Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Purevion Essalique Limited ("we", "us", "our") collects, uses, stores, shares and protects personal information when you visit this website, contact our floristry studio, ask for a quote, or order flowers, event florals or workshops from us.

We are a New Zealand company. Our company number is 8147392, our GST/VAT number is 136-947-582, and our registered address is 58 Cook Flat Road, Fox Glacier 7886, New Zealand. For the purposes of the New Zealand Privacy Act 2020 we are the agency that holds and is responsible for the personal information described in this policy. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to you, we are the data controller.

We handle personal information in line with the Privacy Act 2020 and its thirteen Information Privacy Principles. Because people outside New Zealand may visit this website or order flowers for delivery to New Zealand, we also aim to meet the principles of the GDPR and the UK GDPR where they are relevant, including transparency, purpose limitation, data minimisation, security and respect for individual rights.

This policy applies only to this website and to our own dealings with you. It does not cover websites operated by other organisations that we may link to. Please read it together with our Terms & Conditions and our Cookie Policy.

2. How to contact us about privacy

If you have a question about this policy, want to exercise a privacy right, or wish to raise a concern, please contact our privacy contact:

• Company: Purevion Essalique Limited
• Address: 58 Cook Flat Road, Fox Glacier 7886, New Zealand
• Email: info@purevionessalique.com
• Telephone: +64 3 751 4286

We are a small studio and we do not have a statutory data protection officer. Privacy requests are handled by the studio owner or a person they appoint.

3. The personal information we collect

We collect only the information we need to run our studio and to look after you as a visitor or customer. Depending on how you deal with us, this may include the following.

Enquiries and messages

When you use the contact form, write to us by email, or telephone us, we may collect your name, email address, telephone number, the content of your message and any details you choose to share about your occasion, such as the date, venue, colour preferences or budget.

Quotes, orders, events and workshops

If you become a customer, we also collect the information needed to prepare and deliver your order. This can include your billing and delivery address, the name and address of a gift recipient, any card message you would like included, event details, invoicing details, records of payments made to us, and correspondence about your order. If you book a workshop, we may collect the names of participants and any accessibility or allergy information you choose to tell us so that we can look after you safely.

Payment information

We do not collect or store payment card numbers through this website. If you pay by bank transfer, we keep a record of the transaction (amount, date and the account name shown on our bank statement). If we take card payments in future through a payment provider, that provider will process your card details under its own privacy policy and we will receive only confirmation of the payment.

Technical information

Like most websites, our web server may automatically record technical information when a page is requested. This can include your IP address, the date and time of the request, the pages or files requested, the referring page, and basic information about your browser, device and operating system. See section 7 for more about server logs.

Feedback and testimonials

If you write a review or allow us to publish a comment about our work, we keep that feedback. We will publish your name or any photographs only with your permission, and you can ask us to remove them at any time.

What we do not collect

We do not knowingly collect sensitive information such as health, religious or biometric data, except where you volunteer it to us for a specific purpose, for example an allergy that affects a workshop or delivery. We do not use the website to profile visitors or to build advertising profiles, and we do not use automated decision-making that has legal or similarly significant effects on you.

4. How we collect information

We collect personal information in these ways:

• Directly from you, when you fill in the contact form, email or telephone us, meet us, place an order or book a workshop.
• Automatically, through standard server logs when you visit the website (see section 7).
• From other people, for example when a customer gives us a gift recipient's name and address for a delivery, or when an event planner or venue passes on your contact details so that we can coordinate flowers for your event. In these cases we rely on the person giving us the information to have told you.

Where possible we collect information directly from you and we will tell you why we need it when we ask.

5. Why we use your information and our legal bases

Under the Privacy Act 2020 we collect personal information only for lawful purposes connected with our business, and we use it only for the purposes for which it was collected or for directly related purposes, unless you agree otherwise or the law allows it. Where the GDPR or the UK GDPR applies, we rely on the legal bases set out below.

