Privacy Policy – ROSINATE

‌Effective Date: 23 October 2026‌

Welcome to the privacy policy of ROSINATE LIMITED. This document has been drafted to align with New Zealand’s Privacy Act 2020, as well as all subsequent regulatory updates including the 2025 Privacy Amendment Act, to clearly explain how we collect, use, store, disclose and otherwise process your personal information when you interact with our e-commerce website hosted at www.rosinateltd.com.

ROSINATE LIMITED is the data controller for all personal information processing activities described in this policy. Our registered and operational contact details are as follows:

Email: briar@rosinateltd.com
Physical Address: 10A Pleasant Place, Mellons Bay, Auckland 2014, New Zealand
Telephone: +64 9 534 8614

We are committed to upholding the 13 Information Privacy Principles set out in the Privacy Act 2020, alongside the new requirements introduced by Information Privacy Principle 3A (IPP 3A) which came into force on 1 May 2026, to ensure that all processing of your personal information is transparent, fair, and compliant with New Zealand data protection regulations.

1. Scope of This Policy

This privacy policy applies to all visitors, registered users, customers, and third-party service partners who access or use our e-commerce platform, purchase goods from our online store, submit contact forms, sign up for marketing communications, or otherwise share personal information with ROSINATE LIMITED through any channels linked to www.rosinateltd.com. It covers all personal information processing activities conducted by our team, our authorized subcontractors, and any third-party service providers we engage to support our e-commerce operations.

This policy does not cover the practices of external websites that may be linked from our platform, and we encourage you to review the privacy policies of those third-party sites before you provide any personal information to them.

2. Types of Personal Information We Collect

We only collect personal information that is reasonably necessary to deliver our e-commerce services, process your orders, and comply with our legal obligations. The categories of personal information we may collect include:

‌Basic Identity and Contact Information‌: Your full name, email address, physical delivery and billing address, contact phone number, and any other contact details you voluntarily provide when creating an account, placing an order, or reaching out to our customer support team.
‌Transaction and Payment Information‌: Details of the products you browse, select, and purchase from our store, order history, delivery preferences, payment card or payment account details (processed securely through our PCI DSS-compliant payment gateways), and billing records.
‌Technical Usage Data‌: Information automatically collected when you access our website, including your IP address, browser type and version, device identifiers, operating system, referral sources, pages viewed on our site, navigation paths, time spent on specific pages, and other analytics data collected via cookies and similar tracking technologies.
‌Marketing and Communication Preferences‌: Records of your opt-in consent to receive our promotional newsletters, product update alerts, and marketing communications, as well as your interaction with those messages (including open rates and click-through behaviour).
‌Voluntarily Submitted Information‌: Any additional information you choose to share with us, such as product reviews, feedback on your shopping experience, custom product request details, or information submitted via customer support enquiries.
‌Indirectly Collected Personal Information‌: Under the requirements of IPP 3A introduced by the 2025 Privacy Amendment Act, we may also collect personal information about you from third-party sources including trusted payment verification service providers, shipping and logistics partners, publicly available official records, and fraud prevention agencies, where this is reasonably necessary for us to verify your identity, process your order securely, and prevent fraudulent transaction activities.

3. Legal Bases and Purposes for Processing Your Personal Information

We process your personal information only for lawful, specific, explicitly stated purposes that are directly related to our operation of this e-commerce platform. These purposes include:

