Privacy policy
# Privacy Policy
**Last updated: 23 September 2026**
Messy Kingdom Limited, trading as **Messy Kingdom** (“Messy Kingdom”, “we”, “us” or “our”), operates the Messy Kingdom website, messykingdom.co.nz, and provides messy play sessions, private bookings, events and related products and services.
Our website and checkout are powered by Shopify.
This Privacy Policy explains how we collect, use, store and disclose personal information when you:
- Visit or use our website
- Make or manage a booking
- Attend a Messy Kingdom session, event or private booking
- Contact or communicate with us
- Subscribe to our emails or promotions
- Interact with us through social media
- Purchase products or services from us
We handle personal information in accordance with the **New Zealand Privacy Act 2020**.
## Personal information we collect
“Personal information” means information about an identifiable individual.
Depending on how you interact with Messy Kingdom, we may collect:
- **Contact information**, including your name, email address, telephone number and billing address
- **Booking information**, including the session or event booked, ticket type, number of tickets, payment status and booking history
- **Participant information**, including the age or ages of participating children
- **Safety information** you voluntarily provide, including allergies, medical information, accessibility needs, sensory needs or other information relevant to safe participation
- **Transaction information**, including the amount paid, payment method, discounts, refunds, transfers and transaction confirmation
- **Payment information** processed through Shopify and our payment providers
- **Communications**, including emails, enquiries, feedback, complaints and social media messages
- **Consent and participation records**, including acceptance of our terms, Participation Agreement and photography or video preferences
- **Marketing preferences**, including whether you have subscribed to receive news, discounts and promotional emails
- **Photographs and videos** taken during sessions, private bookings or events where the appropriate permission has been provided
- **Device and technical information**, including IP address, browser, device type, network connection and other online identifiers
- **Website usage information**, including pages or sessions viewed, items added to your cart, purchases made and how you navigate or interact with our website
- **Cookie and advertising information**, where cookies, analytics or advertising tools are enabled
We only ask for information about children where it is reasonably relevant to their participation, safety, accessibility, consent preferences or the activity being booked.
## How we collect personal information
We may collect personal information:
- Directly from you when you make a booking, complete checkout, accept our Participation Agreement, subscribe to our emails, attend a session or contact us
- Automatically through our website, Shopify, cookies and similar technologies
- From payment processors and other providers that help us operate our website and bookings
- Through social media platforms when you message or interact with Messy Kingdom
- From another person where they make a booking or enquiry on your behalf
- From a parent or caregiver providing information about a child in their care
If you provide personal information about another person, you must have their permission or appropriate authority to do so.
## How we use personal information
We may use personal information to:
- Process payments and confirm bookings
- Provide the session, event, private booking, product or service you have purchased
- Send booking confirmations, reminders and important session information
- Contact you about changes, cancellations, transfers, credits or refunds
- Check customers into sessions
- Help us prepare age-appropriate activities
- Record acceptance of our terms, Participation Agreement and consent choices
- Respond to enquiries, feedback or complaints
- Support participant safety and accessibility
- Maintain accurate financial, tax and business records
- Detect, investigate and prevent fraudulent, unsafe or unlawful activity
- Operate, secure, maintain and improve our website and services
- Understand website traffic and how customers interact with our services
- Measure the effectiveness of promotions and advertising
- Send session announcements, new themes, discounts, special events and promotional material where you have subscribed or otherwise agreed to receive it
- Enforce our terms and policies
- Meet our legal and regulatory obligations
We will not use personal information for a purpose unrelated to the reason it was collected unless permitted or required by law.
## Payments
Payments are processed through Shopify and the payment providers available through our checkout.
If services such as Afterpay are enabled, those providers will process information in accordance with their own terms and privacy policies.
Messy Kingdom does not directly receive or store your complete payment card details. Payment providers may collect and process card details, billing information, transaction details and other information needed to approve and process a payment.
## Shopify
Our website and checkout are hosted by Shopify.
Shopify collects and processes information about your access to and use of our website to provide services to both you and Messy Kingdom.
Information submitted through our website may be shared with Shopify and its service providers and may be processed or stored outside New Zealand.
Shopify may also use information about your interactions with Messy Kingdom, other Shopify merchants and Shopify services for purposes including security, analytics, advertising, personalisation and improved shopping features.
You can read more about Shopify’s privacy practices through Shopify’s own privacy information and privacy portal.
## How we disclose personal information
We may disclose personal information to trusted providers where reasonably necessary to operate Messy Kingdom, including:
- Shopify and related website providers
- Payment providers
- Email marketing and booking communication providers
- Website applications and customer support providers
- Website hosting, cloud storage and IT providers
- Analytics, advertising and social media providers
- Accountants, lawyers, insurers and other professional advisers
- Government agencies, courts, regulators or law enforcement where required or permitted by law
If Messy Kingdom Limited or its assets are sold, transferred or restructured, relevant information may be disclosed to professional advisers, a prospective purchaser or a new operator where reasonably necessary and legally permitted.
Appropriate steps will be taken to protect personal information during any such process.
We do not sell or rent customers’ personal information.
## Overseas storage and processing
Some providers used by Messy Kingdom, including Shopify, payment providers, email services, analytics providers and cloud-storage services, may process or store information outside New Zealand.
