Privacy Policy (New Zealand) by OLL
Prefer the original wording?
PRIVACY POLICY
Effective date: [effective date]
Note: Use this Policy if you run a New Zealand business, online or offline, and want to tell your customers, website visitors and people who contact you how you handle their personal information. Every business that collects personal information must follow the Privacy Act 2020, whatever its size: New Zealand has no small business exemption. This Policy does not cover information about your employees or job applicants, which needs its own privacy statement, and it is not for health agencies, which must also follow the Health Information Privacy Code 2020. Complete every yellow field, keep one Option in each Option block and delete the others and the Option labels, and delete any optional Clause you do not need. Renumber the Clauses only when you have finished, because these notes refer to the original Clause numbers.
Note: Make this Policy describe what your business actually does. A privacy statement that says you do something you do not do, or leaves out something you do, can be misleading conduct under the Fair Trading Act 1986, and the Privacy Commissioner can act on a gap between what you say and what you do. Before you publish, check each Clause against the information you collect, your forms, your website and its tools, the providers you use and where they hold information. Review the Policy whenever you add a tool, a provider or a new use of information, and update the effective date.
Note: Publishing this Policy is not enough on its own. Before you collect personal information or, if that is not practicable, as soon as practicable afterwards, you must take reasonable steps to make sure the person knows that you are collecting it and why, who will receive it, your name and address, any law that requires or authorises the collection and whether they have to provide it, what happens if they do not, and that they can access and correct it. This Policy covers those points, so link to it or display it wherever you collect information: your website, sign-up and checkout pages, booking and enquiry forms, and a sign at the counter. You need not repeat this for a person you told recently about the same kind of collection.
This Privacy Policy explains how [legal name of the business] ("we", "us" or "our") collects, uses, holds, shares and protects personal information about you.
Note: Use the full legal name of the business as it appears on the Companies Register or, for a sole trader, the owner's full name. If you trade under another name, add it after the legal name, for example: Smith Plants Limited, trading as Green Thumb Garden Centre.
1. ABOUT THIS POLICY
1.1 This Policy applies to personal information about our customers, people who visit our website or premises, and anyone else who contacts us or deals with us. Personal information is information about an identifiable individual.
This is a preview. The full template is free on GitLaw.
This privacy policy is for New Zealand businesses to inform customers and website visitors about how their personal information is handled under the Privacy Act 2020. It includes specific modules for online payments, CCTV security, and biometric technology like facial recognition.
5.0 out of 5 on Google
Read reviewsAs seen in
About this template
What is this template?
This is a public-facing privacy disclosure document specifically tailored for New Zealand's 2020 privacy regime. It contains specific modules for biometric processing and CCTV that are not found in standard global policies. It is not an internal employee data policy or a specialized health agency disclosure.
When should you use it?
Use this when your New Zealand business collects personal data from customers at a counter, through a website, or via security cameras. Use a separate Employment Privacy Policy for staff data or the Health Information Privacy Code for medical records.
What's inside
| Clause | Name | What it does |
|---|---|---|
| 2 | The Information We Collect | Lists personal data types collected, including name, contact details, order history, login preferences, and website usage data. |
| 6 | Storing Information Outside New Zealand | Specifies whether service providers store information in named countries or within general cloud infrastructure outside New Zealand. |
| 9 | CCTV Cameras | Discloses the use of security cameras at specific locations and sets a defined retention period for footage. |
| 11 | Biometric Technology | Provides mandatory notices for automated facial or feature recognition, including trial periods and available alternatives for customers. |
| 14 | Seeing and Correcting Your Information | Sets a 20-working-day deadline for responding to customer requests to access or correct their personal information. |
| 16 | Complaints | Directs unsatisfied customers to the Privacy Commissioner and provides specific contact details and postal address in Wellington. |
Who it's for
- a New Zealand business using CCTV or facial recognition technology on its premises
- an online retailer in New Zealand processing payments through third-party providers
- a New Zealand organisation storing customer data in overseas cloud services
- a local business needing to comply with mandatory privacy breach notification rules
Law it's drafted under
Frequently asked questions
A template isn't binding on its own - like any contract, it becomes binding once it's properly completed and signed. Templates in our curated library are professionally drafted for US or UK law; review any template before you sign it.
Yes. Chat with GitLaw to edit any section, or make changes directly in the editor.
Yes, read about team plans here.
Describe what you need in the chat and GitLaw will draft it for you.
Templates in our curated library are professionally drafted for US or UK law. The wider library comes from the GitLaw community and public sources - a solid starting point, but check any template fits your situation before you rely on it.
Mostly US and UK law. Some templates use general commercial terms that work across jurisdictions, and many note which law they're written for.
It depends on the situation. Templates work well for routine business agreements. For anything involving significant money, complex IP, employment, or areas you're unsure about, it's worth getting professional advice before you sign. GitLaw provides templates and tools, not legal advice.
Open any template in GitLaw and describe the change you want in the chat — 'make clause 4 mutual' or 'add a 30-day notice period', for example. GitLaw drafts the revised language and shows it as a suggested edit. You accept, reject, or keep editing from there.
Yes. Upload a Word, PDF, or Markdown file and GitLaw will open it in the editor. You can review, edit, or chat with GitLaw about it the same way you would with any template from the library.
Trusted by 5,000+ businesses
From template to signed, in one place
Every template opens in an editor with an AI agent alongside it.
Open
Pick a template and open it. Nothing to download, and no credit card to start.
Free to open
Edit with AI
Describe your situation in chat and the agent adapts the wording, clause by clause.
Tracked changes you can review
Send and sign
Share it for negotiation, then collect signatures without leaving GitLaw.
eSign included
Built for your legal work,
with practicing lawyers
Trained on 5,500+ clauses and specialist areas of law. Built with a standards committee of independent lawyers.
As seen in
Ready to get started?
No sales calls, no credit card. Just chat with GitLaw.
GitLaw provides templates and tools, not legal advice. Templates are a starting point, not a substitute for advice on your situation - for anything significant, speak to a qualified lawyer.