J Ballantyne and Company Limited (trading as Ballantynes) is committed to protecting the privacy of all customers, clients and other individuals that interact with us, whether through our services, Website, communications, transactions or other dealings.

We collect and store personal information about you to allow us to provide you with our services. This Policy explains in general terms how Ballantynes collects, holds, uses and discloses your personal information in accordance with the New Zealand Privacy Act 2020 and all regulations and subordinate legislation implemented under it (Act).

We may amend this Policy as our business requires or the law changes. Any changes to this Policy will be updated on this page www.ballantynes.co.nz/privacy. We encourage you to review the Policy regularly for the latest information on our privacy practices. We will take reasonable steps to bring any material changes to this Policy to your attention.

Nothing in this Policy alters your rights under the Act. If you would like to learn more about these rights, please visit www.privacy.org.nz.

In these terms, the expressions “us”, “we”, “our” and “Ballantynes” are a reference to J Ballantyne and Company Limited (company number 120724); reference to “you” is the customer and “the Website” refers to www.ballantynes.co.nz and any subdomains or directories of the Website (e.g. www.ballantynes.co.nz/gift-registry)

The personal information we collect may include your name, contact details (including email address and/or phone number), date of birth, and payment details (such as credit/debit card number, expiry date, billing and postal addresses). We may collect this information in the following ways:

· Online: when you place an order with us or sign up for information from us online.

· In-store (POS): when you choose to provide your details at our point-of-sale terminals (POS) in-store. If you choose to enrol at our POS, we will collect your mobile phone number and email address to add you to our customer database, identify you as a returning customer, and (where you opt in) send you marketing communications. Providing this information is entirely voluntary and is not required to complete your purchase.

· Other: when you otherwise sign up for information from us or interact with us.

Examples of personal information that we may collect are set out below:

(a) In-store purchases and POS enrolment: Name, mobile phone number, email address, payment details (processed but not retained), and purchase history.

(b) Online purchases: Name, contact details (email address and phone number), date of birth, billing and postal addresses, payment details (processed but not retained), and purchase history.

(c) Marketing and promotional interactions: Name, contact details to which marketing materials are to be sent, and marketing preferences.

(d) General enquiries or communications: Name, contact details (such as your email address and phone number), and the content of your enquiry or correspondence.

(e) Website use and interactions: IP address, device and browser information, location data, and cookies.

(f) Competitions and surveys: Name, contact details, and any preferences, opinions, or other feedback provided to us.

(g) Age verification for alcohol sales: Confirmation of your age and that of the order recipient as being 18 years or over, for alcohol sales online.

Please note that we do not store credit card information and that our payment systems are PCI compliant, using a tokenised method of payment validation.

We may collect personal information about you when you:

(a) purchase goods or services from us in-store (including when you choose to provide your details at our point-of-sale terminals);

(b) purchase goods or services from us online through the Website;

(c) use our services (e.g. Gift Registry);

(d) sign up to receive our emails or other communications;

(e) enter into one of our competitions;

(f) log into your Ballantynes Online Account; or

(g) otherwise interact with us, including by telephone or in person.

Where practicable, we will collect personal information directly from you.

Where it is impracticable in the circumstances to collect personal information directly from you, or where we have reasonable grounds to believe that an exception to Information Privacy Principle 2 applies, we may collect your personal information from a source other than you. Examples of circumstances in which we may indirectly collect your personal information include where:

(a) Fraud prevention and payment verification: We may collect information about you from payment providers, credit reference agencies, or fraud detection services to verify transactions and protect against fraudulent activity.

(b) Meta and social media platforms: If you contact us or interact with us through Facebook, Instagram, or Messenger, we may receive your profile information and message content from those platforms.

(c) General legal compliance: From time to time, a legal or regulatory obligation may require us to collect personal information about you from third-party sources. For the purposes of Information Privacy Principles 2, 3, and 3A, where we collect your personal information directly or indirectly, that collection will only occur as necessary to further any of the purposes set out in this Policy, the personal information will be held by us and will only be disclosed to third parties in accordance with the Disclosure section below, and you have the rights to access and correct the personal information that we hold about you.

We may occasionally monitor telephone calls between customers and our staff to help us provide our high level of customer service. More detailed information about why we collect the personal information outlined above is available upon request.

We collect and use your personal information for the following purposes:

(a) to provide you with our services;

(b) to verify your identity;

(c) to improve your shopping experience;

(d) to communicate with you (including for marketing purposes) and respond to communications from you;

(e) to send news, information about our products, services and promotions which we believe may be useful to you;

(f) to monitor who is accessing the Website or purchasing products offered on the Website;

(g) to conduct research and statistical analysis (on an anonymised basis where possible);

(h) to help us learn more about your shopping preferences;

(i) to help us address problems with and improve our site design, products and services;

(j) to protect the security or integrity of our Website and our business (e.g. complying with legal requirements in relation to the sale of alcohol);

(k) to protect and/or enforce our legal rights and interests, including defending any claim;

(l) to send you any accounts and recover any monies owed by you;

(m) to develop and administer loyalty programmes and customer rewards; and

(n) for any other purposes authorised by you or the Act.

