1. Manuka Health New Zealand Limited (we, usor our) is a leading New Zealand natural health company. We manufacture and sell New Zealand bee products in a range of countries.
2. When we operate our business and our websites, we collect, store, process, use and disclose personal information belonging to a range of people. These include our customers, suppliers, people visiting our website and people engaging with us (youor your).
3. Personal information (sometimes called personal data) is information about an identifiable individual. We are committed to protecting your personal information and meeting our privacy obligations and all privacy-related laws.
4. This Privacy Policy sets out how we store, process, use and disclose the personal information that we may collect when you use:

• any websites or applications operated by us;
• our social media sites and applications such as Facebook, Instagram, Pinterest, Twitter and TikTok;
• our services to purchase our products from us; or
• our services to engage with us.

5. This Privacy Policy applies to all personal information submitted to or collected by us or any third party providers engaged by us for the purpose of conducting our business (Third Party Providers). By submitting personal information to us (including by purchasing our products), you accept the terms of this Privacy Policy, and you consent to collection, use, disclosure and retention of personal information by us or any Third Party Providers as described in this Privacy Policy.
6. If you provide us with any personal information that relates to another individual, you must ensure that you have all necessary consents from that individual to allow us to use that information in accordance with this Privacy Policy.
7. You should read this Privacy Policy carefully and contact us if you have any queries about it.

The types of information we collect

8. We may obtain a wide range of personal information from you when you engage with us.
9. The personal information we collect includes, but is not limited to:

• your name, email address, delivery address, phone number and/or other contact details if you provide these to us;
• your personal preferences of products you have looked at on our websites or orders of products you have made from our websites;
• your payment information, such as your credit card or billing details, if you make an order from our websites or through our customer service representatives;
• your current location when you use our websites;
• information about your use of our websites, including the time you use or visit our websites, how long you use our websites and what pages you view within our websites;
• information about the device you use to access our websites, including your IP address and information about your device;
• survey information and spend data for our loyalty programmes; and
• any other personal information you otherwise provide to us.

10. We collect personal information in a number of ways, including but not limited to:

• when you browse our websites, make enquiries or place orders for our products;
• when you email us or send us messages via our websites, email or our social media sites and applications;
• when you phone us, as telephone conversations with our staff may be recorded;
• when you complete surveys or questionnaires about us or our products;
• when you provide a product or service to us or otherwise work for or with us;
• when you enter any promotions or competitions run by us; and
• in face-to-face meetings with you or at events or conferences.

How we use the personal information we collect

11. We may use your personal information for a variety of reasons and purposes, including but not limited to:

• responding to your enquiries about us or our products;
• taking orders for our products from you and fulfilling those orders;
• measuring, managing, monitoring, developing and improving our websites and services;
• contacting you about our websites, any orders you make or products you may be interested in;
• sending you promotions or special offers from us that we think you may be interested in, including sending electronic messages such as text messages and emails;
• preparing and using data about interest in our products; and
• doing anything else required or permitted by laws, rules or regulations.

12. Where we or our service providers collect information about your computer and its interaction with our websites, we may use "cookies". Cookies are small files of data sent by a website to your browser, which may then be stored on your hard drive or device so we can recognise you when you return. We use cookies for a number of purposes, including to:

• better understand your preferences, including for our products, so that we may enhance your online experience by presenting you with content that is relevant to you;
• improve our products and services; and
• monitor the use of our website, including collecting data on web traffic and activity, to operate it more efficiently and functionally.

Certain of our online store services are provided by our service provider Shopify. Shopify may use cookies to enable store functionality, such as keeping track of your online shopping cart. You may access Shopify’s cookie policy at: https://www.shopify.com/legal/cookies.

13. You may adjust your browser settings to notify you when you receive a cookie and, if you wish, to reject it. If you do reject our use of cookies, you may be unable to access certain parts of our Website.

Who we disclose personal information to

14. We may share your personal information with our Third Party Providers for a range of reasons including:

• managing and operating our websites;
• taking and fulfilling orders made by you for our products;
• marketing or advertising our products to you;
• conducting surveys about our products and our business;
• to enable those third parties to provide services to us in connection with the websites, our advertising or to operate our business;
• to improve our operations, products and services;
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government or law enforcement agency request;
• if we are selling, assigning or transferring any of our assets or business;
• if the third party is one of our related companies;
• as otherwise expressly permitted under this Privacy Policy; and
• where we are permitted to do so under any applicable laws or regulations.

