Privacy Policy

Privacy Policy

1. Introduction

1.1 We understand that protecting your personal data is important.

1.2 This Privacy Policy (Privacy Policy) sets out our commitment to protecting the privacy of personal data provided to us, or otherwise collected by us when you use and interact with our Website, communicate with us or purchase Goods, among other things. We have used examples in this Privacy Policy to help explain some points – please remember that these examples describe common scenarios but do not necessarily cover all situations.

1.3 Please note that this Privacy Policy applies in conjunction with our Terms of Service and any other terms and conditions that you agree to when using or signing up to our Website. To the extent that any such terms conflict with this Privacy Policy, the terms of this Privacy Policy will apply instead.

1.4 We encourage you to read this Privacy Policy carefully. If you provide personal data to us, you understand we will process it in accordance with this Privacy Policy. If you do not provide personal data to us, however, it may impact our ability to provide the full functionality of our Website to you and your use of the Website. If you have any questions, please contact us using the details set out at the bottom of this Privacy Policy.

1.5 This Privacy Policy explains:

  1. the kinds of personal data we may collect from you and how we might collect that information;
  2. how we may use your personal data and the reasons we collect it;
  3. how we will store your personal data;
  4. the circumstances in which we may disclose your personal data overseas;
  5. our use of cookies and analytics tools in connection with our Website;
  6. your rights to request access to and correction of your personal data; and
  7. how you can contact us if you have any other questions regarding our processing of your personal data.

2. Definitions

2.1 In this Privacy Policy, initially-capitalised terms shall have the meanings given to them in the Terms of Service unless otherwise defined below:

  1. applicable privacy laws means the requirements of privacy laws, codes and regulations relevant to you in the country you reside in, including as applicable the New Zealand Privacy Act;
  2. a reference to Eternal Blue, we, us or our is to Ellevate Health & Beauty Limited (New Zealand company number 8229756) trading as Eternal Blue;
  3. personal data means identifiable data about you, for example your name, email, address, telephone number and so on. If you cannot be identified (for example, when personal data has been aggregated and anonymised to the extent you can't reasonably be identified) then certain parts of this Privacy Policy may not apply to that information. This includes "personal information" as it is defined under applicable privacy laws;
  4. Privacy Act means the Privacy Act 2020 of New Zealand, as the same may be amended or replaced from time to time.
  5. where we refer to processing of your personal data, we mean all activities relating to our use of that personal data, from its collection through to its storage and disposal and everything in between, and process shall be interpreted accordingly;
  6. Terms of Service means the Eternal Blue terms of service as published on the Website and as amended or updated from time to time in accordance with their terms;
  7. a reference to our Website is to our website at www.eternalblue.co.nz, any other website(s) and/or e-commerce platform(s) owned, operated and/or managed by Eternal Blue and to any Services that are or may be available on any of them; and
  8. a reference to you, your is to any user of the Website and/or Services or purchaser of Goods.

3. The types of personal data we may collect about you

3.1 The types of your personal data we may collect include:

  1. identity data (including first / middle / last name, date of birth);
  2. contact data (including billing / delivery address, email address and telephone numbers);
  3. financial data (including bank account and payment card details, which are collected and processed by our third party payment processor, Stripe, Inc.;
  4. transaction data (including details about payments from you to us and other details of Goods you have purchased from us);
  5. technical and usage data (including IP address, login data, browser session data, device and network information, statistics on page views and sessions, acquisition sources, search queries and/or browsing behaviour, information about access and use of or communications with our Website, including through the use of cookies, the type of browser being used to access the Website, the type of operating system being using and the ISP domain name);
  6. profile data (including your log in for the Website, support requests you have made, your interests, preferences, feedback and survey responses, additional personal data that you provide to us, directly or indirectly, through your use of the Website, associated applications or accounts from which you permit us to collect information);
  7. marketing and communications data (including communication preferences, preferences in receiving marketing material from us and/or our third party partners); and
  8. requested data (including any other personal data requested by us and/or provided by you or a third party).

