Privacy policy

TheBros Limited (trading as TheBros) | NZBN 9429053602411 | Version: 17 August 2026

TheBros operates this store and website, including all related information, content, features, tools,

products and services, in order to provide you, the customer, with a curated shopping experience (the

"Services"). TheBros is powered by Shopify, which enables us to provide the Services to you. This

use, or make a purchase or other transaction using the Services or otherwise communicate with us. If

there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with

respect to the collection, processing, and disclosure of your personal information.

This Privacy Policy is governed by the Privacy Act 2020. Where this policy refers to rights or

obligations, it refers to those arising under that Act unless it says otherwise.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge

that you have read this Privacy Policy and understand the collection, use, and disclosure of your

information as described in this Privacy Policy.

Our Privacy Officer

Our privacy officer is Timothy Swainson, Director. You can contact our privacy officer about anything

in this policy, or to make a request to access or correct your personal information, at

support@thebros.co.nz or on +64 27 979 7988. Our privacy officer is responsible for encouraging our

compliance with the information privacy principles, dealing with requests and complaints, and working

with the Office of the Privacy Commissioner.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can

reasonably be linked to you or another person. Personal information does not include information

that is collected anonymously or that has been de-identified, so that it cannot identify or be

reasonably linked to you. We may collect or process the following categories of personal information,

including inferences drawn from this personal information, depending on how you interact with the

Services, where you live, and as permitted or required by applicable law:

• Contact details including your name, address, billing address, shipping address, phone number,

and email address.

• Financial information including credit card, debit card, and financial account numbers, payment

card information, financial account information, transaction details, form of payment, payment

confirmation and other payment details.

• Account information including your username, password, security questions, preferences and

settings.• Transaction information including the items you view, put in your cart, add to your wishlist, or

purchase, return, exchange or cancel and your past transactions.

• Communications with us including the information you include in communications with us, for

example, when sending a customer support inquiry.

• Device information including information about your device, browser, or network connection,

your IP address, and other unique identifiers.

• Usage information including information regarding your interaction with the Services, including

how and when you interact with or navigate the Services.

We assign account numbers, order numbers and similar identifiers so that we can operate your

account and process your orders. We do not assign you an identifier that another agency has

already assigned to you, and we will not require you to disclose an identifier assigned by another

agency except where the Privacy Act 2020 permits it. This is information privacy principle 13.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you including when you create an account, visit or use the Services, communicate

with us, or otherwise provide us with your personal information;

• Automatically through the Services including from your device when you use our products or

services or visit our websites, and through the use of cookies and similar technologies;

• From our service providers including when we engage them to enable certain technology and

when they collect or process your personal information on our behalf;

• From our partners or other third parties.

Where we collect personal information directly from you, we will take reasonable steps to make sure

you know why we are collecting it, who will receive it, whether providing it is voluntary, and that you

may ask to see it and correct it. Some information is necessary to process your order; if you do not

provide it, we may not be able to supply you. We collect personal information only by lawful means

and in a way that is fair and not unreasonably intrusive in the circumstances.

Where we collect personal information about you from someone other than you, for example from

our service providers, from our business or marketing partners, or from Shopify, we will take

reasonable steps, as soon as reasonably practicable after we collect it, to make you aware that we

have collected it, what we have collected and why, who we obtained it from, that TheBros Limited of

25 Esk Street, Roslyn, Palmerston North is collecting and holding it, whether any law requires or

authorises the collection, and that you may ask to see the information and ask us to correct it. This is

information privacy principle 3A. We may not do this where the Privacy Act 2020 allows us not to,

including where you already know these things or where telling you would prejudice a purpose for

which the information was collected.How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal

information for the following purposes:

• Provide, Tailor, and Improve the Services. We use your personal information to provide you with

the Services, including to perform our contract with you, to process your payments, to fulfil your

orders, to remember your preferences and items you are interested in, to send notifications to you

related to your account, to process purchases, returns, exchanges or other transactions, to create,

maintain and otherwise manage your account, to arrange for shipping, to facilitate any returns and

exchanges, to enable you to post reviews, and to create a customised shopping experience for

you, such as recommending products related to your purchases.

• Marketing and Advertising. We use your personal information for marketing and promotional

purposes, such as to send marketing, advertising and promotional communications by email, text

message or postal mail, and to show you online advertisements for products or services on the

Services or other websites, including based on items you previously have purchased or added to

your cart and other activity on the Services.

