Privacy Policy

1. Overview

SouthStack Limited ("SouthStack", "we", "us") is committed to protecting the privacy of individuals in accordance with the Privacy Act 2020 (NZ). This policy explains how we collect, use, and protect personal information.

2. What Information We Collect

Information you provide directly:

• Name, email address, and phone number from contact forms or emails
• Business name and address for invoicing
• Project briefs and content you share with us

Information collected indirectly (IPP 3A):

We may collect personal information about you indirectly, including through:

• Website analytics (page visits, device type, location) via tools such as Google Analytics
• Referrals from third parties such as business partners or clients
• Publicly available sources such as LinkedIn or business directories

Where information is collected indirectly, we will inform you of this collection as soon as practicable, unless doing so would prejudice the purposes of collection.

3. How We Use Your Information

• To deliver and communicate about services you have engaged us for
• To send invoices and process payments
• To respond to enquiries
• To improve our services and website
• To comply with legal obligations

4. Cookies & Tracking

Our website uses cookies for analytics and functionality. We will not deploy tracking or advertising scripts without your consent. A cookie consent banner is presented on your first visit to our website in accordance with the Privacy Act 2020.

5. Sharing Your Information

We do not sell your personal information. We may share it with:

• Payment processors (Stripe, POLi) to process transactions
• Accounting software (Xero) for invoicing and record-keeping
• Cloud storage providers (Google Workspace) for document management
• Legal or regulatory authorities if required by law

6. Storage & Security

Your information is stored securely using industry-standard tools including encrypted cloud storage and password management. We retain personal information only for as long as necessary for the purposes it was collected, or as required by law.

7. Data Retention

Client project files and communications are retained for 7 years for tax and legal compliance purposes. Credentials and access details are deleted within 7 days of project handover. You may request deletion of your information at any time, subject to legal retention obligations.

8. Your Rights

Under the Privacy Act 2020, you have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate information
• Make a complaint to the Privacy Commissioner at privacy.org.nz

9. Contact

For privacy enquiries, contact us at hello@southstack.co.nz.

10. Updates

This policy is reviewed annually. The current version is always available at southstack.co.nz/privacy. Last updated: [DATE].