4. When and how we might collect your personal data

4.1 The ways we collect your personal data can be categorised into: (1) information you provide us directly, (2) information that is collected automatically and (3) information we indirectly collect from third parties.

Information you provide to us directly

4.2 The personal data we collect directly from you may include the below:

  1. information contained in or relating to any communication that you send to us or that we send to you (communication data). The communication data may include the communication content and metadata associated with the communication;
  2. data allowing us to get in touch with you (contact data). This contact data may include your name, email address, telephone number, postal / delivery address and other information you provide us when you send us communication data;
  3. information relating to transactions, including purchases of Goods from the Website (transaction data). The transaction data may include payment card details or other payment and transaction details;
  4. data that you provide on creation of your Account (Account data). This Account data may include your name, email address, account creation, business organisation, Website settings and marketing preferences; or
  5. personal information about your hair, scalp or related wellness (for example, through a quiz or consultation or when contacting our support team) (wellness information). Where you choose to provide wellness information, we collect and use it only to provide and improve our Goods and Services and to respond to you. We limit access to staff who need it and hold it securely. You do not have to provide this wellness information, but if you do not, we may be unable to offer certain recommendations or features.

Information that is collected automatically

4.3 Our Website uses cookies, which means we automatically collect certain personal data when you use the Website. A cookie is a file created by our Website host server (and stored on your web browser) when you browse the Website which stores information about you and your behaviour on the Website. The cookies used on this Website enable some of the Website's essential functionality and help us provide the best possible service to you by tailoring our Services to best suit your preferences.

4.4 We may use cookies to:

  1. help us analyse the use and performance of our Website;
  2. identify you as you navigate our Website (for example, to record Goods you wish to purchase in your shopping cart and the location from which you are accessing the Website);
  3. collect information about the device you use to access the Website; and
  4. protect our user accounts and the Website generally.

4.5 Most internet browsers give you the option to reject all cookies, accept all cookies, erase cookies stored on your device or be notified before a cookie is stored on your device. However, if you reject or erase the cookies referred to above, some functionality or features of this Website may not function properly or be fully available. Please refer to your internet browser instructions if you want to find out more about rejecting or blocking cookies.

Information collected indirectly from third parties

4.6 We may indirectly collect personal data about you from third parties with your authorisation or where otherwise permitted by law (for example, where the source of the information is publicly available).

4.7 Where you provide us with any personal data about somebody else, you must have that person's authorisation to do so. By providing us with anybody else's personal data, you represent and warrant that you have such person's permission to provide the personal data to us and for us to process that personal data in accordance with this Privacy Policy.

5. How we may use your personal data and the reasons we collect it

5.1 We will primarily use your personal data to provide you with any Goods and/or Services you have ordered or requested from the Website and to support our relationship with you. We will use this personal data generally to manage our Services and business effectively, as well as for potential development of future products and services.

5.2 In particular, we may use your personal data for the following purposes:

  1. communications - to monitor, respond to and/or keep records of our electronic communications and other correspondence with you;
  2. transactions - to provide our Goods and/or Services, provide you with information in respect of our Goods and/or Services, generate invoices and other payment-related documentation;
  3. operations – to operate, improve and enhance the Website. We may analyse the use of our Website or the Services to ensure our Website and/or Services are provided in the most effective manner for you;
  4. marketing - if you opt-in to receive information about our promotional offers and/or newsletters from us, we may use your personal data to contact you by email, text and/or post with the information you have opted-in to receive. You can opt out of marketing communications at any time using the unsubscribe link in any marketing email, by replying STOP to a marketing text, or by contacting our privacy officer (details at clause 12 below). We will still send you non-marketing messages needed to administer your orders and Account. We comply with the Unsolicited Electronic Messages Act 2007 when sending commercial electronic messages;
  5. customer support - to support your use of our Goods and/or Services, this may include assisting with the resolution of product issues or other issues relating to the Website, whether by email or otherwise;
  6. record keeping and reporting – to create and maintain our databases, back-up copies of our databases and business records generally. We may also use your personal data to produce aggregated and anonymised analytics and reports, which we may share publicly or with third parties;
  7. security - in order to detect and/or prevent any illegal activity that may threaten us, or any of our Services;
  8. risk management – where necessary for the establishment, exercise or defence of legal claims. We may also use your personal data where necessary for the purposes of obtaining or maintaining insurance, managing risks and/or obtaining professional advice; and
  9. compliance - in order to comply with any applicable laws and/or regulations or in order to protect your vital interests or the vital interests of another natural person.