To process, fulfill, and deliver your online orders, including arranging shipping, updating you on order status, processing returns and refunds in line with our store policies, and resolving any order-related issues that may arise.
To verify your identity, authenticate your user account, and prevent unauthorised access, fraudulent transactions, and other security risks that could harm you or our business operations.
To provide responsive customer support, respond to your enquiries, complaints, and feedback, and resolve any disputes in a timely and transparent manner.
To send you service-related alerts and critical operational notifications, including updates about changes to our website functionality, product availability, shipping disruptions, or adjustments to our terms of service that may impact your shopping experience.
Where you have given explicit opt-in consent, to send you personalised marketing communications, including information about new product launches, exclusive promotions, seasonal sales, and special offers that we believe may be of interest to you. You may opt out of these marketing communications at any time, free of charge, by clicking the unsubscribe link included in every marketing email, or by sending a notification to our contact email listed above.
To analyse website usage trends, optimise our platform functionality, improve our product offerings, and enhance the overall user experience for all visitors to www.rosinateltd.com.
To comply with our legal and regulatory obligations, including requirements under the New Zealand Privacy Act 2020, the Consumer Guarantees Act 1993, tax and commercial record-keeping rules, and any lawful requests from public authorities that we are bound to comply with.

For personal information collected indirectly from third-party sources as required by IPP 3A, we will take all reasonable steps to provide you with clear notice of this collection activity, the source of the information, and the purposes for which we will use it, unless an applicable legal exception applies. These exceptions include cases where the information is publicly available, you have already been notified of the collection by the original data controller, providing notice would interfere with ongoing law enforcement activities, undermine the legitimate purpose for which the information was collected, or pose a serious threat to public health, public safety, or the health and safety of any individual.

4. Cookies and Similar Tracking Technologies

Our website uses cookies, small text files stored on your device, to distinguish your browsing session from other users on our platform. We use different categories of cookies for different operational purposes:

‌Strictly Necessary Cookies‌: These cookies are essential to enable core functionality of our e-commerce website, such as maintaining your logged-in session, saving items in your shopping cart, and processing checkout workflows. You cannot disable these cookies through our website banner, as they are required for the platform to operate correctly.
‌Functional Cookies‌: These cookies remember your preferences, including your selected language, region, and saved delivery details, to provide you with a more personalised and convenient browsing experience during your future visits.
‌Analytics Cookies‌: These cookies help us understand how visitors interact with our website, aggregate anonymous usage data, and identify areas for improvement to our site structure and product offerings.
‌Marketing Cookies‌: These cookies are used to track your browsing behaviour across our platform and third-party sites, to serve you targeted advertisements for our products that align with your demonstrated interests, and measure the effectiveness of our promotional campaigns.

You can adjust your browser settings to block or delete cookies at any time, but please note that disabling certain categories of cookies may restrict your access to full functionality on www.rosinateltd.com, and may prevent you from completing online purchases on our platform.

5. Disclosure and Overseas Transfer of Your Personal Information

We will never sell, rent, or lease your personal information to unrelated third parties for their independent marketing purposes without your explicit written consent. We may disclose your personal information only to the following categories of trusted third parties, where the disclosure is necessary to deliver our e-commerce services:

Our authorised logistics, courier, and shipping partners, who require access to your delivery name, address, and contact phone number to complete the dispatch and delivery of your ordered products.
PCI DSS-compliant payment processing service providers, who handle your transaction information to securely process payments, verify card authenticity, and prevent financial fraud.
Cloud hosting and IT service providers who host our website, store our encrypted customer data, and provide platform maintenance and cybersecurity support services.
Professional service advisors including our legal counsel, accountants, and auditors, who process your personal information as part of their statutory and contractual obligations to support our business operations.
Law enforcement agencies, government regulators, or public authorities, only where we are legally required or permitted to disclose your personal information to comply with a lawful court order, statutory request, or regulatory investigation.

When it is necessary to transfer your personal information to overseas recipients located outside of New Zealand, we will take all reasonable steps to ensure that the overseas recipient provides an equivalent level of protection for your personal information as required under the Privacy Act 2020. We will enter into binding data processing agreements with these overseas recipients to enforce strict data security, usage limitation, and confidentiality obligations for your personal data, unless the transfer is to a jurisdiction that is recognised by the New Zealand Office of the Privacy Commissioner as providing adequate data protection safeguards.

