Privacy Policy

What personal information we collect

We collect only what we need to run the site and respond to you. In practice that is limited to:

• Contact-form and email submissions — if you use our contact form or email us, we collect your name, email address and the content of your message. Providing this is voluntary, but we cannot reply without it.
• Analytics and cookies — when you browse the site we collect de-identified usage data through privacy-respecting analytics: pages viewed, approximate region, device and browser type, and how you arrived. This is aggregated and is not used to identify you personally.
• Server logs — our hosting provider automatically records standard technical data such as your IP address, request time, the page requested and your user-agent string. These logs help us keep the site secure and diagnose faults.

We do not ask for, and have no reason to collect, sensitive information such as financial account details, identity documents or gambling history. Please do not send that kind of information to us.

Why we collect it and our purpose

Under IPP 1, we only collect personal information for a lawful purpose connected with running VapeMate. Specifically, we use the information above to reply to your enquiries, to understand which guides are useful so we can improve them, to keep the website secure and available, and to meet our legal obligations. We do not use your information to make automated decisions about you, and we do not profile individual visitors.

Cookies and third-party analytics

Cookies are small text files stored by your browser. We use a small number of them to remember your preferences and to measure traffic. Our analytics provider may set cookies or similar identifiers to count visits, but we configure it to minimise the personal data collected and to respect "do not track" style signals where supported. You can block or delete cookies in your browser settings at any time; the site will still work, though some preferences may not be remembered. For more detail, see our Cookie Policy.

We never sell your data

We do not sell, rent or trade your personal information to anyone, and we never will. We do not build advertising profiles from your visit and we do not pass your contact details to gambling operators or marketing lists.

Disclosure to others

We keep disclosure to the minimum needed to operate (IPP 11). We may share information with the trusted service providers who host our website, deliver our email and provide our analytics, strictly so they can perform those services for us. Those providers are bound to protect the data and use it only on our instructions. We may also disclose information if we are required to by New Zealand law, a court order or a lawful request from a regulator, or where it is necessary to protect someone's safety or our legal rights.

Where your information is stored and how we secure it

Our website and analytics are delivered through global hosting infrastructure, so some data (such as server logs) may be processed on servers outside New Zealand. Where information is held or processed overseas, we take reasonable steps to ensure it has comparable protection to that required under the Privacy Act 2020, consistent with IPP 12. We apply reasonable safeguards (IPP 5) including HTTPS encryption in transit, access controls that limit who can see contact-form messages, and keeping our software up to date. No system is perfectly secure, but we work to protect your information against loss, misuse and unauthorised access.

How long we keep it (retention)

We do not keep personal information longer than we need it. Contact-form and email correspondence is retained only while it is useful to resolve your enquiry and for a reasonable period afterwards for our records, then deleted. Aggregated analytics data is retained in de-identified form. Server logs are rotated and overwritten by our host on a short cycle.

Your rights to access and correct your information

Under IPP 6 and IPP 7 of the Privacy Act 2020 you have the right to ask us whether we hold personal information about you, to be given access to it, and to request that we correct anything that is wrong or out of date. To make a request, email privacy@vapemate.co.nz. We will respond as soon as reasonably practicable and within 20 working days, as the Act requires. There is no charge for a standard request. We may need to confirm your identity before releasing information so that we do not disclose it to the wrong person.

Complaints and the Privacy Commissioner

If you believe we have mishandled your personal information, please contact us first at privacy@vapemate.co.nz so we can try to put it right. If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner, which oversees the Privacy Act 2020. You can reach the Commissioner at privacy.org.nz or on 0800 803 909.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or the law. When we do, we will revise the "last updated" date at the top of this page. Significant changes will be made clear. Continuing to use VapeMate after an update means you accept the revised policy.

Contact us about privacy

Questions about this policy, or any privacy request, can be sent to privacy@vapemate.co.nz. You can also reach us through our contact page.