1. Introduction
Waitapu Group Limited, trading as Stanley Marketing, is the agency responsible for personal information it collects or holds for this business. Company number: 3240248. NZBN: 9429031253055. Our address is 18 Stanley Street, Auckland, New Zealand.
This policy explains our website's current enquiry process and our responsibilities under the Privacy Act 2020. The site lets you browse, build a cart and prepare an enquiry. It does not submit enquiries automatically, create an order, collect card details or take payment. Services arranged separately may require additional project-specific privacy information.
2. Collection of Personal Information
Information you choose to share
If you send us an enquiry or arrange a service, we receive the information you provide. This can include your name, email, optional phone and business details, selected services, project brief, preferred timing and any marketing preference you choose to share. An agreed job may also require billing or project information; we will explain what is needed.
Providing information is voluntary and not required by law merely to browse or enquire. If you provide insufficient contact or project details, we may be unable to respond, quote or provide the requested work. Please leave out card details, passwords and personal information that is unnecessary for the enquiry.
Checkout and contact forms
Details you type are held in the current page's memory so you can review them. Our site code does not save your name, email, phone, business name, brief or marketing preference in browser storage or send them to a server. Your browser may independently retain, restore, autofill or sync form values under its settings.
“Copy enquiry” puts your text on your device's clipboard only when selected. “Open email draft” passes the draft to your email app only when selected. You decide whether to send it. Your email or clipboard provider may handle that information under its own settings and policy. We receive the enquiry when you send or otherwise share it with us.
Cart and hosting information
Your browser tab's session storage holds cart choices: service, package and add-on identifiers and quantities. It keeps those selections as you move between pages or reload; it does not contain your contact details or brief. Browser session-restoration settings may preserve a tab's cart.
Vercel hosts the site and may process technical request information, such as IP address, browser or device information and request logs, to deliver, operate and protect the site. This is separate from the enquiry details you type. The site has no customer accounts or automatic uploads.
Information about other people
We normally collect information directly from the person concerned. If we collect it indirectly for our own purposes, there must be a lawful basis for doing so. We will take reasonable steps to give that person the notice required by information privacy principle 3A as soon as reasonably practicable, unless a lawful exception applies. A client's permission or this policy alone does not replace that obligation.
If a project requires us to process a client's personal information only on its behalf and instructions, we will agree those roles and the permitted processing separately. We remain responsible for obligations that apply to us.
3. Use of Personal Information
We use information received for purposes connected with the enquiry or agreed service:
- Responding, discussing your needs and preparing or managing a quote.
- Delivering agreed work and providing support.
- Administering an agreed job, invoices, refunds and related records.
- Maintaining website operation and security, meeting legal obligations and resolving complaints or disputes.
We take reasonable steps to ensure information is accurate, current, complete, relevant and not misleading before using or disclosing it. A materially different use requires a lawful basis; accepting website terms does not authorise unrestricted reuse.
Marketing messages
An enquiry does not automatically subscribe you to marketing. The optional checkout marketing choice is unchecked by default and is only conveyed to us if you send the enquiry. We send promotional messages only where we have the consent or other basis required by law. Messages identify the sender and provide a working unsubscribe method. We will action an unsubscribe within five working days. Service replies are separate from promotional subscriptions.
4. Disclosure and Overseas Processing
We do not sell personal information. Access or disclosure is limited to what is needed for a lawful purpose, including authorised staff or contractors working on the enquiry or job, service providers supporting that work, and disclosures required or otherwise permitted by the Privacy Act or other applicable law. Sharing with another Waitapu Group business requires its own lawful basis; group membership alone is not permission.
Vercel is the website host and may process technical information outside New Zealand. Its Privacy Notice explains its handling of that information. Communications and project tools may also involve overseas processing; relevant providers and arrangements must be identified before using them for project personal information.
Where a provider processes information solely as our agent and does not use it for its own purposes, we remain responsible for the information. Where information is disclosed to an overseas recipient for its own purposes, we must have a lawful basis for disclosure and meet information privacy principle 12 where it applies, for example through comparable legal protection or enforceable contractual safeguards. This policy is not blanket consent to an overseas disclosure.