• Security and Fraud Prevention. We use your personal information to authenticate your account,

to provide a secure payment and shopping experience, detect, investigate or take action regarding

possible fraudulent, illegal, unsafe, or malicious activity, protect public safety, and to secure our

services.

• Communicating with You. We use your personal information to provide you with customer

support, to be responsive to you, to provide effective services to you and to maintain our business

relationship with you.

• Legal Reasons. We use your personal information to comply with applicable law or respond to

valid legal process, including requests from law enforcement or government agencies, to

investigate or participate in civil discovery, potential or actual litigation, or other adversarial legal

proceedings, and to enforce or investigate potential violations of our terms or policies.

Marketing messages we send you by email or text message will identify us as the sender, will include

our contact details, and will contain a working unsubscribe facility, as the Unsolicited Electronic

Messages Act 2007 requires. You can opt out at any time and we will action your request within five

working days.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate

purposes subject to this Privacy Policy. Such circumstances may include:

• With Shopify, including Shopify Payments and Shop Pay for payments, with Starshipit, which

produces shipping labels and tracking for your order, with Shopify Inbox if you message us

through the site, and with other vendors and third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfilment

and shipping).

• With business and marketing partners to provide marketing services and advertise to you. For

example, we use Shopify to support personalised advertising with third-party services based on

your online activity with different merchants and websites. Our business and marketing partners

will use your information in accordance with their own privacy notices.

• When you direct, request us or otherwise consent to our disclosure of certain information to

third parties, such as to ship you products or through your use of social media widgets or login

integrations.

• With our affiliates or otherwise within our corporate group.

• In connection with a business transaction such as a merger or bankruptcy, to comply with any

applicable legal obligations (including to respond to subpoenas, search warrants and similar

requests), to enforce any applicable terms of service or policies, and to protect or defend the

Services, our rights, and the rights of our users or others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your

access to and use of the Services in order to provide and improve the Services for you. Information

you submit to the Services will be transmitted to and shared with Shopify as well as third parties that

may be located in countries other than where you reside, in order to provide and improve the Services

for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced

features that incorporate data and information obtained from your interactions with our Store, along

with other merchants and with Shopify.

Shopify is responsible for the processing of your personal information, including for responding to

your requests to exercise your rights over use of your personal information for these purposes. To

learn more about how Shopify uses your personal information and any rights you may have, you can

visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain

rights with respect to your personal information here Shopify Privacy Portal Link.

Shopify uses other service providers to help deliver its services and publishes a list of them, which you

can ask us for. Where Shopify or another service provider holds your personal information only in

order to store or process it on our behalf, that information is treated as held by us and not by them.

Where Shopify uses your personal information for its own purposes, including for personalised

advertising across other merchants, that is a disclosure by us and we deal with it under the heading

"Sending information outside New Zealand" below.

Cookies and Similar Technologies

We and our service providers use cookies, pixels, tags and similar technologies on the Services. Strictly

necessary cookies keep the site working, including your cart and your logged-in session. Analytics cookies tell us how the Services are used so that we can improve them. Advertising cookies and pixels,

including those set by Shopify and its advertising partners, are used to show you products and offers

on the Services and on other websites.

You can control cookies through your browser settings, and you can delete cookies already stored on

your device. Blocking strictly necessary cookies will stop parts of the Services working. Where we need

your consent to set a cookie, we will ask for it before we set it, and you can withdraw that consent at

any time by contacting our privacy officer or changing your browser settings. Some browsers send a

"do not track" signal. There is no agreed standard for responding to that signal and the Services do

not currently respond to it.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you

follow links to sites not affiliated or controlled by us, you should review their privacy and security

policies and other terms and conditions. We do not guarantee and are not responsible for the privacy

or security of such sites, including the accuracy, completeness, or reliability of information found on

these sites. Information you provide on public or semi-public venues, including information you share

on third-party social networking platforms may also be viewable by other users of the Services and/or

users of those third-party platforms without limitation as to its use by us or by a third party. Our

inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or

of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used by children. We do not knowingly collect personal

information from anyone under 16. If you are the parent or guardian of a child who has provided us

with their personal information, you may contact our privacy officer to ask us to delete it, and we will

do so unless we are required to keep it.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee

"perfect security." In addition, any information you send to us may not be secure while in transit. We

recommend that you do not use unsecure channels to communicate sensitive or confidential

information to us.