Our providers may also have privacy policies relevant to your personal information. For example, if you order products from us on our online store, our service provider Shopify may collect and process information on our behalf to fulfil your order. Shopify's collection and processing of that information is also subject to its own privacy policy, which may be found at: https://www.shopify.com/legal/privacy.

Transferring and storing personal information

15. We may store and transfer your personal information in different countries, including to third parties in those countries. Countries include Australia, Canada, New Zealand and the US. Whenever we do this, we take steps to make sure your personal information is protected and we meet our legal obligations. We do this to provide our products and services, including for transaction processing and fraud prevention.
16. You acknowledge and agree to such international transfers and storage of your personal information for the purposes set out in this Privacy Policy.

Security of your personal information

17. We take reasonable precautions to make sure that we keep your personal information secure. However, because the internet is an open network, we cannot warrant or guarantee that your personal information is safe from unauthorised access or use when you engage with us.
18. Where you have authorised us to disclose your personal information to a Third Party Provider, we will take reasonable precautions to ensure your personal information is treated securely by them and maintained in accordance with this Privacy Policy.
19. You acknowledge and understand that our websites are not designed for the processing of sensitive or special categories of personal information, or data that is subject to special regulatory schemes, such as protected health information under relevant legislation. You are responsible for risks that may arise if you enter this kind of information into a search field or take other actions that create or submit information of this type for processing by us or any Third Party Providers.

What we do if there is a privacy breach relating to your personal information

20. If we believe that there has been a privacy breach involving your personal information, we will identify the issue and take steps to minimise any harm.
21. If we believe that the breach has caused, or is likely to cause, serious harm, we will contact the appropriate regulator and take all steps to meet our legal obligations. If appropriate, we will also contact you and anyone else affected by this privacy breach.
22. If you believe there may have been a privacy breach, please contact us as soon as possible.

Communications with you

23. We will (and any authorised Third Party Provider may) send you emails throughout the ordering and purchasing process.
24. We will send out promotional material in our newsletters promoting material related to our company and our business. We use email as a means of receiving feedback from you, and we encourage you to email us with your questions or comments.
25. We will preserve the content of any email you send us if we believe we have the legal requirement to do so. Your email message content may be monitored by us for trouble shooting or maintenance purposes or if any form of email abuse is suspected.
26. From time to time we may send you, and you agree to receive, emails, SMS and other promotions relating to services or goods offered by us and our related companies, partners and customers.
27. You consent to share you information in relation to our SMS marketing service. We use this information to send you text notifications (for your order, including abandoned checkout reminders), text marketing offers, and transactional texts, including requests for reviews from us.
28. Our website uses cookies to keep track of items you put into your shopping cart, including when you have abandoned your checkout. This information is used to determine when to send card reminder messages via SMS.
29. You may opt out of receiving those emails, SMS notifications and other promotions at any time by following the opt-out instructions provided in the relevant communication.

Accessing or correcting your personal information

30. You may request access to your personal information that is held by us at any time.
31. If you believe any of your personal information is incorrect or inaccurate you may request us to correct it at any time.

Updating and amending this Privacy Policy

32. The current version of this Privacy Policy posted on our websites will apply to your use of our websites and our use of your personal information.
33. There may be times when we need to change this Privacy Policy. Depending on how significant the changes are, we will tell you about these changes by putting a notice on our websites or by contacting you. Any changes will take effect from when we publish the updated Privacy Policy, so please check our Privacy Policy and our websites from time to time.
34. Our websites may contain links to third party websites or applications. We are not responsible for the privacy practices or content of third party websites or applications.

What about if you're in Europe?

Addendum – European Union General Data Protection Regulation ("GDPR")

38. This Addendum applies to the collection and processing by us of your personal data (Personal Data) in accordance with this Privacy Policy if you are located in a country that is a member of the European Economic Area (EEA); being either a member state of the European Union or the European Free Trade Association. It explains particular rights you have in relation to the processing of your Personal Data in addition to those already set out above in this Privacy Policy.
39. Manuka Health New Zealand Limited is a data controller for our Website, services provided through our websites, and all other services provided by us.
40. Manuka Health New Zealand Limited may process your data under the following legal bases:
    • you have given consent to the processing of your personal data for one or more specific purposes;
    • processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract;
41. If you are in a country that is a member of the EEA, you have the following additional rights in relation to your Personal Data held by us:

