No. 23
Privacy Policy
ABOUT THIS POLICY
No. 23 is a brand strategy and design studio based in Auckland, New Zealand. This policy explains what personal information we collect through no23.co.nz and our client work, why we collect it, and what we do with it.
We follow the Privacy Act 2020 and its 13 Information Privacy Principles, including IPP 3A on information collected from third parties. If you are in the UK or EU, we handle your information with the same care and will respond to requests under the rights your local law gives you.
In this policy, “we” and “us” mean No. 23, operated by Hattie Locke. “You” means anyone who visits the site, downloads a resource, enquires about our services or works with us.
WHAT WE COLLECT
We collect only what we need to respond to you, deliver our work and run the studio.
WHEN
WHAT WE COLLECT
Name, email, business name, and anything you include in your message
You use our contact form
Name and email address
You download the Brand Workbook
Name, email, business name, website, and your answers to the intake questions
You request a Brand Pulse Check
The details you submit through LinkedIn’s Lead Gen Form — typically name, email, job title and company
You respond to a LinkedIn ad
Contact and billing details, questionnaire responses, meeting notes, and the brand materials you share with us
You become a client
Device, browser, approximate location, pages visited, and how you arrived — collected through cookies (see below)
You browse the site
We don’t collect sensitive information such as health, financial account or identity details, and we ask you not to send it.
HOW WE COLLECT AND USE IT
Most of what we hold comes from you directly — through forms, email, calls and meetings.
Some comes from public sources. When we research a business we may want to work with, we note the business contact details published on its website, LinkedIn or the Companies Office. We use these only to introduce No. 23 and its services. If we contact you this way, we will tell you where we found your details and how to opt out.
We use your information to:
reply to enquiries and send the resources you request
prepare and deliver Brand Pulse Checks, proposals and client work
send a short follow-up series after a Workbook download, and occasional updates from the studio
manage our client relationships and invoicing
understand how people find and use the site, so we can improve it and measure our advertising
We only send marketing emails to people who have given us their details for that purpose. Every email includes an unsubscribe link, in line with the Unsolicited Electronic Messages Act 2007.
We don’t sell or rent your information. We share it only with the services we use to run the studio, and only as far as each needs it.
WHO WE SHARE IT WITH
WHAT IT HOLDS
SERVICE
Website and form submissions
Squarespace
Email, working notes and documents in Google Docs, Sheets, and Slides, and site analytics
Google (Workspace, Analytics, Ads)
Client and prospect records, questionnaires, meeting notes
Notion
Recorded Brand Pulse Check walkthroughs
Loom
Invoices and billing contacts
QuickBooks
Several of these services store data overseas, mainly in the United States. Before we use a provider, we check its privacy and security commitments are comparable to New Zealand’s, as IPP 12 requires.
We may also share information with our accountant or legal advisers, or where the law requires it. With your permission, we may share project details with a collaborator — a photographer or developer, for example — working on your brand.
We store your information in password-protected accounts with two-factor authentication. Client records sit in a private workspace that only No. 23 can see across clients — each client sees their own portal and nothing else.
We keep information only as long as we need it:
• Enquiries and leads that don’t become work: up to 2 years, then deleted
• Client records and project files: for the life of the relationship and 7 years after, to meet tax and record-keeping obligations
• Mailing list: until you unsubscribe
If a privacy breach is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as soon as practicable.
SECURITY AND RETENTION
You can ask to see the personal information we hold about you, and ask us to correct it. You can also ask us to delete it, or to stop contacting you. We will respond within 20 working days.
To unsubscribe from emails, use the link at the foot of any message.
If you are unhappy with how we have handled your information, contact us first so we can put it right. If we can’t resolve it, you can complain to the Office of the Privacy Commissioner.
YOUR RIGHTS
We review this policy each year and when our tools change. The date at the top shows the latest version.
Our privacy officer is Hattie Locke.
Email: hattie@no23.co.nz
No. 23, Auckland, New Zealand
CHANGES AND CONTACT