Privacy Policy

Ready Set Smile Limited trading as Whippersnappers (we, us or our) (WS), understands that protecting your personal information is important. This Privacy Policy sets out our commitment to protecting the privacy of personal information provided to us, or collected by us, when interacting with you.

The information we collect

Personal information is information or an opinion, whether true or not and whether recorded in a material form or not, about an individual who is identified or reasonably identifiable.

The types of personal information we may collect about you include:

• Identity data: including your name, age, profession, photographic identification, marital status, pronouns, and gender. Where you are a parent, Guardian or legal guardian, this may also include your child's name, room/class and Early Childhood Education (ECE) Centre details.
• Contact data: including your telephone number, address and email.
• Financial data: bank account and payment details (a third party payment processor stores card information that WS does not have access to).
• Transaction data: including details about transactional payments to you from us and from you to us and other details of products and services you have purchased from us or we have purchased from you.
• Technical and usage: anonymised data is collected of when Users access any of our websites or platforms, including details about the internet protocol (IP) address, login data, browser session and geo-location data, statistics on page views and sessions, device and network information, acquisition sources, search queries and/or browsing behaviour, access and use of our website (including through the use of Internet cookies or analytics), and communications with our website.
• Interaction data: including information you provide to us when you participate in any interactive features, including surveys, contests, promotions, activities or events.
• Marketing and communications data: including your preferences in receiving marketing from us and any third parties required to deliver or enhance the Service, your communication preferences, and any separate and explicit written consent for the use of children's images in marketing materials.
• Professional data: including where you are a worker of ours or applying for a role with us, your professional history such as your previous positions and professional experience.
• Consent records: including records of Guardians consent for children to be photographed, consent preferences and withdrawal of consent, collected through the WS website and Permissions Dashboard.
• Photography data: including digital portraits captured during photography Sessions at ECE Centres, kindergartens, preschools and schools.

We recognise that children's information is sensitive and apply additional protections to this data as set out in more detail below.

How we collect personal information

We collect personal information in a variety of ways, including:

• when you interact directly with us, including face-to-face, over the phone, over email, or online;
• directly from Guardians through the Permissions Dashboard;
• from ECE Centres to confirm participation;
• through the photography process during sessions;
• through secure online platforms for delivering Galleries;
• when you complete a form, such as registering for any events or newsletters, or responding to surveys;
• when you apply for a job with us;
• from third parties, such as anonymised details of the use of any website we operate (from our analytics and cookie providers and marketing providers — see the "Cookies" section below for more detail);
• where we collect personal information about you from a third party source other than you (other than the personal information which we have specified will be collected by us in accordance with this Privacy Policy) we will take reasonable steps to notify you of such collection, including the fact that the information has been collected, the purpose for which the information has been collected, the intended recipients of the information, and the name and address of the agency that is holding the information, as required by law; and
• from publicly available sources, such as social media or the New Zealand Companies Office.

We only collect information required to provide our services.

Why we collect, hold, use and disclose personal information

Personal information: We collect, hold, use and disclose your personal information for the following purposes:

• to enable you to access and use our services, including our photography services and online Gallery;
• to do business with you, including to deliver our services to you, register your attendance at our events, assess your application, manage your appointments;
• to deliver onsite photography sessions at ECE centres;
• to contact and communicate with you about our business, including in response to any support requests you lodge with us or other enquiries you make with us, and to contact parents/caregivers about galleries, orders or photography sessions;
• to contact and communicate with you about any enquiries you make with us via any website we operate;
• for internal record keeping, administrative, invoicing and billing purposes;
• for analytics (including aggregated profiling on our website), market research and business development, including to operate and improve our business, associated applications and associated social media platforms;
• for advertising and marketing, including to send you promotional information about our events and experiences and information that we consider may be of interest to you (we do not use children's images for marketing without separate, explicit written consent);
• to run promotions, competitions and/or offer additional benefits to you;
• if you have applied for employment with us, to consider your employment application; and
• to comply with our legal obligations or if otherwise required or authorised by law, including compliance with ECE health, safety and privacy requirements.

Use of Children's Personal Information

Where we collect personal information about children, we recognise the sensitivity of such information and take additional care in its collection, use and security. The personal information about children that may be provided to us includes:

• the child's name and age for identification purposes;
• contact details of parents or guardians;
• photographs or images of the child;
• special requirements or preferences relevant to our services; and
• any other information provided by parents or guardians in relation to the child.

The information is used solely for:

• providing our services to you and your child;
• maintaining client records and service history;
• communicating with parents or guardians regarding services, orders and delivery;
• allowing parents and guardians to access information relating to their child through our secure systems; and
• marketing our services to existing clients (with appropriate consent).

By providing personal information about your child, you confirm that you are the person who has parental responsibility over this child and consent to us holding and using such information in accordance with this Privacy Policy. This Privacy Policy applies to both your personal information and your child's personal information, and your child has the same rights over their personal information as an adult in the same circumstances does. It is important that the personal information we hold about you and your child is accurate and current. Please keep us informed if personal information changes during your relationship with us.

