Last updated:
Questions about this page? Email [email protected] or message us on WeChat at atoposnz. Read the Terms & Conditions
01Who we are
This website, xus.nz, and our design services are provided by Xu Studio, an independent design studio founded in 2023 by David and Laura (“Xu Studio”, “we”, “us”). We are based in Mainland China.
For the purposes of data protection law, Xu Studio is the personal information handler under the PRC Personal Information Protection Law, the agency responsible under the New Zealand Privacy Act 2020, and the controller under the EU and UK General Data Protection Regulation (GDPR). Our privacy contacts are David and Laura, reachable by email at [email protected] or on WeChat at atoposnz.
02What this policy covers
This policy explains how we handle personal information when you visit this website, contact us (on WeChat or by email) or work with us on a project, including the files and materials you send us.
It does not cover other websites we link to, or WeChat itself. WeChat is operated by Tencent and processes your information under its own privacy policy. The same applies to the payment providers described in section 6.
03Information we collect
When you visit this website
The website has no contact forms, user accounts, advertising or analytics tools. Our hosting and content-delivery provider automatically processes basic technical data for every request so the site can be delivered securely: IP address, browser and device type, the page requested, the referring page and the time of the visit.
When you contact us
On WeChat: your display name and ID. By email: your name and email address. In both cases, the content of your messages and any files, images or voice notes you send.
When we work together
- Contact and project details: name, organisation, role, the brief, deadlines and feedback.
- Project materials: documents, lesson plans, business plans, data and photographs. These sometimes contain personal information about other people, such as students, team members or customers.
- Billing records: fees, invoices and payment confirmations. Card, WeChat Pay, Alipay and PayPal payments are processed by the payment provider; we see only the payer’s name, the amount and a partial card number or transaction reference (for PayPal, also the payer’s PayPal email address), never full card numbers or banking passwords. For bank transfers we see the payer’s name, account number and payment reference as they appear on our bank statement.
We do not intentionally collect sensitive personal information (for example health data, financial account details, precise location, biometric data, religious beliefs, or information about children under 14). If a file contains information like this that is not needed for the project, please remove it before sending, or tell us and we will not use it.
04How we use it, and our legal basis
We use personal information only for the purposes below, each with a lawful basis under PIPL (Art. 13) and, where it applies, GDPR (Art. 6):
- Replying to enquiries and preparing quotes: necessary to take steps at your request before entering a contract.
- Carrying out the project (design, revisions, delivery, support): necessary to perform our contract with you.
- Business, tax and accounting records: necessary to comply with legal obligations.
- Keeping the website secure and working: our legitimate interest in operating a safe website (GDPR) and the necessity of providing the service (PIPL).
- Showing finished work in our portfolio: only with your consent, which you can withdraw at any time.
We do not sell personal information, use it for targeted advertising, make automated decisions about you, or send marketing messages you have not asked for.
05Children and students
This website is not directed at children. We do not knowingly collect personal information directly from children under 14 (Mainland China), under 13 (United States, COPPA), or under the age of digital consent in your country (EU/UK, 13–16).
Teaching projects sometimes include pupils’ names, images or work. Under PIPL, personal information of minors under 14 is sensitive personal information. In these projects we act only on the instructions of the teacher or school, use the material solely for that project, keep it to the minimum needed, and rely on the school or teacher to have obtained consent from a parent or guardian where the law requires it. Where possible, please blur faces and remove names before sending.
07International transfers
We are based in Mainland China, so information you send us from New Zealand, the EU/UK, the US or elsewhere is transferred to and processed in China. Our website is served through a global content-delivery network, so technical website data may be processed in data centres outside your country.
- From the EU/UK: China does not have an adequacy decision. We transfer data where necessary to perform our contract with you or at your request (GDPR Art. 49(1)(b)), and use the European Commission’s Standard Contractual Clauses (or the UK Addendum) with service providers where required.
