Summary. We process personal information only where we have a valid legal basis, keep it no longer than necessary, and give you clear ways to exercise your privacy rights. The sections below provide detail suitable for legal and operational review.
Who is responsible
The data controller for personal information described in this policy is Zelmaronvit, registered office at 160 Broadway, Newmarket, Auckland 1023, New Zealand. You can contact our privacy team using ask@zelmaronvit.world or by telephone on +64 9 919 2320 during published office hours. When we use processors, they act on our instructions and remain bound by contract.
Scope and audience
This policy applies when you browse our public website, submit a contact form, correspond with us by email, telephone, or post, or purchase goods or services where we are the seller. If you follow links to third-party websites, their own privacy notices apply. We do not control external platforms and encourage you to read their terms before you share information there.
Categories of data
Depending on how you interact with us, we may process some or all of the following categories:
- Identity data: full name, title, or similar identifiers you provide.
- Contact data: email address, postal address, telephone number.
- Communication content: free-text messages, attachments, and notes from calls or meetings that you initiate or consent to.
- Transaction data: order references, delivery preferences, and payment status where a payment provider shares limited confirmation data with us.
- Technical data: Internet Protocol address, browser type and version, time zone, device category, operating system, and pages viewed, typically collected in server logs or through analytics tools if you consent.
- Preference data: cookie choices stored in local storage, marketing preferences where applicable, and language settings.
We avoid collecting special categories of personal data unless you voluntarily include them in a message and we need them to respond fairly. If that happens, we treat the content with additional care and limit access to trained staff.
Sources of data
Most information comes directly from you. We may also receive technical data automatically when your device connects to our infrastructure. In rare cases we might receive a referral from a partner with your knowledge; in that situation the partner remains responsible for lawful collection until the data is transferred to us under an appropriate agreement.
Purposes and legal bases
We process personal information for specific purposes and only where a legal basis under the Privacy Act 2020 applies. Typical mappings include:
Responding to enquiries
We use identity, contact, and message content to answer questions you send. The basis is usually performance of steps at your request prior to a contract or our legitimate interests in operating a responsive service, balanced against your rights.
Fulfilling orders
We process name, address, and payment-related references to deliver goods or services. The basis is performance of a contract or steps taken at your request.
Security and fraud prevention
We analyse logs and patterns to protect systems and users. The basis is our legitimate interests in maintaining a secure online environment.
Analytics and marketing
Where we deploy optional analytics or marketing technologies, we rely on your consent obtained through the cookie interface. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Advertising and measurement
We may use online advertising platforms (including, where relevant, Google Ads) to reach people interested in our content or services. Those platforms may process pseudonymous identifiers, device or browser data, and conversion events to measure performance or to show more relevant ads after you have given any consent required under New Zealand law (including through our cookie banner for non-essential technologies).
We do not sell personal information for money. Where an advertising partner acts as our processor, we require a contract and appropriate safeguards under the Privacy Act 2020. Where a partner determines purposes and means independently, their privacy notice applies and we encourage you to read it.
You can manage ad personalisation for Google services via Google Ads Settings. Industry opt-out tools may also be available depending on your region. Refusing or withdrawing consent may mean you see less relevant ads; core site functions that do not rely on optional cookies will still work where technically possible.
Cookies and similar technologies
Our site uses strictly necessary mechanisms to remember your cookie preferences and maintain session integrity. Optional analytics or marketing cookies are described in our cookies policy and are only activated when you allow them. Browser settings can also limit tracking, though some site features may not work as expected if you block all storage.
Recipients and sharing
We share personal information with categories of recipients where required to operate the business:
- Hosting and infrastructure providers that store website files and databases in New Zealand or in jurisdictions with adequate privacy protections.
- Email and productivity services used to read and store correspondence.
- Payment service providers, who receive transaction details directly where you pay online.
- Advertising and analytics technology providers when you consent to optional cookies, including platforms we use to measure visits or run campaigns.
- Professional advisers such as accountants or lawyers when confidentiality obligations apply.
- Public authorities when we are legally required to disclose information.
We do not sell personal information in the sense of exchanging lists for money. If our corporate structure changes, we will inform you of any successor controller where required by law.
International transfers
Where personal information is transferred outside New Zealand, we implement appropriate safeguards such as standard contractual clauses, supplementary measures where recommended by the Privacy Commissioner, or reliance on jurisdictions with adequate privacy protections. Copies of relevant safeguards can be requested by contacting us using the details above.
Transfers to Australia currently benefit from mutual recognition under privacy law, subject to future legislative change. We monitor official guidance and update contracts when needed.
Retention periods
We retain personal information only as long as necessary for the purposes collected:
- Marketing and general correspondence: up to twenty-four months after the last inbound message unless a longer period is justified by an ongoing relationship or dispute.
- Contract and tax records: up to seven years where New Zealand tax and company law require retention, unless a shorter period applies to a specific record type.
- Server and security logs: typically ninety days, extended where needed to investigate incidents.
- Cookie preference records: stored in your browser until you clear site data or update choices.
When retention ends, we delete or anonymise data so that it can no longer identify you, except where statute requires archival storage in a non-active environment.
Security of processing
We implement technical and organisational measures appropriate to the risk, including access controls on a need-to-know basis, encryption in transit for services that support it, malware protection on endpoints used by staff, periodic review of vendor security practices, and training on data handling. No method of transmission over the Internet is completely secure; we work to reduce risk in proportion to the sensitivity of the information involved.
Your rights
Subject to applicable conditions, you may have the following rights under the Privacy Act 2020:
- Access: request a copy of personal information we hold about you.
- Correction: ask us to correct inaccurate or incomplete information.
- Deletion: request deletion where there is no overriding legitimate ground for continued processing.
- Restriction: ask us to limit processing in specific circumstances.
- Portability: receive certain information in a structured, commonly used, machine-readable format where processing is based on consent or contract and is automated.
- Objection: object to processing based on legitimate interests, including profiling in some cases.
- Withdraw consent: where processing is consent-based, without affecting lawfulness before withdrawal.
To exercise a right, email us with enough detail to verify your identity. We respond within one month in ordinary cases, extendable by two further months for complex requests, and we explain any refusal with reference to legal grounds.
Complaints and supervisory authority
If you believe we have processed your information unlawfully, please contact us first so we can investigate. You also have the right to lodge a complaint with the Office of the Privacy Commissioner in New Zealand.
Children
Our services are directed at adults. We do not knowingly collect personal information from children under sixteen without verifiable parental authority. If you become aware that a child has provided information without appropriate consent, contact us and we will take steps to delete it.
Changes to this policy
We may update this privacy policy to reflect legal, technical, or business developments. The hero section at the top of this page shows the current calendar date when you load it in your browser; substantive edits are also recorded in internal change logs. Material changes will be highlighted on the website or communicated directly when we have your contact details.
Contact
For privacy questions or to exercise your rights, write to Zelmaronvit, 160 Broadway, Newmarket, Auckland 1023, New Zealand, or email ask@zelmaronvit.world. Please include a description of your request and preferred reply channel.