Privacy | Headshot Coffee

Website and whole-of-business privacy statement

Effective / prepared: 10 September 2025

Headshot Coffee collects and uses personal information only for legitimate business purposes connected with our services. We take reasonable steps to protect it, limit unnecessary collection, provide access and correction rights, and respond to privacy incidents in accordance with New Zealand law.

1. About this policy

Headshot Coffee ("Headshot Coffee", "we", "us" or "our") is a New Zealand business providing coffee, event, catering, equipment, rental and related services. This Privacy Policy explains how we collect, hold, use, disclose and protect personal information.

This policy applies across our website, event and corporate bookings, enquiries, competitions and promotions, social media activity, customer and rental relationships, suppliers, contractors, staff and job applicants, and any Headshot Coffee applications, portals, software or digital services.

We intend to handle personal information in accordance with the Privacy Act 2020 and the Information Privacy Principles, including Information Privacy Principle 3A relating to information collected indirectly.

2. Who is responsible for privacy?

Privacy Officer: Headshot Coffee Privacy Officer

Email: info@headshotcoffee.com

Business location: Auckland, New Zealand

Website: www.headshotcoffee.com

We do not publish a street or residential address in this policy. A postal or service address can be provided where reasonably required.

3. What personal information we may collect

The information we collect depends on how you interact with us. We may collect the following where reasonably necessary for a legitimate Headshot Coffee purpose:

identity and contact details, such as name, email address, telephone number, postal or delivery details and organisation or employer;
booking, event and service details, including event location, dates, attendance information, venue requirements, delivery instructions and correspondence;
customer, rental and account information, including booking history, equipment supplied, deposits, damage records, service records, signed terms and identification where reasonably required for a rental or risk-control purpose;
billing and transaction information, including invoice details, payment status, transaction references and relevant accounting records;
dietary, allergy or accessibility information where you choose to provide it and where it is relevant to the service requested;
competition, promotion, survey and feedback information;
communications with us by email, telephone, messaging, social media, web forms or other channels;
photographs, video and other event media where captured lawfully and fairly;
CCTV images and associated date/time/location information from our trailer, business locations or controlled operational areas;
website, app and software information, including IP address, device and browser information, cookies, session information, referral source, approximate location derived from IP, usage logs, account activity and security logs;
marketing preferences, consent records, unsubscribe choices and campaign interaction information;
supplier, contractor, staff and applicant information, including contact details, work history, qualifications, references, payroll or bank details, tax information, emergency contacts, availability, performance and health-and-safety-related information where necessary; and
other information you provide to us, or that we lawfully obtain, where it is reasonably necessary for the relevant business purpose.

We will not require identifying information where the lawful purpose can reasonably be achieved without it.

4. How we collect information?

We usually collect personal information directly from you, for example when you make an enquiry, request a quote, place an order, make a booking, hire equipment, enter a competition, apply for work, use our website or software, or communicate with us.

We may also receive information from another person or organisation where permitted by law, for example from a corporate event organiser, venue, client, staffing provider, referee, supplier, payment provider, publicly available source, social media platform, analytics provider or another person you have authorised. Where Information Privacy Principle 3A applies, we will take reasonable steps to make you aware of the indirect collection and the relevant privacy information unless an exception applies.

5. Why we collect and use personal information?

responding to enquiries and providing quotes;
taking, managing and fulfilling bookings, orders, rentals, catering and event services;
communicating with clients, customers, venues, suppliers, staff and contractors;
processing payments, invoices, deposits, refunds and accounting records;
managing rental assets, equipment condition, maintenance, loss, damage and recovery;
providing, maintaining, securing and improving our website, apps, software and customer experience;
administering competitions, promotions, loyalty activity, surveys and prize fulfilment;
sending marketing and promotional communications where permitted, and recording unsubscribe choices;
creating and using event photography or video for agreed or otherwise lawful promotional, advertising, social media and portfolio purposes;
protecting people, property, equipment, cash and operations, including through CCTV and security logs;
recruiting, engaging, paying, managing and supporting staff and contractors;
meeting tax, employment, health and safety, insurance, legal, regulatory and record-keeping obligations;
preventing or investigating suspected fraud, misuse, theft, security incidents, unlawful activity or breaches of our terms; and
establishing, exercising or defending legal rights and resolving complaints or disputes.

6. Payments

Online or electronic payments may be processed by third-party payment providers. Depending on the service used, these may include providers such as Stripe, Square, Shopify, Windcave or another payment processor selected by Headshot Coffee. Payment providers may collect payment-card or bank information directly under their own terms and privacy notices.

Headshot Coffee does not intend to store full payment-card numbers or card security codes unless a lawful and appropriately secured payment process specifically requires this. We may retain transaction references, payment status, invoice data and other accounting records required for business and tax purposes.

7. Website, cookies, analytics and digital services

Our website and digital services may use cookies and similar technologies for essential functionality, security, preferences, analytics, performance, advertising and campaign measurement. Some technologies may be placed or read by third-party service providers.

Where appropriate, we may provide cookie controls or consent choices for non-essential analytics or advertising technologies. You can also control cookies through your browser or device settings, although disabling necessary technologies may affect functionality.

Our website is operated using third-party website and hosting technology. Service providers may change over time. We require staff to keep an internal record of material providers that handle personal information on our behalf.

8. Apps, portals and software

If you use a Headshot Coffee app, portal, account system or other software service, we may collect account details, login and security data, device information, app usage information, support requests and transaction or booking activity. We will use that information to deliver and secure the service, provide support, improve functionality and communicate service-related information.

Marketing communications through an app, email, SMS or other electronic channel will be handled separately from essential service communications and will be sent only where permitted by law.

