Spa World Limited, NZBN 9429030890411 Last updated: 22-7-26
Policy overview
This Privacy Policy is maintained by Spa World Limited, NZBN 9429030890411 ("we", "our", "us"). It explains how we collect, use, store, disclose and protect your personal information, and applies whenever you use our website, interact with a system or database maintained by us, or otherwise deal with us.
By using our website or transacting with us, you acknowledge the contents of this Privacy Policy. It is in addition to any other terms and conditions that apply to our goods, services or websites.
We comply with the Privacy Act 2020 and the Information Privacy Principles (IPPs). We recognise the importance of protecting personal information, meaning information about an identifiable individual.
We may update this Privacy Policy from time to time. The current version is always the one published on this page, and the "last updated" date above shows when it last changed. Please review it periodically.
1. Personal information we collect
a. The personal information we may collect includes your name, contact details (postal and residential address, telephone number, email address) and relevant financial information.
b. We usually collect personal information directly from you, for example when you visit a showroom, contact us by phone, email or online form, request a quote, or register with us.
c. In some cases we collect personal information about you from other sources, such as a person you have authorised to act for you, a trade reference or credit reporting agency (to help us decide whether to offer credit), publicly available sources, or third parties who are licensed by us to sell or distribute our goods or services or to engage with customers on our behalf.
d. Registration (online or in store) is optional. If you register, we may collect your name, email address, postal address, telephone numbers, your marketing preferences, and related information so you can make full use of our services.
2. Notice when we collect your information from someone else (IPP 3A)
From 1 May 2026, where we collect personal information about you from a source other than you (for example from a licensee, a credit reporting agency, or a third party who refers you to us), we take reasonable steps to make sure you are aware of:
- the fact that we have collected your information and, if relevant, that collection is required or authorised by law;
- the purpose for which we collected it;
- who we may disclose it to;
- our identity and contact details;
- your rights to access and correct the information; and
- any consequences for you if the information is not collected.
Where practicable we give this notice at or around the time of collection. This obligation applies to personal information collected indirectly on or after 1 May 2026.
3. Personal information about other people
You should only give us another person's personal information if you have their authority to do so. You should also take reasonable steps to make them aware of this Privacy Policy. If you provide another person's personal information, you confirm you have their authority and have told them about this policy, and we will rely on that.
4. Anonymity
You may deal with us anonymously or under a pseudonym where practicable, and we will do our best to help. However, without your identity we may be limited in what we can do, and in some cases we may be unable to provide goods or services to you.
5. How we use and disclose your information
a. We use personal information for the purpose it was collected, for related secondary purposes you would reasonably expect, for purposes disclosed in this policy or at the time of collection, for any purpose you authorise, and as required or authorised by law.
b. We collect and use personal information to run our business and to provide and market our goods and services to you, including purposes necessary or incidental to providing them. We may share your personal information with our related or associated entities, and with third parties (including licensees) where necessary to provide you with goods or services.
c. We keep personal information only for as long as needed for the purpose it was collected or as required by law, and take reasonable steps to destroy or de-identify it when it is no longer needed.
d. We may disclose personal information where we reasonably believe it is necessary to protect our rights or property, our customers or others, or where we believe in good faith that the law requires disclosure.
e. We may engage third parties to provide goods or services on our behalf and disclose your personal information to them for that purpose.
6. Use of AI and automated tools
We use software tools, including artificial intelligence tools, to help us run our business. Examples include customer service and support systems, chat and messaging tools, transcription, and analytics.
Where we use these tools:
- A person remains responsible for decisions that affect you. We do not use automated systems as the sole basis for significant decisions about you without human review.
- We do not enter your payment card details, passwords, or sensitive information into AI tools.
- Some of these tools process information on servers outside New Zealand. See section 9 (transborder data flows).
If you ask whether you are dealing with a person or an automated system, we will answer honestly.
7. Security
a. We take reasonable steps to protect the personal information we hold from loss and from unauthorised access, use, modification or disclosure, and we review our security measures as technologies change.
b. Our employees and the contractors who support our information systems are required to respect the confidentiality of personal information and to comply with this Privacy Policy. We use contractors based in the Philippines who may access your order information and contact details in order to provide customer service.
c. No transmission over the internet is completely secure. While we take reasonable steps to protect your information, we cannot guarantee the security of information sent to us electronically. Our liability for data security is limited to the maximum extent permitted by law.
8. Notifiable privacy breaches
We take the security of your personal information seriously, but data breaches can occur. Under Part 6 of the Privacy Act 2020, a notifiable privacy breach is a breach that it is reasonable to believe has caused, or is likely to cause, serious harm to an affected individual or individuals.
If we have reasonable grounds to believe a notifiable privacy breach has occurred, we will notify the Office of the Privacy Commissioner and affected individuals as soon as reasonably practicable.
9. Transborder data flows (IPP 12)
Some personal information may be transferred outside New Zealand, for example where we use overseas service providers (including some AI, cloud and customer service tools) or our Philippines-based customer care contractors.
Before disclosing personal information to an overseas provider, we take reasonable steps to satisfy ourselves that the recipient protects the information with safeguards comparable to those under the Privacy Act 2020 (IPP 12), or that another basis for the transfer under IPP 12 applies. Our commitment to protect your privacy does not change when information is transferred overseas.
10. Cookies and website information
a. Our web servers log information such as IP address, browser type, referring page and time of visit to help diagnose problems and analyse site usage. This information is generally aggregated.
b. We use cookies to improve your experience, maintain your session, and analyse how the site is used. You can block or delete cookies through your browser settings, though some features may not work as a result.
c. We and third parties may use analytics and advertising tools that set cookies to measure and improve our marketing. You can manage advertising preferences through your Google Ad Settings and through your browser.
d. Our site links to third-party websites we do not control. We are not responsible for their conduct or privacy practices. Review their terms and privacy policies before providing personal information.
11. Accessing and correcting your information
a. We take reasonable steps to keep the information we hold accurate and up to date. If you believe information we hold is incorrect, contact our Privacy Officer to have it corrected.
b. You may request access to the personal information we hold about you by contacting our Privacy Officer. Except where a legal restriction applies, we will provide access. If we refuse, we will explain why. We will deal with requests as quickly as possible.
12. Complaints
If you have a complaint about how we have collected, used, stored or disclosed your personal information, please contact our Privacy Officer by email at info@spaworld.co.nz. We take privacy complaints seriously and will investigate, including how any breach occurred and how to prevent it happening again.
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz.
13. Contact
Privacy Officer Spa World Limited 203A Waimea Road, Bishopdale, Nelson 7010 NZBN: 9429030890411 Email: info@spaworld.co.nz
For more information about privacy in New Zealand, visit the Office of the Privacy Commissioner at https://www.privacy.org.nz