• Right to access and rectification of your information: you have the right to access your Personal Data that we are processing and, to the extent the Personal Data is incorrect or incomplete, to have the Personal Data corrected or supplemented.
• Right to erasure of your information: you have, in certain circumstances, the right to request that the Personal Data that we collect from you is erased. If we refuse any request you make in relation to this right, we will tell you why in writing and how you can make a complaint about our decision.
• Right to object to or restrict processing of your information:you may request that further processing of your Personal Data is restricted in certain circumstances, including while we investigate your concerns with this information.
• Right to object to data processing and right to data portability:you have in certain circumstances the right to request that the further processing of your information is restricted or to object to its processing and the right to data portability (to receive and have transferred the information provided). If we refuse any request you make in relation to this right, we will write to you to explain why and how you can make a complaint about our decision.
• Right to withdraw consent: you may withdraw consent where provided or object to the further processing of your Personal Data under certain circumstances. If we refuse any request you make in relation to this right, we will write to you to explain why and how you can make a complaint about our decision. The withdrawal of your consent will not affect the lawfulness of the processing of your information before your withdrawal of consent.
• Right to lodge a complaint: you have a right to lodge a complaint concerning processing of your Personal Data to a supervisory authority.

What about if you're in California?

Addendum – California Consumer Privacy Act ("CCPA")

If you are a California resident, California Civil Code Section 1798.83 permits you to request information with respect to the disclosure of your personal information by us to third parties for such third parties’ direct marketing purposes. We are only required to respond to a particular customer’s request for such information once during a calendar year. To make such a request, please send us an email at privacyofficer@manukahealth.co.nz.

Rights and Choices for California Residents. The California Consumer Privacy Act (“CCPA”) provides California residents with specific rights regarding their personal information. This section describes California residents’ CCPA rights and explains how to exercise those rights. If you are a resident of a state other than California, we may respond to requests in ways that differ from responses that are required only under California law.

Categories of Data Collected and Uses of Collected Data. We collect and process personal data as set forth above.

Access to Specific Information and Data Portability Rights. You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your request, we will disclose to you:

(a) The categories of personal information we collected about you.

(b) The categories of sources for the personal information we collected about you.

(c) Our business or commercial purpose for collecting or selling that personal information.

(d) The categories of third parties with whom we share that personal information.

(e) The specific pieces of personal information we collected about you.

(f) For your personal information we sold or disclosed for a business purpose, two separate lists disclosing: (1) for sales, a list identifying the personal information categories; and (2) for disclosures for a business purpose, a list identifying the personal information categories.

Deletion Request Rights. You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service providers to:

(a) Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

(b) Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

(c) Debug products to identify and repair errors that impair existing intended functionality.

(d) Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

(e) Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).

(f) Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

(g) Comply with a legal obligation.

(h) Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Access, Data Portability, and Deletion Rights. To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to at the Contact Information provided below or on our Website at: [website link].

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a request for access or data portability twice within a 12-month period. The consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Our processes for verifying requests include matching identifying information that we already have on record to provide services to the customers.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

Response Timing and Format. We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Right to Opt-out. You have the right to opt-out of us selling your personal information. We do not currently sell personal information to third parties, and as such you are already opted-out without any further action required of you.

Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

(a) Deny you goods or services;

(b) Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

(c) Provide you a different level or quality of goods or services; or

(d) Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Your Consent. By using our Website, you consent to the collection, use and disclosure of information in accordance with the terms of this Privacy Policy. By using our Website, you should also be aware that any personally identifiable information you submit can be read, collected, or used by other users of the Website, and could be used to send you unsolicited messages. We are not responsible for the personally identifiable information you choose to submit through your use of the Website.

We reserve the right to modify or amend this Privacy Policy at any time in our sole and absolute discretion. If we change our Privacy Policy, we will post any changes on this page and your continued use of the Website constitutes your acceptance and agreement to any revisions to our Privacy Policy.

Contacting us about privacy

39. If you wish to contact us about your privacy, including for any of the purposes outlined in this Privacy Policy or to make a complaint about how we handle your personal information, you can contact us at privacyofficer@manukahealth.co.nz.
40. If you have a complaint and feel that this has not been resolved by us to your satisfaction, you may take your complaint directly to the relevant data protection authority in your country (for example in the place you reside or where you believe we have breached your rights). You are not required to let us try to resolve your complaint first before escalating this further.