Privacy Policy

EcoBay Fresh Market is a local fresh food shop at 5/1063 Ferry Road, Ferrymead, Christchurch 8023, Aotearoa New Zealand. We are the "agency" responsible for the personal information described in this policy. You can reach our privacy contact at support@ecobayfresh.com.

We only collect information we genuinely need. This usually includes:

• Contact details — name, email, phone number, and (for Click & Collect) the name of the person picking up.
• Fresh Club details — date of birth (to confirm you're 16+), suburb, communication preferences, points balance, stamps, redemption history, and your member QR.
• Order and purchase information — items purchased, order totals, collection times, and any notes you send us.
• Payment information — handled by our payment provider. We don't store full card numbers on our servers.
• Customer care messages — emails, chatbot conversations, and any feedback you give us.
• Technical information — IP address, device and browser type, pages visited, and basic analytics so we can keep the site working and improve it.

We don't knowingly collect personal information from children under 16. Fresh Club is for NZ residents aged 16 and over.

• To take and fulfil your orders, including Click & Collect.
• To run the Fresh Club rewards programme and track points and redemptions.
• To answer your questions and provide customer care.
• To send service messages (order confirmations, reward updates) and, if you opt in, occasional marketing.
• To operate, secure and improve our website and in-store systems.
• To meet our legal obligations (e.g. tax, consumer protection, age-restricted product rules).

We won't use your information for a materially different purpose without telling you and, where required, getting your consent.

We collect information directly from you when you sign up to Fresh Club, place an order, contact us, or use our website. Some technical information is collected automatically through cookies and analytics (see section 8).

We don't sell your personal information. We share it only with trusted service providers who help us run the business, and only for the purposes above. These include:

• Our hosting, database and email infrastructure providers.
• Our payment provider for processing card payments.
• AI providers that power our customer service chatbot (messages may be processed to generate replies).
• Analytics tools to understand how the site is used.
• Government agencies or law enforcement where we're legally required to disclose information.

Some of these providers may store or process data outside New Zealand (for example in Australia, the United States, or the EU). Where this happens, we take reasonable steps to ensure your information has comparable protection to the Privacy Act 2020, in line with Information Privacy Principle 12.

We keep personal information only for as long as we need it for the purposes above, or as required by law (for example, tax records generally need to be kept for seven years). When we no longer need it, we securely delete or de-identify it.

We use reasonable technical and organisational measures to protect your information, including access controls, encryption in transit, secure logins for staff, and Row Level Security on our database. No online system can be 100% secure, but we take security seriously and will tell you and the Privacy Commissioner if a notifiable privacy breach occurs.

Our website uses cookies and similar technologies to keep you logged in, remember your cart, and understand how the site is used. You can control cookies in your browser settings, but turning them off may affect how the site works (for example, you may not stay signed in to Fresh Club).

We'll only send marketing emails or messages if you've opted in. Every marketing message includes an unsubscribe link, and you can also email us anytime to opt out. Service messages (like order confirmations or important account notices) aren't marketing and will still be sent.

Under the Privacy Act 2020 you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information that is wrong.
• Withdraw consent for marketing at any time.
• Close your Fresh Club account.
• Complain to us, and to the Office of the Privacy Commissioner, if you think we've mishandled your information.

To exercise any of these rights, email support@ecobayfresh.com. We may need to verify your identity before acting on a request.

Please talk to us first — we'd like the chance to put things right. If you're not satisfied, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

We may update this policy from time to time. The current version will always be on this page with the "last updated" date at the top. Significant changes will be communicated through the website or by email where appropriate.

Questions about privacy at EcoBay? Email support@ecobayfresh.com or write to us at 5/1063 Ferry Road, Ferrymead, Christchurch 8023.