you noticing.
Answered within one working day.