Our disclosures of personal information to third parties

To provide the Service effectively, we may disclose personal information to:

• our employees, contractors and/or related entities;
• WS photographers delivering sessions at ECE Centres;
• IT service providers, data storage, web-hosting and server providers;
• marketing or advertising providers, payment systems operators including, but not limited to, Paypal, Stripe and Shopify Payments;
• ECE Centres, kindergartens, preschools or schools, only to confirm participation and never to share images;
• anyone to whom our business or assets (or any part of them) are, or may (in good faith) be, transferred;
• courts, tribunals and regulatory authorities, in the event you fail to pay for goods or services we have provided to you;
• courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights; and
• third parties to collect and process data, such as Google Analytics (to find out how Google uses data when you use third party websites or applications, please see www.google.com/policies/privacy/partners/ or any other URL Google may use from time to time), Meta Pixel or other relevant analytics businesses; and
• any other third parties as required or permitted by law, such as where we receive a subpoena.

Image Access, Availability and Retention

• Families receive a private gallery link within the WS website when images are ready to view.
• Only the parent/caregiver or legal guardian with the link can access a child's images.
• Images remain available for a set viewing and purchasing period.
• Unpurchased images will be permanently deleted after the expiry period specified in the Terms and Conditions and cannot be recovered.
• Purchased images remain accessible unless the parent/caregiver or legal guardian requests account deletion or deletion of their gallery or images.
• Parents/caregivers may request deletion of their gallery or images at any time.

Marketing Use of Images

• WS will only use a child's image for marketing with explicit written parent/Guardian consent.
• Marketing consent is separate from photography consent and is optional.
• Marketing may include WS website, social media, printed material, advertising and brand communications.
• Parents/caregivers may withdraw marketing consent at any time by contacting WS.
• If consent is withdrawn, images will not be used from that date forward.

Your rights and controlling your personal information

Your choice: Please read this Privacy Policy carefully. If you provide personal information to us, you understand we will collect, hold, use and disclose your personal information in accordance with this Privacy Policy. You do not have to provide personal information to us, however, if you do not, it may affect our ability to do business with you.

Information from third parties: If we receive personal information about you from a third party, we will protect it as set out in this Privacy Policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person's consent to provide the personal information to us.

Restrict and unsubscribe: To object to processing for direct marketing/unsubscribe from our email database or opt-out of communications (including marketing communications), please contact us using the details below or opt-out using the opt-out facilities provided in the communication.

Access: You may request access to the personal information that we hold about you. An administrative fee may be payable for the provision of such information. Please note, in some situations, we may be legally permitted to withhold access to your personal information. If we cannot provide access to your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal. If we can provide access to your information in another form that still meets your needs, then we will take reasonable steps to give you such access.

Correction: If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to promptly correct any information found to be inaccurate, out of date, incomplete, irrelevant or misleading. Please note, in some situations, we may be legally permitted to not correct your personal information. If we cannot correct your information, we will advise you as soon as reasonably possible and provide you with the reasons for our refusal and any mechanism available to complain about the refusal.

Complaints to us: If you wish to make a complaint, please contact us using the details below and provide us with full details of the complaint. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take in response to your complaint.

Complaints to the Privacy Commissioner: If you believe that we have breached your privacy or not adequately addressed your privacy concerns, you have the right to make a complaint to the Office of the Privacy Commissioner. We encourage you to contact us first so we can try to resolve any issues directly.

Storage and security

We are committed to ensuring that the personal information we collect is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures, to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.

WS uses secure, reputable systems and industry-standard protections to safeguard children's data. These include:

• SSL/HTTPS encryption across all WS websites;
• Encrypted cloud storage (via Amazon Web Services) for digital images;
• Password-protected devices and accounts for Photographers and staff;
• Restricted server and database access, limited to authorised developers and personnel;
• Encrypted passwords that cannot be viewed by WS staff or photographers; and
• Secure payment processing (e.g., Stripe).

Access to personal data is limited to WS staff, authorised photographers and approved contractors who have a business need to know. All are bound by confidentiality.

While we are committed to security, we cannot guarantee the security of any information that is transmitted to or by us over the Internet. The transmission and exchange of information is carried out at your own risk.

Data breach response

We are committed to protecting your personal information and take data security seriously. In the unlikely event of a data breach that poses a risk of serious harm to affected individuals, we will:

• take immediate steps to contain and assess the breach;
• notify the Privacy Commissioner within 72 hours of becoming aware of the breach (where required by law);
• notify affected individuals without unreasonable delay where the breach is likely to cause serious harm;
• provide clear information about what happened, what information was involved, and what steps we are taking to address the breach; and
• offer appropriate support and guidance to affected individuals.

We maintain incident response procedures and regularly review our security measures to prevent data breaches. If you suspect a security incident involving your personal information, please contact us immediately using the details below.

Cookies

We may use cookies on our website from time to time. Cookies are text files placed in your computer's browser to store your preferences. Cookies, by themselves, do not tell us your email address or other personally identifiable information. However, they do recognise you when you return to our online website and allow third parties to cause our advertisements to appear on your social media and online media feeds as part of our retargeting campaigns. If and when you choose to provide our online website with personal information, this information may be linked to the data stored in the cookie.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

Links to other websites

Our website may contain links to other party's websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

Amendments

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Privacy Policy on our website. We recommend you check our website regularly to ensure you are aware of our current Privacy Policy.