9. Marketing communications

We may send news, offers, promotions, corporate-service information, follow-up communications or other marketing where we have the required consent or another lawful basis to do so. Where the Unsolicited Electronic Messages Act 2007 applies, commercial electronic messages will identify the sender and provide a clear and functional way to unsubscribe.

You can unsubscribe at any time using the method provided in the message or by contacting us. We may keep a minimal suppression record after an unsubscribe so that we can respect the request and avoid re-adding the address inadvertently.

10. Photography, video and promotional media

Headshot Coffee may photograph or film our equipment, activations, trailer, staff, events and event atmosphere for business records, social media, portfolio, promotional or advertising purposes. An identifiable image of a person can be personal information.

Where a person is deliberately featured, portrayed as a customer, used in an endorsement-style context, photographed in a non-public setting, or where the context is sensitive, we will seek appropriate permission before promotional use unless another lawful basis clearly applies. For general public-event or crowd imagery, we will take reasonable steps to be fair and transparent, which may include event or onsite signage and practical opt-out arrangements.

Where children or young people are the identifiable focus of promotional content, we will take extra care and seek appropriate consent from a parent or guardian where reasonably required by the circumstances.

11. CCTV

CCTV may operate in or around our coffee trailer, business premises and other areas under our operational control for safety, security, theft prevention, incident investigation and protection of people, cash, property and equipment.

We will use signage or other reasonable notice where CCTV is operating. Cameras should be positioned only where reasonably necessary for the stated security purpose. We do not ordinarily record audio with CCTV unless there is a specific, documented and lawful reason that justifies the additional privacy intrusion.

CCTV footage is normally retained for up to 31 days and then overwritten or securely deleted, unless footage is required for an incident, complaint, insurance matter, investigation, legal process or another lawful purpose. Access to footage is restricted to authorised persons and relevant service providers.

12. When we may share personal information

We do not sell personal information. We may disclose information where reasonably necessary for the purposes described in this policy, including to:

website, hosting, app, software, database, cloud-storage and IT providers;
payment processors, banks and payment or fraud-prevention services;
accounting, payroll, invoicing and professional advisers;
email, messaging, CRM, survey, booking, analytics, advertising and social-media platforms;
couriers, delivery providers, venues, event organisers, contractors, suppliers and service partners involved in delivering the requested service;
insurers, loss adjusters, debt-recovery or asset-recovery providers where relevant;
law enforcement, regulators, courts, tribunals or government agencies where disclosure is required or authorised by law;
a purchaser, adviser or other relevant party in connection with a genuine business sale, restructure or transaction, subject to appropriate confidentiality controls; and
other parties where you have authorised the disclosure or another Privacy Act exception applies.

Where a third party processes information only to provide a service to Headshot Coffee, we expect it to use and protect the information consistently with its contractual obligations and applicable law.

13. Overseas service providers

Some of our service providers may store, process or access personal information outside New Zealand. We will assess overseas disclosures under Information Privacy Principle 12 and take reasonable steps to ensure that any cross-border disclosure is permitted and subject to appropriate privacy safeguards. In some situations, information may be processed overseas by a service provider acting solely as our agent rather than being disclosed for its own purposes.

14. Security

We take reasonable administrative, technical and physical safeguards appropriate to the information and the risks involved. Measures may include access controls, passwords and multi-factor authentication, secure payment systems, device security, backups, staff confidentiality obligations, restricted CCTV access, software updates and controlled disposal of records.

No internet, cloud or storage system can be guaranteed to be completely secure. If a privacy breach occurs, we will contain and assess it and, where the breach is notifiable, notify the Office of the Privacy Commissioner and affected people as soon as practicable in accordance with the Privacy Act 2020.

15. How long we keep information

We keep personal information only for as long as it is reasonably required for a lawful purpose, including providing services, meeting contractual obligations, resolving disputes and complying with legal record-keeping duties. Different records have different retention periods.

tax and core business records may need to be retained for at least seven tax years;
wage, time, holiday and leave records for employees must generally be retained for six years;
CCTV is normally retained for up to 31 days unless required for an incident or other lawful purpose;
marketing contact details may be retained while consent or another lawful marketing basis continues, with minimal suppression records retained as necessary to honour opt-outs; and
other customer, enquiry, staff, supplier, competition, software and media records are reviewed and deleted, anonymised or archived when no longer required for a lawful purpose.

16. Accessing or correcting your information

You may ask whether we hold personal information about you, request access to it, or ask us to correct information you believe is inaccurate, incomplete or misleading. Contact the Privacy Officer at info@headshotcoffee.com.

We may ask you to verify your identity before releasing personal information. We will respond as soon as reasonably practicable and, for Privacy Act access or correction requests, make the required decision within the statutory timeframe (generally 20 working days), subject to any lawful extension or withholding ground.

You may also ask us to delete information. New Zealand privacy law does not create an absolute general right to erasure, but we will consider deletion requests against our lawful purposes, retention obligations and the Privacy Act.

17. Complaints

If you have a privacy concern, please contact our Privacy Officer first at info@headshotcoffee.com so we can investigate and try to resolve it.

You may also make a complaint to the Office of the Privacy Commissioner of New Zealand. Information about privacy rights and complaints is available at www.privacy.org.nz.

18. Staff, contractors and applicants

This policy also applies to personal information we collect about job applicants, employees and contractors, subject to any more specific employment, contractor or internal privacy notices. We may collect and use that information for recruitment, onboarding, roster and availability management, payroll, tax, training, performance, safety, security, access management, investigations, insurance and legal compliance.

19. Changes to this policy

We may update this policy when our services, technology, providers or legal obligations change. The current version will be published on our website with an updated effective date. If a change materially affects how we use information already collected, we will consider whether further notice or consent is required before applying the change.

20. Contact

Privacy Officer

Headshot Coffee

Auckland, New Zealand