6. Data Storage and Security

We implement industry-leading administrative, technical, and physical security measures to protect your personal information against unauthorised access, accidental loss, destruction, alteration, misuse, or unlawful disclosure. These safeguards include end-to-end encryption for all payment processing activities, regular security vulnerability testing of our website systems, role-based access controls to restrict access to customer personal information only to authorized employees who require it to perform their job duties, encrypted offsite data backups, and ongoing cybersecurity staff training for all members of our team.

We will retain your personal information only for as long as it is reasonably necessary to fulfill the original purposes for which it was collected, including to complete any ongoing contractual obligations with you, resolve pending disputes, enforce our user agreements, and comply with applicable New Zealand legal record-keeping requirements. Once your personal information is no longer required for these purposes, we will securely delete, anonymise, or permanently destroy the data in line with our data retention and disposal policies.

7. Your Rights Under New Zealand Privacy Law

In accordance with the Privacy Act 2020, you have the following enforceable rights in relation to your personal information held by ROSINATE LIMITED:

‌Right of Access‌: You may submit a written request to us to confirm whether we hold any of your personal information, and to receive a full copy of that information, along with details of how we have processed and shared the data. We will respond to your access request within 20 working days of receiving valid verification of your identity, in line with the requirements set by the Office of the Privacy Commissioner.
‌Right to Correction‌: If you find that any personal information we hold about you is inaccurate, incomplete, out of date, or misleading, you may request that we correct the data immediately. Where we do not agree to make the correction you have requested, we will provide you with a written notice explaining our decision, and you may request that we attach a statement of your proposed correction to the relevant personal record.
‌Right to Withdraw Consent‌: You may withdraw any previously provided consent for us to process your personal information for specific purposes, including consent to receive marketing communications, at any time free of charge. This withdrawal will not affect the lawfulness of any processing activities we completed prior to the date your consent withdrawal was received.
‌Right to Lodging a Complaint‌: If you believe that our processing of your personal information has breached your privacy rights under New Zealand law, you may submit a complaint to us using the contact details listed in this policy. We will investigate your complaint thoroughly and respond to you within 30 working days. If you are not satisfied with the outcome of our internal investigation, you have the right to refer your complaint directly to the Office of the New Zealand Privacy Commissioner for independent review.

8. Privacy Breach Response

We maintain a formal documented privacy breach response plan to manage any unauthorised access, disclosure, alteration, or destruction of personal information that we hold. In the event that a privacy breach occurs which has caused, or is likely to cause, serious harm to any affected individual, we will immediately notify the New Zealand Office of the Privacy Commissioner, as well as all affected individuals, in line with the mandatory notifiable privacy breach regime outlined in the Privacy Act 2020. Our response plan includes full root cause analysis, immediate mitigation of any identified security vulnerabilities, and clear communication to all affected parties about the nature of the breach, the categories of information involved, and the recommended steps that individuals can take to protect themselves from potential harm.

9. Updates to This Privacy Policy

We may periodically revise and update this privacy policy to reflect changes to our e-commerce business operations, new regulatory requirements issued by the New Zealand Privacy Commissioner, updates to New Zealand data protection legislation, or recommendations from the Office of the Privacy Commissioner. When we make material changes to this policy, we will update the effective date listed at the top of the document, and publish a clear prominent notification on the homepage of www.rosinateltd.com to inform all users of the revisions before the new policy takes effect. We encourage you to review this policy on a regular basis to stay informed about our latest personal information processing practices.

10. Contact Information

If you have any questions, concerns, or requests related to this privacy policy, or any aspect of our personal information processing activities, you may contact our designated privacy officer at any time via the following channels:

Attn: Privacy Officer, ROSINATE LIMITED
Physical Address: 10A Pleasant Place, Mellons Bay, Auckland 2014, New Zealand
Email: briar@rosinateltd.com
Telephone: +64 9 534 8614

We will respond to all privacy-related enquiries within 10 working days of receipt.