We take reasonable steps to protect the personal information we hold against loss, misuse,

unauthorised access, modification and disclosure. If a privacy breach occurs that has caused, or is

likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected

individuals as soon as practicable, as the Privacy Act 2020 requires.

Before we use or disclose your personal information, we take reasonable steps to check that it is

accurate, up to date, complete, relevant and not misleading. This is information privacy principle 8. Please keep your account details current and tell our privacy officer if anything we hold about you is

wrong.

We do not keep personal information for longer than we need it. We keep order and account records

for seven years, which reflects our tax and business record-keeping obligations, and then delete or deidentify them. We may keep information for longer where we are required to, or where it is needed for

a dispute that is on foot.

Your Rights and Choices

Under the Privacy Act 2020 you have the following rights in relation to the personal information we

hold about you.

• Access. You may ask us for confirmation of whether we hold personal information about you,

and for access to that information. This is information privacy principle 6. We will respond as soon

as reasonably practicable and no later than 20 working days after we receive your request. There

are limited grounds on which we may refuse a request, and if we refuse we will tell you why.

• Correction. You may ask us to correct personal information we hold about you. This is

information privacy principle 7. If we do not agree to correct it, you may ask us to attach a

statement of the correction you sought, and we will take reasonable steps to do so.

• Managing Communication Preferences. We may send you promotional emails, and you may opt

out of receiving these at any time by using the unsubscribe option displayed in our emails to you.

If you opt out, we may still send you non-promotional emails, such as those about your account or

orders that you have made.

• Deletion. New Zealand law does not give a general right to have personal information deleted.

We will, however, consider any request you make and we will not keep information longer than we

need it.

You may exercise any of these rights where indicated on the Services or by contacting us using the

contact details provided below. There is no charge for making a request. If the Privacy Act 2020

permits us to impose a charge, we will tell you the amount before we do the work, and any charge will

be reasonable. To learn more about how Shopify uses your personal information and any rights you

may have, including rights related to data processed by Shopify, you can visit

https://privacy.shopify.com/en.

We may need to verify your identity before we can process your request. You may authorise another

person to make a request on your behalf. Before we accept a request from that person, we will require

evidence of their authority, and we may need to verify your identity with you directly.

Complaints

If you have complaints about how we process your personal information, please contact us using the

contact details provided below. Our privacy officer will acknowledge your complaint and will tell you

the outcome of our investigation within 10 working days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner, telephone 0800 803 909, email

enquiries@privacy.org.nz, or online at www.privacy.org.nz.

Sending information outside New Zealand

Please note that we may transfer, store and process your personal information outside the country

you live in.Our website is hosted by Shopify and your personal information is stored and processed on

servers outside New Zealand. Where Shopify or another provider holds or processes your information

only on our behalf, that is not a disclosure and the information remains ours under the Privacy Act

2020.

Where we do disclose your personal information to a person or organisation outside New Zealand, we

do so only in accordance with information privacy principle 12. That means we satisfy ourselves, on

reasonable grounds, that the recipient is subject to the Privacy Act 2020, is subject to privacy laws that

provide comparable safeguards, participates in a prescribed binding scheme, or is required by its

agreement with us to protect your information in a way that provides comparable safeguards. In the

case of Shopify, we rely on the Shopify Data Processing Addendum, which is incorporated into

Shopify's Terms of Service. Under it Shopify must keep your information secure, limit access to people

who are under confidentiality obligations, use only the service providers on its published list, tell us

about a breach, and delete or return your information when our agreement ends. Shopify may process

your information in countries including Singapore and Canada. Information you give to Shopify

directly, through services such as Shop or Shop Pay, is collected by Shopify under its own privacy

policy and this policy does not apply to it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or

for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this

website, update the "Last updated" date and provide notice as required by applicable law. Where a

change is material, we will tell you before it takes effect.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like

to exercise any of the rights available to you, please contact our privacy officer:

TheBros Limited (trading as TheBros)

25 Esk Street, Roslyn, Palmerston North 4414, New Zealand

Email: support@thebros.co.nz | Telephone: +64 27 979 7988

Last updated: 17 August 2026