GDPR Information

Effective Date: January 15, 2026

1. Introduction

This page provides information about how we comply with the General Data Protection Regulation (GDPR) for visitors and customers located in the European Economic Area (EEA). While we are based in New Zealand, we respect the data protection rights of all individuals, including those protected under GDPR.

2. Data Controller

For the purposes of GDPR, the data controller is:

ochre-tide.cyou

47 Harewood Road
Christchurch 8053
New Zealand

Email: [email protected]

3. Legal Basis for Processing

We process personal data under the following legal bases as defined by GDPR:

3.1 Consent (Article 6(1)(a))

For marketing communications and certain optional features, we rely on your explicit consent. You may withdraw consent at any time.

3.2 Contract Performance (Article 6(1)(b))

Processing necessary to fulfil our contractual obligations when you order services or subscriptions from us.

3.3 Legal Obligation (Article 6(1)(c))

Processing required to comply with legal obligations, including tax and accounting requirements.

3.4 Legitimate Interests (Article 6(1)(f))

Processing necessary for legitimate business interests, such as fraud prevention, network security, and service improvement, provided these interests do not override your fundamental rights.

4. Your Rights Under GDPR

If you are located in the EEA, you have the following rights:

4.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and to access that data along with specific information about the processing.

4.2 Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and completion of incomplete personal data.

4.3 Right to Erasure (Article 17)

You have the right to request deletion of your personal data under certain circumstances, including when the data is no longer necessary for the purposes collected or when you withdraw consent.

4.4 Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing under certain circumstances, such as when you contest the accuracy of the data.

4.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

4.6 Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

4.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently engage in automated decision-making.

4.8 Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

5. Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, though this may be extended by two additional months for complex requests. We will inform you of any extension within the initial one-month period.

We may request specific information from you to confirm your identity before processing requests.

6. Data Protection Officer

Given the scale and nature of our operations, we are not required to appoint a dedicated Data Protection Officer. However, privacy-related enquiries should be directed to [email protected]

7. International Data Transfers

Your personal data may be transferred to and processed in New Zealand. While New Zealand is not covered by an EU adequacy decision, we implement appropriate safeguards to ensure your data receives adequate protection:

• Standard contractual clauses approved by the European Commission
• Technical and organisational security measures
• Adherence to data protection principles consistent with GDPR

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations. Specific retention periods include:

• Customer account data: Duration of relationship plus 2 years
• Transaction records: 7 years for accounting and tax purposes
• Marketing data: Until consent is withdrawn or the data becomes outdated
• Technical logs: 12 months

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and within 72 hours of becoming aware of the breach, where feasible. The notification will include:

• Nature of the breach
• Categories and approximate number of affected individuals
• Likely consequences of the breach
• Measures taken or proposed to address the breach

10. Cookies and Tracking

We use cookies and similar technologies on our website. For detailed information about the cookies we use and your choices, please see our Cookies Policy.

11. Third-Party Data Processors

We work with third-party service providers who process personal data on our behalf. All processors are carefully selected and bound by data processing agreements that require them to:

• Process data only on our documented instructions
• Implement appropriate technical and organisational security measures
• Assist with responding to data subject rights requests
• Delete or return data at the end of the service relationship

12. Children's Data

We do not knowingly collect or process personal data from children under 16 years of age without parental consent. If you believe we have inadvertently collected such data, please contact us immediately.

13. Complaints

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. For EEA residents, this is typically the authority in your country of residence. You can find contact details for EU supervisory authorities at: https://edpb.europa.eu

14. Updates to This Information

We may update this GDPR information from time to time. Significant changes will be communicated through our website and, where appropriate, via email to registered users.

15. Contact Us

For any questions about our GDPR compliance or to exercise your rights, please contact:

Email: [email protected]
Address: 47 Harewood Road, Christchurch 8053, New Zealand