• To reply to your enquiry and prepare a quote. We use your contact details and message to respond to you. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in answering enquiries.
• To supply flowers, arrangements, event florals and workshops. We use order, delivery and payment information to fulfil your order, arrange delivery, take payment and keep you informed. Legal basis: performance of a contract with you.
• To keep business, tax and accounting records. We keep invoices and payment records as required by New Zealand tax and company law. Legal basis: compliance with a legal obligation.
• To operate, secure and improve the website. We use technical information to keep the site available, detect misuse and fix faults. Legal basis: our legitimate interests in running a secure and reliable website.
• To protect our rights. We may use information to establish, exercise or defend legal claims or to enforce our terms. Legal basis: our legitimate interests and, where applicable, legal obligations.
• To send you news and offers. We will send marketing messages only if you have asked for them or, for existing customers, where the law permits and you can easily opt out. Legal basis: your consent, or our legitimate interest in keeping in touch with customers where allowed.
• To publish your feedback or photographs. We do this only with your permission. Legal basis: your consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have considered your interests and rights and concluded that they do not override ours, given the limited and expected way in which we use the information.

6. The contact form and email

The contact form on this website does not send your message to a form-processing service or to any third party. When you select "Send Message", the website checks that the required fields are complete and then opens a new email in the email program on your own device, addressed to info@purevionessalique.com, with your details and message already filled in. Nothing is sent until you press "Send" in your email program.

Once you send that email, it travels through your email provider and ours, and it is stored in our mailbox. Your email provider handles your message under its own privacy policy. If you would rather not use the form, you are welcome to email or telephone us directly using the details in section 2.

Please do not include sensitive information, such as payment card numbers or passwords, in a message to us.

7. Server logs

Our website is delivered by a hosting provider that keeps standard server logs for security, troubleshooting and capacity planning. These logs typically contain the technical information described in section 3. We do not use them to identify individual visitors, we do not combine them with other information to profile you, and we access them only when needed to investigate technical or security problems.

Log files are kept for a limited period set by the hosting provider, generally no longer than 90 days, and are then deleted or anonymised, unless we need to keep an entry longer to investigate a specific incident.

8. Cookies, analytics and similar technologies

At the time of writing, this website does not set cookies and does not use analytics, advertising, tracking pixels, embedded social media widgets, embedded maps or embedded videos. The fonts, icons, images and scripts used by the pages are hosted on the same server as the site itself, so your browser does not contact third-party services to display them.

Because we do not run analytics, we do not measure your visit beyond the server logs described above. If we introduce any cookie, analytics tool or similar technology in the future, we will update this policy and our Cookie Policy first and, where the law requires, ask for your consent before any non-essential technology is used.

9. Marketing messages

We do not send marketing emails or text messages to people who have not asked to receive them. If you agree to receive news, seasonal offers or workshop announcements, every message will identify us as the sender and contain a simple way to unsubscribe, in line with the New Zealand Unsolicited Electronic Messages Act 2007 and similar laws elsewhere. You can withdraw your consent at any time by using the unsubscribe link or by writing to us. We will still send you service messages that relate to an order you have placed, such as delivery confirmations.

10. Who we share information with

We do not sell your personal information and we do not share it for third-party advertising. We share information only where it is necessary to run our studio or where the law requires, and only to the extent needed. Depending on what you ask us to do, recipients can include:

• Service providers that support the website and our business, such as web hosting and domain services, email and productivity services, and secure file or document storage.
• Delivery partners, such as couriers or local drivers, who receive a recipient's name, address, telephone number and delivery instructions so they can deliver your flowers.
• Payment and banking providers, who process payments made to us.
• Accountants, auditors, lawyers and other professional advisers, who are bound by professional duties of confidentiality.
• Event partners, such as venues, planners or photographers, when you ask us to coordinate with them, and only for that purpose.
• Authorities and regulators, such as Inland Revenue, the New Zealand Police, courts and the Office of the Privacy Commissioner, where we are legally required or authorised to disclose information.
• A buyer or successor, if we sell or restructure our business, in which case the new owner would be required to handle your information in line with this policy or notify you of any changes.

We require our service providers to protect personal information and to use it only for the services they provide to us.

11. Sending information outside New Zealand

We are based in New Zealand, but some of the providers we use, for example for email, hosting or document storage, may store or process information on servers in other countries. Information may therefore be held or accessed outside New Zealand, including in Australia, the United States, the United Kingdom or the European Economic Area.