- From New Zealand: we take reasonable steps to ensure your information is protected by safeguards comparable to the Privacy Act 2020 (Information Privacy Principle 12).
- Out of Mainland China: we do not transfer personal information collected in China abroad unless a project requires it; if it does, we will tell you the recipient, purpose and how to exercise your rights, and ask for your separate consent (PIPL Arts. 38–39).
08How long we keep it
- Enquiries that do not become projects: files are deleted within 6 months of our last conversation.
- Project files and source files: kept for 12 months after delivery so we can help with later changes, then deleted, unless you ask us to delete them sooner or to keep them longer.
- Billing records: kept for as long as tax and accounting law requires.
- Website technical data: kept by our hosting provider for a short period under its own policy.
We keep personal information for no longer than is necessary for the purpose it was collected for (PIPL Art. 19; GDPR Art. 5(1)(e); NZ IPP 9).
09Security and breaches
We keep project files on password-protected devices and accounts, limit access to the two of us, and use secure links for large file transfers. No system is completely secure. If a breach is likely to harm you, we will notify you and the relevant authority as required: promptly under PIPL Art. 57, within 72 hours to the supervisory authority under GDPR Art. 33 where applicable, and as soon as practicable to the Office of the Privacy Commissioner for notifiable privacy breaches under the NZ Privacy Act 2020.
10Your rights
Wherever you are, you can ask us to:
- tell you what personal information we hold about you and how we use it, and give you a copy;
- correct information that is inaccurate or incomplete;
- delete it, where it is no longer needed or you withdraw consent;
- restrict or object to certain uses, and receive your data in a portable format where the law provides for it;
- withdraw consent at any time (this does not affect processing before withdrawal);
- explain these rules to you, if anything in this policy is unclear.
Send requests by email to [email protected] or on WeChat to atoposnz. We may ask you to confirm your identity. We reply within 15 working days in China, within 20 working days in New Zealand, within one month in the EU/UK, and within 45 days in US states that set a deadline. Reasonable requests are free of charge, and we will never treat you differently for exercising your rights.
11Region-specific information
Mainland China
We process personal information in line with the Personal Information Protection Law, the Cybersecurity Law and the Data Security Law. You have the rights set out in Chapter IV of PIPL, including the right to know, decide, restrict, refuse, access, copy, port, correct and delete, and to ask us to explain our rules. If you believe your rights have been infringed, you may complain to the cyberspace administration or other competent authority, or bring proceedings in a people’s court.
New Zealand
We comply with the 13 Information Privacy Principles of the Privacy Act 2020. You may access and request correction of your personal information (IPPs 6 and 7). If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).
European Union, EEA and United Kingdom
You have the rights in GDPR Arts. 15–22: access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to solely automated decisions (we make none). Our processing of EU/UK residents’ data is occasional and does not involve sensitive data on a large scale, so we have not appointed an EU or UK representative (GDPR Art. 27(2)). You may lodge a complaint with the supervisory authority in your country of residence, or in the UK with the Information Commissioner’s Office (ico.org.uk).
United States
In the past 12 months we have collected identifiers (name, WeChat ID, email address, IP address), commercial information (quotes and invoices), internet activity (website request data) and any personal information contained in files you send us, for the purposes described in section 4. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Residents of California and other states with consumer privacy laws may request to know, delete or correct their information, and may use an authorised agent. We honour Global Privacy Control signals, although this website does not track you. We comply with the Children’s Online Privacy Protection Act (COPPA).
13Changes to this policy
We may update this policy when our services or the law change. The date at the top of the page shows the latest version. If a change significantly affects how we use your information, we will tell clients we are currently working with and, where required, ask for fresh consent.
14Contact and complaints
For any privacy question, request or complaint, email [email protected] or message Xu Studio on WeChat at atoposnz. We will try to resolve your concern directly. You also have the right to complain to the data protection authority where you live, as listed in section 11.