Privacy Policy

How we collect, use, and protect your personal information.

Last updated:

1. Data Controller

The data controller responsible for your personal data is:

Refreshdyn
37 Domett Street, Westport 7825, New Zealand
Email: community@refreshdyn.world
Phone: +64 3 789 7043

2. Scope and Applicable Law

This Privacy Policy applies to all personal information collected through the website refreshdyn.world and related services offered by Refreshdyn. We are based in New Zealand and primarily comply with the Privacy Act 2020 and its Information Privacy Principles (IPPs). Where applicable, we also respect the rights of individuals under the General Data Protection Regulation (GDPR) and other international privacy frameworks.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the rights available to you under New Zealand law.

3. Information Privacy Principles

We handle personal information in accordance with the 13 Information Privacy Principles under the Privacy Act 2020, including:

IPP 1–4: We collect personal information only for lawful purposes connected with our educational website, directly from you where practicable, and in a fair manner that does not intrude unreasonably on your affairs.
IPP 5: We protect personal information with reasonable security safeguards against loss, misuse, and unauthorized access.
IPP 6–7: You may request access to and correction of your personal information held by us.
IPP 8–9: We take reasonable steps to ensure information is accurate and not kept longer than necessary.
IPP 10–11: We use and disclose personal information only for the purposes for which it was collected, unless an exception under the Privacy Act applies.
IPP 12: Before disclosing personal information to overseas recipients, we ensure appropriate safeguards as required by the Privacy Act 2020.
IPP 13: We do not assign unique identifiers to individuals unless necessary and permitted by law.

4. Data We Collect

4.1 Information you provide

When you contact us via the contact form, we collect:

Your name
Your email address
Your message content
Your consent to data processing

4.2 Automatically collected data

When you visit our website, we may automatically collect:

IP address (anonymized where possible)
Browser type and version
Operating system
Referring URL
Pages visited and time spent
Cookie preferences stored in localStorage

5. Purposes of Collection

We collect personal information for the following purposes:

Responding to inquiries submitted through our contact form
Operating and securing the website and its core functionality
Analytics, only where you have provided consent for analytics cookies
Marketing measurement, only where you have provided consent for marketing cookies, including measuring advertising campaign performance
Legal compliance with New Zealand and applicable international laws
Managing privacy requests and complaints

Providing contact form information is voluntary. If you choose not to provide required fields, we may be unable to respond to your inquiry.

For visitors in the European Economic Area, our legal bases under GDPR are: consent (Article 6(1)(a)), legitimate interests (Article 6(1)(f)), and legal obligation (Article 6(1)(c)) as applicable to each processing activity.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

Contact form submissions: 24 months from the date of submission, unless a longer period is required by law
Analytics data: 14 months from collection
Cookie consent records: 12 months from the date of consent
Server logs: 90 days

After the retention period expires, data is securely deleted or anonymized.

7. Data Sharing and Disclosure

We do not sell your personal information. We may disclose personal information to:

Hosting and infrastructure providers who store data on our behalf under contractual confidentiality obligations
Analytics and advertising measurement providers, only where you have given consent for the relevant cookies
Professional advisers where reasonably necessary
Law enforcement or regulatory bodies when required or authorized by New Zealand law

Any third-party service providers may only use personal information for the purposes we specify and must protect it with appropriate safeguards.

8. Overseas Disclosure

Some service providers we use may store or process personal information outside New Zealand. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient is subject to privacy safeguards comparable to those under the Privacy Act 2020, as required by IPP 12. This may include contractual protections, documented privacy commitments, or reliance on approved mechanisms under applicable law.

For individuals in the European Economic Area, where data is transferred outside the EEA, we implement appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

9. Your Rights Under New Zealand Law

Under the Privacy Act 2020, you have the right to:

Request access to personal information we hold about you
Request correction of personal information if you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading
Withdraw consent for processing based on consent, without affecting the lawfulness of prior processing
Complain to us or to the Office of the Privacy Commissioner if you believe we have interfered with your privacy

To make an access or correction request, contact us using the details in Section 1. We will respond within 20 working days, as required under the Privacy Act 2020, unless an extension is permitted by law. We may need to verify your identity before releasing information.

If you are located in the European Economic Area, you may also have additional rights under GDPR, including erasure, restriction of processing, data portability, and the right to object to certain processing. We will respond to GDPR requests within 30 days where applicable.

10. Complaints to the Privacy Commissioner

If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner (New Zealand):

Office of the Privacy Commissioner
PO Box 10 094, Wellington 6143, New Zealand
Phone: 0800 803 909 (New Zealand) / +64 4 474 7590
Website: www.privacy.org.nz

11. Notifiable Privacy Breaches

If we become aware of a privacy breach that is reasonably likely to cause serious harm to affected individuals, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, in accordance with the Privacy Act 2020 notifiable privacy breach scheme.

12. Direct Marketing and Electronic Messages

We do not send commercial electronic messages without your express consent, in compliance with the Unsolicited Electronic Messages Act 2007 (New Zealand). If we ever send marketing communications, they will include a clear unsubscribe mechanism and identify Refreshdyn as the sender.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

HTTPS encryption for all data transmission
Access controls limiting data access to authorized personnel
Regular security assessments of our systems
Encrypted storage for sensitive data
Incident response procedures for data breaches

14. Children's Privacy

Our website is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will take steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

16. Contact

For privacy-related questions or to exercise your rights:

Refreshdyn
37 Domett Street, Westport 7825, New Zealand
Email: community@refreshdyn.world
Phone: +64 3 789 7043