Privacy Policy

Version 2, August 2026

This page explains how personal information is collected, used, stored and protected by Note Lab Limited, both through this website and in the course of our professional work.

Who we are

This website is operated by Note Lab Limited, a New Zealand company. In this policy, "we", "us" and "our" mean Note Lab Limited.

We handle personal information in accordance with the Privacy Act 2020.

What we collect

Personal information means information about an identifiable individual, such as a name, email address, postal address, phone number or other contact details.

From website visitors. Information you choose to provide when you contact us, subscribe to our mailing list, make a purchase or make a donation. This typically includes your name and email address, and for purchases a delivery or billing address.

From clients and collaborators. Contact details, billing information, company and tax details, and any information you provide in the course of an engagement. Where an engagement involves other people, such as musicians or crew, we may hold their names and contact details for the purposes of that work.

Automatically. Technical information about your visit, including IP address, browser type, device type, referral source and general usage data.

We do not collect sensitive information, and we do not store full payment card details at any time.

Why we collect it

We use personal information to respond to enquiries, provide and administer our services, issue and process invoices, deliver purchases, send mailing list updates where you have asked for them, meet our tax and legal obligations, and operate and improve this website.

We do not sell personal information, and we do not use it for automated decision making or profiling.

Cookies and analytics

Cookies may be used to support essential website functionality and analytics. You can disable cookies in your browser settings, although some features of the site may not operate as intended.

Our website platform may also set cookies of its own. Details of how to manage these are available in your browser settings.

Who we share it with

We do not share personal information with third parties except where it is necessary to operate our business, or where we are required to by law.

Personal information may be held in trusted third party systems that support our operations, including our website platform, email and file storage services, accounting and invoicing software, mailing list software and payment processors. These providers hold information on our behalf and are not permitted to use it for their own purposes.

Payments and donations are processed by secure third party providers. We do not store full payment information.

Information held overseas

Several of the providers we use are based outside New Zealand, including in the United States, Australia and the European Union. This means personal information we hold may be stored or processed overseas.

Where we disclose personal information to an overseas provider, we take reasonable steps to satisfy ourselves that the provider is required to protect that information with safeguards comparable to those under the Privacy Act 2020.

How long we keep it

We keep personal information only for as long as it is needed for the purpose it was collected, or for as long as we are required to keep it by law.

Records relating to invoicing, tax and business transactions are kept for at least seven years, as required by New Zealand tax law. Mailing list subscriptions are kept until you unsubscribe. Enquiries that do not lead to an engagement are deleted once they are no longer relevant.

Keeping information secure

We take reasonable steps to protect the information we hold from loss, misuse and unauthorised access.

If a privacy breach occurs that is likely to cause serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

Mailing list

We will send email updates only if you have chosen to receive them. You can unsubscribe at any time using the link in any newsletter email, or by contacting us directly.

Your rights

You may request access to the personal information we hold about you, and you may ask us to correct it if it is wrong. Requests should be made using the contact details below, and we will respond within 20 working days as required by the Privacy Act 2020.

If you are in the United Kingdom or the European Economic Area, you may also have rights to request deletion of your information, to restrict or object to how we use it, to receive a copy of it in a portable format, and to withdraw consent where our use is based on consent. Where the UK GDPR or EU GDPR applies to our handling of your information, we rely on your consent for mailing list communications, on the performance of a contract for client and purchase information, and on our legitimate interests in operating and improving our business for everything else.

Contact and complaints

Privacy questions, requests and complaints should be sent to Ryan Youens at ryan@ryanyouens.com.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

This Privacy Policy may be updated from time to time. Any changes take effect when they are posted on this page. The version in effect at the time is shown at the top.