6. Other circumstances where we may share your personal data

6.1 We will only share personal data when we are allowed to under applicable data protection laws, or when we are legally required to. We may disclose your personal data:

  1. to our third party service providers for the purpose of enabling them to provide their services to us and therefore to you, including IT service providers, content management system providers, data storage, web-hosting and server providers, debt collectors, maintenance or problem-solving providers, marketing or advertising providers, professional advisors and payment systems operators;
  2. internally within Eternal Blue, including to our employees and contractors;
  3. to our existing or potential agents or business partners;
  4. to anyone to whom our business or assets (or any part of them) are, or may (in good faith) be, transferred;
  5. to courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings (for example, in the event you fail to pay for Goods and/or Services we have provided to you) or in order to establish, exercise or defend our legal rights; and
  6. to any other third parties as required or permitted by law.

7. How we will store your personal data

7.1 We will not keep personal data for longer than is reasonably necessary to fulfil the purposes outlined in this Privacy Policy. We are committed to keeping personal data as safe and secure as possible and we follow generally accepted industry standards to protect the personal data submitted to us.

7.2 Wherever your personal data is stored, we take reasonable steps to ensure that it is protected, including for example access to the personal data we store is limited to those Eternal Blue staff members who have a legitimate business requirement to use it.

7.3 While we continuously implement and update our administrative, technical, and physical security measures to help protect your personal data against unauthorised access, loss, destruction, or alteration, we cannot guarantee the security of the transmission or storage of your personal data.

8. The circumstances in which we may disclose your personal data overseas

8.1 Some of the third parties to whom we disclose your personal data may be located outside New Zealand, for example our payment processor Stripe, Inc. and our cloud hosting and IT service providers. Before disclosing personal data overseas, we comply with Information Privacy Principle 12 of the Privacy Act. We will therefore only do so where we reasonably believe the recipient is subject to privacy safeguards comparable to those under the Privacy Act (whether under that country's law or binding contractual arrangements), where you authorise the disclosure or where another exception under the Privacy Act applies.

8.2 You may contact our privacy officer (details at clause 12 below) for more information about how we protect your personal data when it is disclosed overseas.

9. Your rights in relation to your personal data

9.1 You have certain rights in connection with your personal data, which may include the right to know what personal data we hold about you and the right to request access to, and correction of, your personal data. These rights are subject to certain limitations and exceptions as set out in the applicable privacy laws.

9.2 If you wish to exercise any of the rights described above, please contact our privacy officer using the details at clause 12 below.

9.3 If you have any concerns or wish to make a complaint about our use of your personal data, please contact our privacy officer using the details at clause 12 below and provide us with full details of the complaint. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take in response to your complaint.

9.4 If you are not satisfied with our resolution process you may also have the right to make a complaint to the relevant personal data protection authority.

10. Links to other websites

10.1 Our Website may contain links to other websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal data which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

11. Changes to this Privacy Policy

11.1 We may need to update this Privacy Policy from time to time, including when necessary to reflect changes to this Website, updates to our Goods and/or Services or to reflect any change in law.

11.2 When we update this Privacy Policy, we will revise the "Last updated" date at the top of this Privacy Policy. Where the changes are material, we will use reasonable endeavours notify you, usually by prominently posting a notice of those changes on our Website, by a dialog box that is presented on your log-in or by sending you an email.

12. Contact details

For any questions or notices, please contact our privacy officer at:

Ellevate Health & Beauty Limited t/a Eternal Blue

Address: 76 Westpoint Drive, Hobsonville Auckland

Email: privacy@eternalblue.co.nz