Privacy Policy
How SouthStack collects, uses, and protects your personal information.
1. Overview
SouthStack Limited ("SouthStack", "we", "us") is committed to protecting the privacy of individuals in accordance with the Privacy Act 2020 (NZ). This policy explains how we collect, use, and protect personal information.
2. What Information We Collect
Information you provide directly:
- Name, email address, and phone number from contact forms or emails
- Business name and address for invoicing
- Project briefs and content you share with us
Information collected indirectly (IPP 3A):
We may collect personal information about you indirectly, including through:
- Website analytics (page visits, device type, location) via tools such as Google Analytics
- Referrals from third parties such as business partners or clients
- Publicly available sources such as LinkedIn or business directories
Where information is collected indirectly, we will inform you of this collection as soon as practicable, unless doing so would prejudice the purposes of collection.
3. How We Use Your Information
- To deliver and communicate about services you have engaged us for
- To send invoices and process payments
- To respond to enquiries
- To improve our services and website
- To comply with legal obligations
4. Cookies & Tracking
Our website uses cookies for analytics and functionality. We will not deploy tracking or advertising scripts without your consent. A cookie consent banner is presented on your first visit to our website in accordance with the Privacy Act 2020.
5. Sharing Your Information
We do not sell your personal information. We may share it with:
- Payment processors (Stripe, POLi) to process transactions
- Accounting software (Xero) for invoicing and record-keeping
- Cloud storage providers (Google Workspace) for document management
- Legal or regulatory authorities if required by law
6. Storage & Security
Your information is stored securely using industry-standard tools including encrypted cloud storage and password management. We retain personal information only for as long as necessary for the purposes it was collected, or as required by law.
7. Data Retention
Client project files and communications are retained for 7 years for tax and legal compliance purposes. Credentials and access details are deleted within 7 days of project handover. You may request deletion of your information at any time, subject to legal retention obligations.
8. Your Rights
Under the Privacy Act 2020, you have the right to:
- Request access to personal information we hold about you
- Request correction of inaccurate information
- Make a complaint to the Privacy Commissioner at privacy.org.nz
9. Contact
For privacy enquiries, contact us at hello@southstack.co.nz.
10. Updates
This policy is reviewed annually. The current version is always available at southstack.co.nz/privacy. Last updated: April 2026.