Privacy Policy - The Vaping Kiwi

1. Who we are

The Vaping Kiwi (the "Site") is an online and bricks-and-mortar vape retailer operating at thevapingkiwi.co.nz. References to "we", "us", and "our" mean the operators of the Site. References to "you" and "your" mean any visitor to the Site or customer of the business.

2. Information we collect

We may collect the following categories of information:

Information you provide: Email address, name, phone number, delivery address, payment details (handled through our payment processor), date of birth (for age verification), and any other information you submit through forms on the Site, including order forms, account sign-up, contact requests, newsletter sign-ups, and rewards-program enrolments.
Automatically collected information: IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, time spent, click activity, geolocation derived from IP, and similar technical data, collected through server logs, cookies, web beacons, pixel tags, local storage, and similar technologies.
Information from third parties: Aggregated, demographic, or behavioural data provided by analytics providers, advertising networks, marketing partners, and data brokers about you or about audiences similar to you. Age-verification data returned by third-party verification services where applicable.

3. How we use information

We use information collected through the Site for any lawful purpose, including:

Operating, maintaining, and improving the Site and our retail business;
Processing orders, payments, deliveries, and returns;
Verifying the age of customers as required by New Zealand vaping legislation (the Smokefree Environments and Regulated Products Act);
Communicating with you, including via email, about orders, newsletters, partnerships, events, promotions, and product offerings;
Personalising content and advertising you see on the Site and on third-party sites and apps;
Conducting research, analytics, modelling, profiling, and benchmarking;
Building, training, and improving advertising and recommendation models, including by sharing data with third-party providers for these purposes;
Detecting fraud, abuse, and security incidents;
Complying with applicable laws and enforcing our Terms & Conditions.

4. Cookies and tracking technologies

The Site uses cookies, web beacons, pixel tags, local storage, software development kits (SDKs), device fingerprinting, and similar technologies operated by us and by third parties. These technologies are used to recognise your browser or device, remember your preferences (including cart contents and age-verification status), measure usage, deliver advertising, and otherwise enable Site functionality.

Third-party providers we may use include, without limitation: Google (Google Analytics, Google Ads, Google Tag Manager), Meta Platforms (Facebook Pixel and Conversions API), TikTok, Microsoft Advertising, Cloudflare, payment processors (including Laybuy and our card-payment gateway), our shipping providers, and any other advertising, analytics, attribution, or marketing-technology vendor we may engage from time to time. Each of these providers may set its own cookies and identifiers and may collect and process information about you for its own purposes, governed by its own privacy policies.

You may be able to limit some tracking through your browser settings, your device settings, or industry opt-out programs. Disabling cookies may degrade your experience on the Site.

5. Sharing of information

We share information liberally to advance the operation of the Site and the businesses of our commercial partners. Categories of recipients include, without limitation:

Service providers who host, operate, secure, or analyse the Site or our email programs;
Order fulfilment partners, including couriers, click-and-collect partners, age-verification services, and payment gateways;
Advertising and marketing-technology vendors, ad networks, demand-side platforms, supply-side platforms, identity-resolution services, attribution platforms, and data cooperatives, including for the purpose of audience building, lookalike modelling, and cross-device tracking;
Commercial partners, including vape brands and distributors we work with, sponsors, advertisers, and other businesses we work with on joint or co-branded initiatives, including by sharing or licensing email lists, audience segments, and behavioural data for their own marketing purposes;
Affiliates and successors, including in connection with a merger, acquisition, restructuring, financing, sale of assets, or similar transaction;
Authorities, when required by law, regulation, legal process, or to protect our rights, property, safety, or the rights, property, or safety of others;
Other parties with your consent or at your direction.

To the maximum extent permitted by law, sharing of de-identified, aggregated, or hashed information is unrestricted.

6. Your choices

Marketing email: You may unsubscribe from our marketing emails using the unsubscribe link contained in those emails. We may continue to send you transactional or order-related communications.
Cookies and ads: See Section 4 above.
Access, correction, deletion: New Zealand residents may request access to or correction of personal information held about them in accordance with the Privacy Act 2020. Other applicable rights vary by jurisdiction.

7. Data retention

We retain information for as long as we determine reasonably necessary for the purposes set out in this policy, for our legitimate business interests, or as required by law (including tax-record requirements), whichever is longer.

8. International transfers

Information collected through the Site may be processed and stored in New Zealand, Australia, the United States, the European Union, the United Kingdom, and any other country in which we or our service providers operate. Privacy protections in those countries may differ from those in your country of residence.

9. Age

The Site is restricted to adults aged 18 years and over. We do not knowingly collect personal information from anyone under 18. If you believe we have collected such information, please contact us via our contact page and we will delete it.

10. Security

We use commercially reasonable measures to protect information collected through the Site. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

11. Third-party sites

The Site contains links to third-party websites, including the websites of vape brands, distributors, and payment providers. We are not responsible for the privacy practices of those sites and recommend you review their respective privacy policies.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this policy reflects the most recent update. Continued use of the Site after a change constitutes acceptance of the updated policy.

13. Contact

Questions about this policy can be sent via our contact page.