Privacy Policy

Almond Labs Limited
Last updated: April 2026

1. Introduction

Almond Labs Limited (NZBN [insert NZBN]) ("we", "us", "our") is committed to protecting your privacy in accordance with the Privacy Act 2020 (NZ) and the thirteen Information Privacy Principles ("IPPs"). This policy explains how we collect, use, store, disclose, and protect your personal information when you visit our website [insert URL] (the "Site") and interact with our services.

By using the Site, you acknowledge that you have read and understood this Privacy Policy.

2. What Personal Information We Collect

We collect only the personal information reasonably necessary for our lawful business purposes (IPP 1). This includes:

Information you provide directly:

  • Name
  • Email address
  • Phone number (if provided)
  • Business or company name (if provided)
  • Any other details you include in a contact or enquiry form submission

Information collected automatically:

  • IP address
  • Browser type and version
  • Device type and operating system
  • Pages visited on our Site, time spent, and navigation paths
  • Referring URL (how you arrived at our Site)
  • Approximate geographic location (derived from IP address)
  • Session recordings and interaction data (mouse movements, clicks, scroll behaviour)

3. How We Collect Your Information

We collect personal information:

  • Directly from you — when you complete a contact form, subscribe to a mailing list, or otherwise submit your details through the Site (IPP 2).
  • Automatically via cookies and tracking technologies — through the tools described in Section 7 below.

Where we collect information directly from you, we will take reasonable steps to ensure you are aware of the matters set out in IPP 3 (purpose of collection, intended recipients, and your rights of access and correction).

4. Purpose of Collection

We collect and use your personal information for the following purposes (IPP 10):

  • Responding to your enquiries or requests
  • Sending you marketing communications, including email newsletters and nurture sequences (with your consent, in accordance with the Unsolicited Electronic Messages Act 2007)
  • Managing our relationship with you through our customer relationship management system
  • Analysing Site usage and user behaviour to improve our Site and services
  • Complying with our legal obligations under New Zealand law

We will not use your personal information for any purpose other than those for which it was collected, or a directly related purpose, unless we have your consent or are otherwise permitted by law (IPP 10).

5. Marketing Communications

Where you submit your contact details through our Site, we may send you commercial electronic messages (as defined under the Unsolicited Electronic Messages Act 2007) including newsletters, product updates, and educational content.

Every marketing email we send will:

  • Clearly identify Almond Labs Limited as the sender
  • Include accurate contact information for Almond Labs Limited
  • Contain a functional unsubscribe mechanism

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any email or by contacting us at the details in Section 13. We will process your unsubscribe request within 5 working days.

Opting out of marketing emails will not affect any transactional or service-related communications we may need to send you.

6. Disclosure and Third-Party Service Providers

We may share your personal information with the following categories of third-party service providers who assist us in operating our business (IPP 11):

  • Attio (or applicable CRM) — Customer relationship management and lead tracking — United States / EU
  • Google (Google Analytics) — Website traffic analysis and reporting — United States
  • Hotjar (or Microsoft Clarity) — Session recording, heatmaps, and user behaviour analysis — EU / United States
  • Email service provider [insert name, e.g. Klaviyo] — Sending marketing emails and nurture sequences — United States

These providers act as our processors and are contractually required to handle your personal information in accordance with our instructions and applicable privacy obligations.

We will not sell, rent, or trade your personal information to any third party.

We may also disclose your information where required by law, regulation, or court order, or to protect the rights, property, or safety of Almond Labs Limited or others.

7. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies. A cookie is a small text file placed on your device that allows us to recognise your browser and capture certain information.

Cookies we use:

  • Essential (Site platform) — Core site functionality — Session duration
  • Analytics (Google Analytics) — Aggregated traffic and usage data — Up to 2 years
  • Analytics / UX (Hotjar / Clarity) — Session recordings, heatmaps, scroll and click tracking — Up to 1 year

Your choices:

You can manage or disable cookies through your browser settings. Disabling cookies may affect the functionality of the Site. Most browsers allow you to:

  • View what cookies are stored and delete them individually
  • Block third-party cookies
  • Block all cookies
  • Clear all cookies when you close the browser

Hotjar / Clarity session recordings: These tools may record your mouse movements, clicks, and scrolling behaviour on the Site. Hotjar is configured to suppress any personal data entered into form fields during recordings. No keystrokes in password fields or sensitive input areas are captured.

8. Cross-Border Disclosure of Information

Some of our third-party service providers (as listed in Section 6) are located outside of New Zealand, including in the United States and the European Union. By providing us with your personal information, you acknowledge and consent to the transfer of your information to these jurisdictions (IPP 12).

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient is subject to privacy protections comparable to those under the Privacy Act 2020, including through contractual arrangements and reliance on established privacy frameworks (such as the EU GDPR where applicable).

9. Storage and Security

We take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure (IPP 5).

Our security measures include:

  • Use of encrypted (HTTPS/TLS) connections across the Site
  • Access controls limiting who within Almond Labs Limited can access personal information
  • Selection of third-party providers with appropriate security certifications and practices
  • Regular review of data handling practices

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

10. Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law (IPP 9). Specifically:

  • Contact form submissions and lead data: Retained for as long as the business relationship is active, and for a reasonable period thereafter (typically up to 3 years from last interaction) for follow-up or reactivation purposes.
  • Marketing list data: Retained until you unsubscribe, at which point your data will be removed from active marketing lists within 30 days. We may retain a suppression record of your email address to ensure we do not contact you again.
  • Analytics data: Retained in accordance with the default retention settings of each analytics platform (typically 14–26 months for Google Analytics).

When personal information is no longer required, we will take reasonable steps to destroy it or ensure it is de-identified.

11. Your Rights Under the Privacy Act 2020

You have the following rights in relation to your personal information:

  • Right of access (IPP 6): You may request confirmation of whether we hold personal information about you and, if so, request access to that information.
  • Right of correction (IPP 7): You may request that we correct any personal information we hold about you that is inaccurate, incomplete, or misleading.
  • Right to request deletion: While the Privacy Act 2020 does not provide an express right to erasure, you may request that we delete your personal information. We will comply with such requests where we have no lawful reason to retain the information.
  • Right to withdraw consent: Where we rely on your consent (e.g., for marketing communications), you may withdraw that consent at any time.

We will respond to any access or correction request within 20 working days, as required by the Privacy Act 2020. We will not charge a fee for access requests unless the request is manifestly excessive.

12. Complaints

If you believe we have breached your privacy or mishandled your personal information, you may:

  1. Contact us directly using the details in Section 13, and we will investigate and respond within 20 working days.
  2. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner:

    Office of the Privacy Commissioner / Te Mana Mātāpono Matatapu
    PO Box 10094, Wellington 6143
    Phone: 0800 803 909
    Website: privacy.org.nz

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to make a complaint, please contact us:

Almond Labs Limited
Email: [insert email]
Address: [insert physical address]
Phone: [insert phone number]

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any material changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.