AI, chatbots and other project systems
This website does not send enquiry text to AI tools or run a live chatbot, AI receptionist, recording system or payment processor. Before an agreed project uses such tools with personal information, we will explain the intended collection, use, recipients and relevant overseas arrangements, and agree the responsibilities and safeguards. We will not treat this policy as permission to feed customer information into any AI tool for any purpose.
5. Security and Privacy Breaches
The Privacy Act requires reasonable safeguards against loss, unauthorised access, use, modification or disclosure and other misuse. Safeguards must suit the information and its risks, including when a provider processes it for us. We must also take reasonable steps to prevent unauthorised use or disclosure when information is given to a person providing services for us.
The public site uses HTTPS. Its code keeps enquiry fields in page memory and does not automatically transmit them. No online system offers absolute security; this does not remove our duty to take reasonable safeguards. Please do not send unnecessary sensitive information.
If we become aware of a breach that has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner as soon as practicable. We will also notify affected individuals as soon as practicable, or give public notice where the Act requires it. Any lawful exception or delay in notifying affected individuals will be assessed under the Act. We will take steps to contain the breach and address its effects.
6. Access and Correction
You can request access to personal information we hold about you and ask for a correction. Contact [email protected] and mark your request “Privacy”. We may reasonably verify your identity or authority, without collecting unnecessary information.
We will decide on your access or correction request and notify you as soon as reasonably practicable and within 20 working days, unless a lawful extension applies. If we extend the period, we will notify you within the initial 20 working days of the extension's length or new decision date, its reason and your complaint rights. Where access is granted, we will provide it without undue delay. For Privacy Act requests, working days have the statutory meaning, including the exclusion of 25 December through 15 January inclusive.
Any refusal or withholding must have a lawful basis. We will explain the decision, reasons and right to complain where required by law. If we do not make a requested correction, you may ask us to attach a statement of that correction. We will take reasonable steps to attach it so it is read with the information. Where reasonably practicable, we will inform previous recipients of a correction or statement.
7. Retention
We must not keep personal information longer than required for a lawful purpose. Retention depends on its purpose, the agreed job and any legal requirements, such as financial record obligations. We will delete or anonymise information when it is no longer lawfully needed. Financial records may need to be kept longer than an enquiry or creative brief.
Enquiry fields are not written to persistent storage by this site. Cart choices use tab session storage; browser session restoration may preserve them. Copies you make, email drafts you open and information you send may remain in your own devices, email systems or recipients' records. Those are distinct from the site form.
For information processed only on a client's behalf, retention, return and deletion arrangements will be agreed for that project and remain subject to applicable law.
8. Cookies and Browser Storage
This website does not install advertising trackers, analytics scripts or marketing cookies. It uses browser session storage for the cart as described in section 2. Hosting-related technical processing is described in sections 2 and 4.
You can clear site data or restrict storage in your browser settings; doing so may clear the cart or stop it working across pages. Third-party sites you choose to visit may use their own cookies or tracking.
9. Third-Party Links
Opening an external website or email app involves that provider's services and privacy practices. Review its policy before sharing information. External links do not authorise us to disclose information beyond the law and do not reduce our responsibility for our own handling of it.
10. Changes to This Privacy Policy
We may update this policy as the site or lawful practices change. The current version and update date are published here. An update is not itself consent to a new use or disclosure. We will give any notice required by law and establish a lawful basis before new processing.
If online payments, automatic enquiry submission, analytics or other new processing is introduced, the relevant privacy information must be updated and provided before that processing starts.
11. Contact Us
For privacy questions, access or correction requests, or complaints, email [email protected] and mark your message “Privacy” for the person responsible for privacy.
Waitapu Group Limited, trading as Stanley Marketing.
Company number: 3240248. NZBN: 9429031253055.
Address: 18 Stanley Street, Auckland, New Zealand.
12. Privacy Complaints
Please contact [email protected] if you are concerned about our handling of personal information. We will investigate and respond within a reasonable timeframe.
If we cannot resolve your concern, you can complain to the Office of the Privacy Commissioner. You can also contact it for information about your privacy rights. Our internal complaint process does not remove your rights under the Privacy Act.