Privacy Policy
Last updated:
1. Data Controller
Elbowflexmove
233 Baldrock Road, Kaiwaka 0587, New Zealand
Email: supportcenter@elbowflexmove.world
Phone: +64 274 937 801
2. Scope
This Privacy Policy describes how Elbowflexmove ("we", "us", "our") collects, uses, stores, and protects personal data when you visit elbowflexmove.world or contact us regarding our outdoor fitness masterclasses and movement sessions.
3. Personal Information We Collect
3.1 Information You Provide
When you use our contact form, we may collect:
- Full name
- Email address
- Message content
- Privacy consent confirmation
3.2 Automatically Collected Information
When you visit our website, we may automatically collect:
- IP address (anonymised where possible)
- Browser type and version
- Device type and operating system
- Pages visited and time spent on pages
- Referring website address
- Cookie preferences stored in localStorage
4. Collection Notice (Privacy Act 2020)
Under the Privacy Act 2020, we must tell you why we collect personal information and what will happen if you do not provide it.
- Contact form fields — collected so we can read, respond to, and follow up on your enquiry about outdoor fitness masterclasses and sessions. If you do not provide your name, email, or message, we cannot respond to your enquiry.
- Privacy consent checkbox — collected to confirm you agree to our handling of your enquiry. Submitting the form without this consent is not permitted.
- Website usage data — collected to operate, secure, and improve the website. Analytics and marketing data are collected only if you consent via our cookie banner.
We collect personal information directly from you, except for automatically collected technical data generated when you browse the site.
5. Purposes of Use
We use personal information only for purposes that are connected with our outdoor fitness information and enquiry services, including:
- Responding to enquiries — to reply to contact form submissions and arrange session information
- Website functionality — to ensure the website operates correctly, including cookie consent management
- Analytics — to understand how visitors use our website, only with your consent
- Marketing measurement — to measure the effectiveness of our communications, only with your consent
- Legal compliance — to meet obligations under New Zealand law
We do not use your contact details for direct marketing unless you have given separate express consent. See Section 12 regarding the Unsolicited Electronic Messages Act 2007.
6. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected:
- Contact form data: up to 24 months after your last communication with us
- Analytics data: up to 26 months
- Cookie consent records: up to 12 months
- Server logs: up to 90 days
When information is no longer required, we securely delete or de-identify it.
7. Disclosure to Third Parties
We do not sell your personal information. We may disclose information to:
- Hosting and infrastructure providers necessary to operate the website
- Analytics service providers (only if you have consented to analytics cookies)
- Professional advisers where reasonably required
- Law enforcement or regulatory bodies when required by applicable New Zealand law
Third-party service providers may only use your information to perform services for us and must protect it in line with applicable privacy law.
8. Overseas Disclosure
Some service providers (for example, analytics or cloud hosting providers) may store or process personal information outside New Zealand, including in the United States, European Economic Area, or Australia.
Before disclosing personal information overseas, we take reasonable steps to ensure the recipient protects it in a way that, overall, provides comparable safeguards to the Privacy Act 2020. Where required for European visitors, we also use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
You may request further details about overseas recipients by contacting us using the details in Section 15.
9. Data Security
We implement reasonable security safeguards to protect personal information against loss, unauthorised access, use, modification, or disclosure, including:
- HTTPS encryption for data transmission
- Access controls limiting information access to authorised personnel
- Regular review of our systems and processes
- Secure storage with encryption at rest where applicable
10. Your Rights Under the Privacy Act 2020
As a New Zealand-based organisation, we comply with the Privacy Act 2020 and its Information Privacy Principles. You have the right to:
- Access — request confirmation of whether we hold personal information about you and request access to it (IPP 6)
- Correction — request correction of personal information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading (IPP 7)
- Withdraw consent — where processing is based on consent, withdraw that consent for future processing
- Complain — lodge a complaint with us or with the Office of the Privacy Commissioner if you believe we have interfered with your privacy
To make an access or correction request, contact us at supportcenter@elbowflexmove.world. We will respond within 20 working days, or inform you if an extension is required under the Privacy Act 2020.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:
- Website: www.privacy.org.nz
- Phone: 0800 803 909 (New Zealand)
11. Your Rights Under GDPR
If you are located in the European Economic Area, you also have the following rights under the General Data Protection Regulation:
- Right of access — request a copy of your personal data
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your personal data
- Right to restrict processing — request limitation of data processing
- Right to data portability — receive your data in a structured format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — withdraw consent at any time without affecting prior processing
To exercise GDPR rights, contact us at supportcenter@elbowflexmove.world. We will respond within 30 days where GDPR applies.
12. Unsolicited Electronic Messages
We comply with the Unsolicited Electronic Messages Act 2007. We will not send commercial electronic messages (such as promotional emails or SMS) without your express consent. Every marketing message will include a functional unsubscribe facility. Replying to a contact form enquiry does not by itself mean you have opted in to marketing communications.
13. Notifiable Privacy Breaches
If a privacy breach occurs that is likely to cause anyone serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required under the Privacy Act 2020. We maintain internal procedures to identify, assess, and respond to privacy breaches promptly.
14. Children's Privacy
Our website is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children without appropriate parental or guardian consent. If you believe we have collected information from a child, please contact us immediately so we can delete it.
15. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
16. Contact
For any privacy-related questions or requests, contact our data protection contact:
Elbowflexmove
233 Baldrock Road, Kaiwaka 0587, New Zealand
Email: supportcenter@elbowflexmove.world