Privacy policy
Last updated: 11 September 2026.
Overview
This privacy policy explains how Brickbox collects, uses, stores, and discloses personal information when you visit brickbox.nz or buy from us.
We comply with the New Zealand Privacy Act 2020. Nothing in this policy limits your rights under that Act.
Who we are
Brickbox is a New Zealand business selling LEGO sets and collectibles through brickbox.nz.
For privacy questions or requests, use our contact form.
What we collect
Depending on how you use the site, we may collect:
- Contact details — name, email address, phone number (if you provide it), and delivery address
- Order information — products purchased, order history, and payment status (payment card details are processed by our payment providers — we do not store full card numbers)
- Account information — if you create a customer account, your login email and order history
- Communications — messages you send via our contact form or email correspondence
- Technical data — IP address, browser type, device information, and cookies used to operate and improve the site
We collect personal information directly from you when you place an order, create an account, or contact us. We do not knowingly collect personal information from children under 16 without parental consent.
How we use your information
We use personal information to:
- Process and fulfil orders, including shipping and customer support
- Communicate about your order (confirmations, shipping updates, responses to enquiries)
- Operate, secure, and improve brickbox.nz
- Comply with legal and tax obligations
- Send marketing communications only where you have opted in — you can unsubscribe at any time
Who we share information with
We do not sell your personal information. We share information only as needed to run the business:
- Shopify — our e-commerce platform, hosting, and checkout provider
- Payment processors — to process payments securely
- Courier services — name and delivery address to deliver your order
- Professional advisers — where required (e.g. accountants), under confidentiality
- Law enforcement or regulators — if required by New Zealand law
Overseas disclosure
Some service providers (including Shopify and payment processors) may store or process personal information outside New Zealand, including in the United States. Where information is disclosed overseas, we take reasonable steps to ensure it is protected in line with New Zealand privacy law.
Cookies and analytics
brickbox.nz uses cookies and similar technologies to keep the site working, remember preferences, and understand how visitors use the store. You can control cookies through your browser settings, though some site features may not work correctly if cookies are disabled.
How we protect your information
We take reasonable steps to protect personal information from loss, misuse, unauthorised access, and disclosure. This includes secure checkout, access controls, and using reputable service providers.
No method of transmission over the internet is completely secure. We cannot guarantee absolute security.
How long we keep information
We retain personal information for as long as needed to fulfil the purposes described in this policy, including meeting legal, accounting, and tax requirements. Order records are typically retained for at least seven years for tax purposes.
Your rights
Under the Privacy Act 2020, you have the right to:
- Ask whether we hold personal information about you
- Request access to personal information we hold about you
- Request correction of inaccurate information
To make a request, use our contact form with enough detail for us to identify you and your request. We will respond within a reasonable time.
Notifiable privacy breaches
If a privacy breach is likely to cause serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by New Zealand law.
Links to other websites
Our site may link to third-party websites (for example, social media). We are not responsible for the privacy practices of those sites.
Changes to this policy
We may update this policy from time to time. The current version will always be published on this page. Material changes may be communicated where appropriate.
Contact
For privacy enquiries or requests, use our contact form.