1. Who We Are

O2Sync NZ is a New Zealand-owned and operated business based in Napier, Hawke's Bay. We sell mouth tape and nasal strips online at o2sync.co.nz. You can contact us about privacy matters at o2syncnz@gmail.com.

2. What Personal Information We Collect

We may collect the following personal information when you place an order or contact us:

• Identity information: your full name
• Contact information: email address, phone number (if provided)
• Delivery information: physical shipping address (New Zealand addresses only)
• Payment information: card details — processed directly and securely by Stripe; we do not store card numbers
• Order information: products ordered, quantities, order history, and subscription details
• Communications: any messages you send us via our contact form or email

We collect this information directly from you when you place an order, subscribe to a plan, or get in touch. We do not collect sensitive information (as defined by the Privacy Act 2020) and we do not engage in any automated decision-making that produces legal or significant effects.

3. Why We Collect Your Information (IPP 1 & 2)

We collect your personal information only for purposes that are directly related to our functions as a retailer, including:

• Processing and fulfilling your orders
• Arranging delivery (including rural delivery where selected)
• Sending order confirmations, tax invoices, and renewal notifications by email
• Managing your subscription, including billing and cancellations via the Stripe customer portal
• Responding to enquiries and providing customer support
• Complying with legal obligations (e.g., GST record-keeping under the Goods and Services Tax Act 1985)

We will not use your information for any purpose that is not directly related to why it was collected without obtaining your consent first.

4. Who We Share Your Information With

We do not sell or rent your personal information to third parties. We share it only where necessary to deliver our services, with the following trusted service providers:

• Stripe Inc. — payment processing and customer portal. Stripe is PCI-DSS compliant. Your card details go directly to Stripe and never pass through our servers. See Stripe's Privacy Policy.
• Supabase Inc. — secure database hosting for order records and stock management. Data is stored on servers in the AWS ap-southeast-2 (Sydney) region.
• Resend Inc. — transactional email delivery (order confirmations, invoices, renewal notices).
• New Zealand Post / courier providers — your name and delivery address are passed to our courier to complete delivery of your order.
• Netlify Inc. — our website is hosted on Netlify's platform.

These providers act as our agents and are only permitted to use your information to perform services on our behalf. Where personal information is transferred offshore (e.g., to Stripe or Resend servers located outside New Zealand), we take reasonable steps to ensure it receives comparable protection to that required under the Privacy Act 2020 (IPP 12).

5. How Long We Keep Your Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Order records are generally retained for seven years to meet our obligations under New Zealand tax law. You may request deletion of your information at any time — see section 7 below.

6. Security

We take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure (IPP 5). Our website uses HTTPS encryption. Payment processing is handled entirely by Stripe using industry-standard security. Access to our database is protected by row-level security and API key controls.

While we take these precautions, no method of transmission over the internet is 100% secure. If you become aware of any security concern related to your information, please contact us immediately.

7. Your Rights (IPP 6 & 7)

Under the Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Correct any personal information that is inaccurate, incomplete, or out of date
• Request deletion of your personal information (subject to any legal retention requirements)
• Complain to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act 2020

To exercise any of these rights, please contact us using the details in section 8. We will respond to your request within 20 working days, as required by the Privacy Act 2020.

8. Complaints

If you have a concern about how we have handled your personal information, we encourage you to contact us first so we can try to resolve it. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:

• Website: www.privacy.org.nz
• Phone: 0800 803 909

9. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on this page with the date it was last updated. Continued use of our website after any changes constitutes acceptance of the updated policy.