Under Information Privacy Principle 12 of the Privacy Act 2020, we disclose personal information to an overseas recipient only if the recipient is subject to comparable privacy safeguards, if you have authorised the disclosure after being told that comparable protections may not apply, or if another exception in the Act applies. Where the GDPR or the UK GDPR applies to a transfer, we rely on an appropriate safeguard such as an adequacy decision or standard contractual clauses. You can ask us for more information about the safeguards we use by contacting us.

12. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy or as the law requires. As a guide:

• Enquiries that do not lead to an order: up to 24 months after our last contact with you, then deleted or anonymised.
• Customer and order records, quotes and correspondence: for the duration of our relationship and afterwards for the period we need to deal with any queries or claims, and for at least seven years for invoices and accounting records, as required by New Zealand tax and company law.
• Marketing preferences: until you withdraw your consent or ask us to stop, and then a minimal record so that we do not contact you again.
• Testimonials and photographs published with your permission: until you ask us to remove them.
• Server logs: as described in section 7.

When information is no longer required, we delete it securely or make it anonymous so that it can no longer identify you.

13. Your rights

Under the New Zealand Privacy Act 2020

You have the right to ask us to confirm whether we hold personal information about you and to give you access to it (Information Privacy Principle 6). You also have the right to ask us to correct information you believe is wrong (Information Privacy Principle 7) and, if we decline, to ask us to attach a statement of the correction you sought. We will respond within 20 working days of receiving your request, as the Act requires, and we will tell you if we need more time or need to refuse a request and why.

Under the GDPR and the UK GDPR

If those laws apply to you, you also have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of inaccurate or incomplete data.
• Erasure of your data in certain circumstances, sometimes called the "right to be forgotten".
• Restriction of processing in certain circumstances, for example while we check the accuracy of your data.
• Object to processing that is based on our legitimate interests, and to direct marketing at any time.
• Data portability, meaning to receive the data you gave us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Withdraw consent at any time where we rely on your consent. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
• Not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.

How to exercise your rights

Email or write to us using the details in section 2. To protect your information we may ask you to verify your identity before we act on a request. We do not normally charge a fee. Under the Privacy Act 2020 access to your own information is generally free, and where the GDPR applies we will respond within one month, which we may extend by up to two further months for complex requests. Some rights are not absolute and may be limited by law, for example where we must keep records for tax purposes or where releasing information would affect another person's privacy.

14. Security

We take reasonable steps to protect personal information against loss, misuse, unauthorised access, modification and disclosure. These include limiting access to those who need it, using reputable service providers, keeping software up to date, using secure connections where available, and storing paper records securely. No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security, but we take our responsibilities seriously.

If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as required by Part 6 of the Privacy Act 2020. Where the GDPR or the UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a reportable breach and inform affected individuals where the law requires.

15. Children and young people

This website is intended for adults and is not directed at children. We do not knowingly collect personal information from anyone under 16 years of age without the consent of a parent or guardian. If you believe a child has given us personal information, please contact us and we will delete it. Workshops for younger participants are accepted only when booked and supervised by a parent or guardian.

16. Links to other websites

Our website may contain links to other websites, for example to a supplier, venue or our email address. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any site you visit.

17. Complaints and supervisory authorities

We would like the chance to fix any concern first, so please contact us using the details in section 2. We will acknowledge your complaint promptly and aim to resolve it fairly.

If you are not satisfied with our response, you have the right to complain to the New Zealand Office of the Privacy Commissioner, whose website is www.privacy.org.nz. If you live in the European Economic Area or the United Kingdom, you may also lodge a complaint with the data protection authority in the country where you live or work, or where you believe an infringement occurred.

18. Changes to this policy

We may update this policy from time to time, for example when our services, our providers or the law change. The date of the latest update is shown at the top of this page. If we make a significant change, we will take reasonable steps to bring it to your attention, for instance by a notice on the website. Please check this page periodically.

19. Contact details

Purevion Essalique Limited, company number 8147392, GST/VAT number 136-947-582.
Registered address: 58 Cook Flat Road, Fox Glacier 7886, New Zealand.
Email: info@purevionessalique.com. Telephone: +64 3 751 4286.