Where personal information is disclosed overseas, we will take reasonable steps to ensure it is protected appropriately or that the disclosure is otherwise permitted under the Privacy Act 2020.
## Children’s privacy
Messy Kingdom activities are designed for children and families, but our website and booking system are intended to be used by adult parents, legal guardians and caregivers.
We do not knowingly invite children to:
- Create customer accounts
- Make payments
- Accept participation terms
- Provide personal information through our website without appropriate adult involvement
Parents and caregivers should only provide information about a child where it is reasonably necessary for a booking, enquiry, safety requirement, accessibility need, activity planning or consent preference.
If you believe a child has provided personal information to us without appropriate parental or guardian involvement, please contact us so we can review and, where appropriate, delete it.
## Photography and videos
Photos and videos may be taken during Messy Kingdom sessions, birthday parties, private bookings, events and other Messy Kingdom activities.
Parents and caregivers may choose one of the following photography options when booking:
**Full consent**
The child may be photographed or filmed, including their face, and the content may be used by Messy Kingdom for social media, website content, advertising and promotional material.
**Limited consent**
The child may appear only where their face is not clearly visible or identifiable. This may include photographs of hands taking part in activities, photographs from behind, close-ups of play or wider activity shots.
**No consent**
The child will not be intentionally photographed or filmed.
Messy Kingdom may use a simple identification system, such as coloured wristbands, to help staff recognise children with limited or no photography consent.
Parents and caregivers may change their preference at any time by speaking with a Messy Kingdom team member.
Messy Kingdom will not intentionally publish a child’s full name alongside photographs or videos without separate permission.
If you previously agreed to an image being used and later change your mind, please contact us. We will take reasonable steps to remove it from channels controlled by Messy Kingdom where practical.
We may not be able to remove copies that have already been shared, downloaded or republished by other people.
## Email marketing
You may choose to subscribe to receive information about:
- Upcoming sessions
- New themes
- Special events
- Private booking information
- Discounts and promotions
- New Messy Kingdom products and services
You can unsubscribe at any time by:
- Selecting the unsubscribe link in a marketing email; or
- Contacting us at **messykingdomnz@gmail.com**
Unsubscribing from marketing will not prevent us from sending essential messages about an existing booking, payment, cancellation, transfer or session.
## Cookies and analytics
Our website may use cookies and similar technologies to:
- Provide essential website and checkout functions
- Remember your preferences
- Maintain website security
- Understand website traffic and usage
- Improve our services
- Measure advertising and promotional performance
- Provide or measure personalised advertising where enabled
Cookies may be placed by Shopify and other third-party services, including payment, analytics, advertising and social media providers.
You can manage or disable cookies through your browser or available website privacy settings.
Disabling essential cookies may prevent parts of our website or checkout from working correctly.
## Third-party websites and social media
Our website may contain links to third-party websites, payment services or social media platforms.
Those providers have their own privacy policies and are responsible for how they collect and use information on their platforms.
Messy Kingdom is not responsible for the privacy or security practices of third-party websites or services we do not control.
Information posted publicly on social media may be visible, copied or shared by other users.
## Security and privacy breaches
We take reasonable steps to protect personal information against loss, misuse, unauthorised access, disclosure, alteration or destruction.
These measures may include:
- Limiting access to booking and participant information
- Using password-protected systems
- Using reputable website and payment providers
- Limiting access to sensitive participant and consent information to people who reasonably need it
No electronic system can be guaranteed to be completely secure.
If a privacy breach occurs that has caused or is likely to cause serious harm, we will respond in accordance with the Privacy Act 2020. This may include notifying affected individuals and the New Zealand Office of the Privacy Commissioner where required.
## How long we retain information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or to meet our legal, financial, tax, insurance and business obligations.
This may include:
- Retaining transaction and financial records for at least seven years where legally required
- Retaining booking, participation, consent and incident information for an appropriate period for legal, safety and insurance purposes
- Retaining marketing contact information until you unsubscribe or ask us to remove it
- Retaining photographs and videos while we have an appropriate business purpose and the relevant consent has not been withdrawn
When personal information is no longer required, we will take reasonable steps to securely delete, anonymise or archive it.
## Your rights
Under the Privacy Act 2020, you may ask us to:
- Confirm whether we hold personal information about you
- Provide access to personal information we hold about you
- Correct information you believe is inaccurate or incomplete
- Consider deleting information where we are not legally required to retain it
- Update your communication preferences
- Update photography and video consent preferences
We may need to verify your identity before completing a request.
In some circumstances, the law may allow or require us to withhold certain information.
To make a request, contact **messykingdomnz@gmail.com**.
## Complaints and contact
If you have a question, request or complaint about how we collect, use or protect personal information, please contact:
**Privacy Officer**
**Messy Kingdom Limited**
Trading as **Messy Kingdom**
Auckland, New Zealand
Email: **messykingdomnz@gmail.com**
If you require an address for formal postal correspondence, please contact us by email and we will provide the appropriate correspondence address.
We will review your concern and aim to respond within a reasonable timeframe.
If you are not satisfied with our response, you may contact the **New Zealand Office of the Privacy Commissioner**.
## Changes to this policy
We may update this Privacy Policy when our services, technology providers, business arrangements or legal obligations change.
The latest version will be published on our website with its updated date.