Privacy policy

1. Who we are and what this policy covers

Mt Atkinson Coffee (“we”, “us”, “our”) is a specialty coffee roastery and café based at 44b Portage Road , New Lynn Auckland, New Zealand. This policy explains what personal information we collect when you visit or buy from our online store, why we collect it, who we share it with, and the rights you have over it under New Zealand law.

This policy applies to our Shopify store and any related apps we use to run it, listed in Section 5 below.

2. What information we collect

When you purchase something from our store, we collect the personal information you give us as part of the buying and selling process  such as your name, address, email address, and phone number.

When you browse our store, we also automatically receive your computer’s IP address, along with information about your browser, device, and how you interact with the site (for example, pages viewed and items added to cart), which helps us understand how customers use the store and improve it.

Email and SMS marketing (if applicable): with your permission, we may send you emails or texts about our store, new products, and other updates, using the marketing platform named in Section 5.

3. Consent

How do you get my consent?

When you provide personal information to complete a transaction: verify a card, place an order, arrange delivery, or process a return we take it that you consent to us collecting and using that information for that specific reason only.

If we want to use your information for a secondary reason, like marketing, we’ll either ask for your express consent directly, or give you a clear opportunity to opt out.

How do I withdraw my consent?

If you change your mind after opting in, you can withdraw your consent for us to contact you, or to continue collecting, using, or disclosing your information, at any time, by contacting us at digital@mtatkinson.co.nz or by mail at:

Shop | Mt Atkinson Coffee
44b Portage Road, New Lynn  Auckland, New Zealand 0604

4. How we disclose your information

We may disclose your personal information where we are required to by law, where you’ve breached our Terms of Service, or where it’s shared with the service providers listed in Sections 5 and 6 in order to run our store, process payments, ship orders, or deliver marketing you’ve opted into.

5. Third-party apps we use

Our store uses the following third-party apps to operate. Each provider only receives the information it needs to perform its specific function, and each has its own privacy policy governing how it handles that information.

App / Service	What it does	What we collect / share with it
Klaviyo	Email and SMS marketing automation	Your name, email, phone number (if provided), and your browsing, cart, and purchase activity on our store, used to send targeted marketing messages and build a marketing profile. You can unsubscribe at any time via the link in any email or by contacting us.
ReCharge	Subscription billing for recurring orders	Your billing and delivery details, recurring payment authorisation, and subscription schedule, used solely to process and manage your subscription orders.
Judge.me	Collects and displays product reviews	Your email address, used to send a review request after purchase, and any review content, star rating, or photos you choose to submit, which may be displayed publicly on our store.
Monster Cart	In-cart upsells, volume discounts, and free-gift offers	The contents of your cart and your on-site browsing behaviour, used to trigger relevant offers, progress bars, and upsell prompts while you shop.

 

We may add, remove, or change these apps from time to time as our store evolves. Where a new app materially changes how your information is handled, we’ll update this policy.

6. Shopify and other third-party services

Our store is hosted on Shopify Inc., which provides the e-commerce platform we use to sell to you. Your data is stored through Shopify’s data storage, databases, and application, on secure servers behind a firewall.

Payment

If you choose a direct payment gateway, Shopify stores your card data, encrypted in line with the Payment Card Industry Data Security Standard (PCI-DSS). Your transaction data is stored only as long as necessary to complete the transaction, then deleted. All direct payment gateways adhere to PCI-DSS standards, managed by the PCI Security Standards Council (a joint effort of Visa, Mastercard, American Express, and Discover).

Other third-party providers

Third-party providers we use, including those listed in Section 5, only collect, use, and disclose your information to the extent needed to perform the services they provide us. Some, such as payment processors, have their own privacy policies covering information we’re required to give them for your purchase — we recommend reading those directly.

Links

Links on our store may take you to third-party sites. We’re not responsible for their privacy practices and encourage you to read their own privacy statements.

7. Overseas disclosure

Several of the providers in Section 5 and 6  including Shopify, Klaviyo, ReCharge, and Judge.me store or process data on servers located outside New Zealand, principally in the United States. This means your personal information may become subject to the laws of that jurisdiction while it’s held there.

Under the New Zealand Privacy Act 2020, we only send your information overseas where the receiving provider is subject to privacy laws providing comparable safeguards to New Zealand’s, or has otherwise agreed to protect your information to a comparable standard — which each of the providers above does through their own data processing terms.

8. Security

We take reasonable precautions and follow industry best practice to make sure your personal information is not inappropriately lost, misused, accessed, disclosed, altered, or destroyed.

Credit card information is encrypted using secure socket layer technology (SSL) and stored with AES-256 encryption. No method of transmission over the internet or electronic storage is 100% secure, but we follow all PCI-DSS requirements and other generally accepted industry standards.

Data breach notification

If a privacy breach occurs that we reasonably believe has caused, or is likely to cause, serious harm to you, we’ll notify you and the Office of the Privacy Commissioner as required under the Privacy Act 2020.

Data retention

We only keep personal information for as long as we need it for the purpose it was collected typically the duration of our business relationship with you, plus any period required to meet our legal, accounting, or tax obligations.

9. Cookies and tracking

Here are the cookies we use. We’ve listed them so you can choose whether to opt out.

●      _session_id — unique token, sessional. Allows Shopify to store information about your session (referrer, landing page, etc).

●      _shopify_visit — no data held, persists 30 minutes from your last visit. Used by Shopify’s internal stats tracker to record visits.

●      _shopify_uniq — no data held, expires midnight (relative to you) the next day. Counts visits to the store by a single customer.

●      cart — unique token, persistent for 2 weeks. Stores the contents of your cart.

●      _secure_session_id — unique token, sessional.

●      storefront_digest — unique token, indefinite. If the shop has a password, used to determine whether the current visitor has access.

●      Klaviyo tracking cookies/pixels — used to track browsing and email engagement for marketing personalisation. See Klaviyo’s privacy policy for details.

●      Monster Cart tracking — used to track cart contents and on-site behaviour to trigger in-cart upsell offers.

You can control or delete cookies through your browser settings. Blocking some cookies may affect how the store functions, for example your cart may not be saved between visits.

10. Your rights under the Privacy Act 2020

Under New Zealand’s Privacy Act 2020, you have the right to:

●      Ask us what personal information we hold about you, and request a copy of it.

●      Ask us to correct any information that’s wrong or out of date.

●      Withdraw your consent to marketing communications at any time (see Section 3).

●      Make a complaint about how we’ve handled your information, first to us and, if unresolved, to the Office of the Privacy Commissioner (www.privacy.org.nz).

To exercise any of these rights, contact our Privacy Compliance Officer using the details in Section 12.

11. Age of consent

By using this site, you confirm that you are of the age of majority in your state, province, or country of residence, or that a parent or guardian has consented on your behalf if you are a minor dependant using this site.

12. Questions and contact information

If you’d like to access, correct, amend, or delete any personal information we hold about you, register a complaint, or simply want more information, contact our Privacy Compliance Officer:

Emily — Privacy Compliance Officer
Mt Atkinson Coffee
44b Portage Road, Auckland, New Zealand 0604
emily@mtatkinson.co.nz

13. Changes to this policy

We may modify this privacy policy at any time, so please check back periodically. Changes take effect immediately once posted. If we make material changes, we’ll let you know here so you’re aware of what we collect, how we use it, and under what circumstances we disclose it.

If our store is acquired or merges with another company, your information may transfer to the new owners so we can continue serving you.