Privacy Policy

EcoBay Fresh Market is a local fresh food shop at 5/1063 Ferry Road, Ferrymead, Christchurch 8023, Aotearoa New Zealand. We are the "agency" responsible for the personal information described in this policy. You can reach our privacy contact at support@ecobayfresh.com.

We only collect information we genuinely need. This usually includes:

• Contact details — name, email, phone number, and (for Click & Collect) the name of the person picking up.
• Fresh Club details — date of birth (to confirm you're 16+), suburb, communication preferences, points balance, stamps, redemption history, and your member QR.
• Order and purchase information — items purchased, order totals, collection times, and any notes you send us.
• Payment information — handled by our payment provider. We don't store full card numbers on our servers.
• Customer care messages — emails, chatbot conversations, and any feedback you give us.
• Technical information — IP address, device and browser type, pages visited, and basic analytics so we can keep the site working and improve it.

We don't knowingly collect personal information from children under 16. Fresh Club is for NZ residents aged 16 and over.

• To take and fulfil your orders, including Click & Collect.
• To run the Fresh Club rewards programme and track points and redemptions.
• To answer your questions and provide customer care.
• To send service messages (order confirmations, reward updates) and, if you opt in, occasional marketing.
• To operate, secure and improve our website and in-store systems.
• To meet our legal obligations (e.g. tax, consumer protection, age-restricted product rules).

We won't use your information for a materially different purpose without telling you and, where required, getting your consent.

We collect information directly from you when you sign up to Fresh Club, place an order, contact us, or use our website. Some technical information is collected automatically through cookies and analytics (see section 8).

We don't sell your personal information. We share it only with trusted service providers who help us run the business, and only for the purposes above. These include:

• Our hosting, database and email infrastructure providers.
• Our payment provider for processing card payments.
• AI providers that power our customer service chatbot (messages may be processed to generate replies).
• Analytics tools to understand how the site is used.
• Government agencies or law enforcement where we're legally required to disclose information.

Some of these providers may store or process data outside New Zealand (for example in Australia, the United States, or the EU). Where this happens, we take reasonable steps to ensure your information has comparable protection to the Privacy Act 2020, in line with Information Privacy Principle 12.

We keep personal information only for as long as we need it for the purposes above, or as required by law (for example, tax records generally need to be kept for seven years). When we no longer need it, we securely delete or de-identify it.

We use reasonable technical and organisational measures to protect your information, including access controls, encryption in transit, secure logins for staff, and Row Level Security on our database. No online system can be 100% secure, but we take security seriously and will tell you and the Privacy Commissioner if a notifiable privacy breach occurs.

Our website uses cookies and similar technologies to keep you logged in, remember your cart, and understand how the site is used. You can control cookies in your browser settings, but turning them off may affect how the site works (for example, you may not stay signed in to Fresh Club).

We'll only send marketing emails or messages if you've opted in. Every marketing message includes an unsubscribe link, and you can also email us anytime to opt out. Service messages (like order confirmations or important account notices) aren't marketing and will still be sent.

Under the Privacy Act 2020 you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information that is wrong.
• Withdraw consent for marketing at any time.
• Close your Fresh Club account.
• Complain to us, and to the Office of the Privacy Commissioner, if you think we've mishandled your information.

To exercise any of these rights, email support@ecobayfresh.com. We may need to verify your identity before acting on a request.

Please talk to us first — we'd like the chance to put things right. If you're not satisfied, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

We may update this policy from time to time. The current version will always be on this page with the "last updated" date at the top. Significant changes will be communicated through the website or by email where appropriate.

Questions about privacy at EcoBay? Email support@ecobayfresh.com or write to us at 5/1063 Ferry Road, Ferrymead, Christchurch 8023.

Our website has a support chat you can use to ask about the shop. It's recorded, and here's exactly what that means.

What we collect. The messages you type in the chat, the date and time of the conversation, and basic technical information (such as your browser type). Please don't share sensitive personal details in the chat — it isn't the place for account numbers, health information or ID documents.

Why we collect it. To answer your question, to review the quality and safety of the answers our chat gives, and to improve the information we provide.

AI processing. Messages are processed by an AI service provider to generate replies. That processing may happen on servers outside New Zealand, under appropriate safeguards in line with Information Privacy Principle 12.

What we don't do. We don't use chat content for advertising, and we don't sell it.

How long we keep it. Chat records are kept for up to 90 days and then deleted. Questions we couldn't answer may be kept in summary form, without personal details, to improve our information.

Your rights. You can ask for access to, or correction of, chat records about you by emailing support@ecobayfresh.com.

If you apply for a job with us through our careers pages, here's what happens to what you send.

What we collect. Your name, email address, mobile number, the role you applied for, anything you write in the message box, and any CV or cover letter you attach. We also keep a scrambled (hashed) technical tag so the form can't be submitted in bulk by bots.

Why we collect it. Only to consider you for the role you applied for, to contact you about it, and to come back to you if a similar role opens soon after.

Who sees it. Only the shop owner and managers. Applications are never shown on the website, never shared with other businesses, and never used for marketing.

How long we keep it. Applications and any attached files are kept for 6 months, then automatically deleted by a scheduled daily job — the file and the record both go.

Your rights. You can ask us what we hold about your application, ask for a correction, or ask us to delete it early by emailing support@ecobayfresh.com.