We may disclose your personal information in the following ways:

(a) any business that supports our services and products, including any person that hosts or maintains any underlying IT system or data centre that we use to provide the Website or any of our other services, any payment providers, any fraud detection partners, marketing and advertising partners, and customer support partners;

(b) any credit reference agency for the purpose of credit checking you;

(c) other third parties (for anonymised statistical information);

(d) a person who can require us to supply your personal information (such as a regulatory or government authority);

(e) with our service providers who manage our Customer information and perform services on our behalf, such as sending emails to our Customers. We do not authorise these service providers to make any other use or disclosure of your information;

(f) when we team up with another company to offer or provide products, services or promotions to our Customers;

(g) Any other person authorised by the Act or another law (such as a law enforcement agency);

(h) to enforce our rights under these terms and conditions; or

(i) any other person authorised by you.

We may disclose or store your personal information with service providers or other recipients located outside New Zealand where necessary. This may occur, for example, where we use overseas‑based IT systems or cloud service providers.

We may also disclose your personal information to any entity that we enter into any joint venture with or any other business that we are sold to or merged with.

Except as set out above, we will not sell or otherwise provide your personal information to a third party, or make any other use of your personal information for any purpose which is not related (directly or indirectly) or incidental to your use of this Website. For the avoidance of doubt, your personal information will not be used for any purpose which a reasonable person in your position would not expect. Personal information which we collect may be aggregated for analysis but in such circumstances we would ensure that individuals would remain anonymous.

Cookies are small pieces of data stored on the web browser on your computer. It is essentially your identification card for your visit, and cannot be executed as code or deliver viruses. It is uniquely yours and can only be read by our site. There is no data in a cookie that can personally identify you. The Website may store cookies on your web browser.

The main reasons we store cookies are:

(a) to improve your Website browsing experience. For example, to remember your search criteria so you don’t have to re-enter them to do multiple searches and to remember your site preferences for your next visit to the site;

(b) to gather statistics on site usage. For example, page views and drop off points so we can monitor site usage and make improvements to site usability; and

(c) to enable us to present customised and appropriate messages from Ballantynes.

If you have a Ballantynes online account and are logged into it, the information we collect via cookies may be linked with your personal information.

If you disable the use of cookies on your web browser or remove or reject specific cookies from the Website, then you may not be able to gain access to all the content and facilities of the Website.

We take all reasonable steps to keep your personal information safe from loss, unauthorised activity or other misuse. These steps include:

(a) adopting and regularly reviewing the performance and terms of our internal data security policies and systems to ensure that they are fit for purpose and protect your personal information from unlawful processing, accidental loss, destruction and damage; and

(b) adopting technologies for our internal use that otherwise help us to comply with the Information Privacy Principles set out in the Act.

We hold your personal information in electronic files. We use third party information system providers who store and may have access to your personal information. When you place an order through the Website, a secure server is used. Secure Sockets Layer (SSL) encrypts the information you send the Website.

To protect your personal information while you are using our Website, we have implemented the secure HTTPS data transfer protocol for the transmission of data and our site holds an SSL certificate from a trusted organisation. Despite this, the internet is not in itself a secure environment and we cannot give an absolute assurance that your information will be secure at all times. Transmission of personal information over the internet is at your own risk and you should only enter, or instruct the entering of, personal information to the service within a secure environment.

The Website uses SSL technology that scrambles all confidential data entered by you, such as payment details and address information, before being supplied and decoded by our payment and hosting providers. When you create an account or place an order, look for the SSL security padlock in the address bar.

Where we disclose personal information in accordance with the above, we will take reasonable steps to ensure that the recipient has appropriate data security policies and systems in place prior to disclosure. Where personal information is disclosed outside of New Zealand in accordance with the above, we will ensure that the recipient is subject to privacy safeguards that are comparable to those required under the Act (or that the disclosure is otherwise permitted by the Act).

Privacy Breaches

If we become aware of a privacy breach involving your personal information, we will:

(a) assess the breach to determine whether it amounts to a notifiable privacy breach (as that phrase is defined in the Act);

(b) investigate the cause and effects of the breach; and

(c) take reasonable steps to prevent similar breaches from occurring again in the future.

Where the breach is assessed as being a notifiable privacy breach (that is, it is likely to cause serious harm), we will notify the Privacy Commissioner and (subject to any appropriate exceptions applying) the affected individuals of the breach in accordance with the requirements of the Act.

Your rights to access to and correction of your personal information

Under the Act, you have the following rights:

(a) The right to be informed about how your data is being used. If you would like further information beyond that provided in this Policy, please contact us.

(b) The right to access readily retrievable personal information held by us about you. This right is subject to certain grounds for our refusal as outlined in the Act.

(c) The right to request corrections to the personal information that we hold about you. Should you request a correction, we will make the correction should the correction be reasonable and we are reasonably able to make it. If we are unable to, we will take reasonable steps to note the requested correction in our records against your data.

If you would like to exercise the above rights, please contact us. In your message, please clearly state what information you are requesting, provide evidence of your identity, and notify us of anything else you deem relevant to your request. Please note that, in considering your request, we may need to request additional information from you in order to verify your identity prior to acting on your request.

We only want to communicate with you if you want to hear from us. Accordingly, if you receive promotional material from us but would prefer not to receive such information, please unsubscribe using the link in the email which we sent to you (see bottom of each email) or contact us to have your name removed from future publication mailings. If you ask us to remove your name and address from promotional lists, please note that it may take up to 2 working days to process your request, during which period you may continue to receive communications from us.

If you unsubscribe from receiving promotional material, you will still receive order confirmation and status emails for any orders placed by you using your email address. We may also need to contact you via telephone, email or postal mail with questions or information regarding your order.

Our Website may contain links to third-party websites. If you follow a link from our Website to any other website, the owner(s) of that site will not be bound by our Policy and may have their own policy in place. We suggest that you review any applicable privacy policies on those websites before you provide any personal information.