Privacy Policy

KiwiKandy (kiwikandy.com)

Effective date: 23 March 2026
Last updated: 16 August 2026

1. Who we are

KiwiKandy is operated by Obsessed ASF Ltd, a New Zealand company based in Auckland ("we", "our", "us"). We run the website kiwikandy.com (the "Site") and sell New Zealand lollies, chocolate, biscuits and spreads to customers worldwide. We are the controller of the personal information collected through the Site.

This policy explains what we collect, how we use it, who we share it with, and the rights and choices you have. The fastest way to reach us about anything in it is our contact form.

2. Information we collect

2.1 Information you give us

Orders: your name, email address, phone number, delivery and billing address, and what you bought. Payment card details go directly to Stripe, our payment processor. They never touch our servers and we never see your full card number.
Accounts: your name, email address and password when you create an account.
Mailing list: your email address when you join through the Site.
Contact form: your name, email address and message.
Product reviews: the display name, country and review text you submit. Reviews are published on the Site.
Stock alerts: the email address you leave so we can tell you when a treat is back.

2.2 Information collected automatically

Device and usage data: IP address, browser and device type, and the pages you visit and actions you take on the Site, collected through Google Analytics (see sections 6 and 8).
Approximate location: we use the country your IP address points to so we can show prices in a sensible currency and the right shipping information.
Abuse prevention: when you submit the contact form, join the mailing list or set a stock alert, we record the IP address the request came from to limit spam and abuse.
Email engagement: whether emails we send you were delivered, opened or clicked (see section 7).

2.3 Information from others

Stripe: payment confirmation and fraud-prevention signals.
DHL Express and NZ Post: delivery status and tracking events for your parcel.
Google: aggregated reporting on how the Site and our advertising perform.

3. How we use your information

Processing and delivering your orders, including the customs declarations international parcels require
Emailing you about your order: confirmation, dispatch, delivery and any problems along the way
Answering your enquiries and support requests
Sending marketing email where you have joined the mailing list or created an account (see section 5)
Advertising KiwiKandy and measuring whether that advertising works (see section 6)
Understanding how the Site is used so we can improve it
Preventing fraud and abuse, including abuse of promo codes and the referral programme
Meeting legal obligations such as tax record-keeping and customs law

4. Legal bases for processing

Where privacy law asks us to name a legal basis, we rely on:

Contract: processing needed to take your order, deliver it and support you afterwards.
Consent: marketing email. You can withdraw it at any time with the one-click unsubscribe in every marketing email.
Legitimate interests: measuring our advertising, understanding how the Site is used, preventing fraud and abuse, and running our business, balanced against your rights.
Legal obligation: keeping tax records and completing customs declarations.

5. Marketing email

You end up on our mailing list in one of two ways: you join through the Site (the signup card or the footer form), or you create an account, which signs you up as stated on the registration form. We send new treats, restocks, deals, reminders about carts left behind, and invitations to review treats you bought.

Every marketing email carries a one-click unsubscribe link, and you can also manage what we send from your notification settings. When you unsubscribe we keep your address on a suppression record so marketing to you stays stopped. We never sell or rent the mailing list.

6. Advertising

We advertise KiwiKandy online, mainly through Google, and we measure whether that advertising leads to orders:

Google's tags on the Site, loaded through Google Tag Manager (including via our own measurement subdomain), record browsing activity such as products viewed, carts and purchases against Google's cookies.
When you complete an order, we send Google a record of the purchase (order value, currency and items, but not your name, email or address) so the sale can be matched to the advertising that led to it.
Google may use its cookies to show you our ads on other websites and apps (remarketing).

The Site does not send browsing data to Meta. There is no Facebook or Instagram pixel here. Where we promote KiwiKandy on those platforms, who sees it is decided inside those platforms under Meta's own privacy policy.

You can opt out of personalised Google advertising at Google Ads Settings, block Google Analytics with the Google Analytics opt-out browser add-on, and opt out of interest-based advertising generally through the Digital Advertising Alliance or the Network Advertising Initiative.

7. Email delivery and tracking

Our email is delivered by Maileroo. Order emails and marketing emails include open and click tracking: a tiny image that tells us the email was opened, and links that pass through a counter on their way to where they point. We use this to know what arrived, what got read and what was useful. Security emails such as password resets are never tracked.

These tracking events are short-lived on our side: the detailed event data is removed after 90 days and the events themselves are deleted within 180 days.

8. Cookies and similar technologies

The Site sets a small number of essential cookies of its own. They remember your shopping cart, keep you signed in to your account, remember your display currency, and remember a referral link you arrived through so your friend's Kiwi Koins arrive if you order. None of them track you across other websites.

Analytics and advertising cookies are set by Google when you browse the Site: the _ga family of cookies, used for Google Analytics and the advertising measurement described in section 6.

Cloudflare sits in front of the Site for security and performance. It reports aggregate, cookieless traffic statistics to us and may set its own operational cookies.

The Site also keeps a few small flags in your browser's local storage, for example so the mailing-list invitation stays away once you have dismissed it. These flags identify nothing about you.

You can block or delete cookies in your browser settings. The essential cookies above are needed for the cart and checkout to work, and the Google opt-outs in section 6 cover the analytics and advertising cookies.

9. Who we share information with

We do not sell your personal information. We share it with the services that run the shop, and each one only gets what its job needs:

Stripe processes payments (including Apple Pay and Google Pay) and screens for fraud.
DHL Express delivers overseas orders and handles customs clearance, which means your name, address, phone number and the contents and value of your parcel appear on the customs declaration. NZ Post carries New Zealand orders.
Maileroo sends our email and reports delivery, open and click events back to us.
Google provides the analytics and advertising services described in sections 6 and 8.
Cloudflare provides security, content delivery and image hosting for the Site.
Geoapify powers address suggestions at checkout: as you type your delivery address, the text you have typed so far is sent through our server to Geoapify to suggest completions.
Hosting providers run the servers and databases behind the Site.
Professional advisers (accountants, lawyers) where necessary, and government authorities where the law requires it.

10. International data transfers

We are based in New Zealand and ship worldwide, so your information may be processed in New Zealand, the United States and other countries where the providers above operate. Where a transfer needs safeguards we rely on measures such as standard contractual clauses. New Zealand itself holds adequacy status under both EU and UK law, meaning its privacy protection is officially recognised as comparable.

11. How long we keep information

Order and transaction records: 7 years, as New Zealand tax law requires.
Your account: until you ask us to delete it.
Mailing list: until you unsubscribe. After that we keep your address on the suppression record so marketing to you stays stopped.
Email delivery and engagement events: detail stripped after 90 days, deleted within 180 days.
Contact form messages: as long as needed to resolve your enquiry, plus a reasonable period after.
Analytics data: held by Google for the retention period configured in our analytics account.

12. Your rights

To exercise any of the rights below, use our contact form. We may ask you to confirm the request from the email address we hold for you, and we respond within the timeframe the law that applies to you sets.

12.1 New Zealand (Privacy Act 2020)

You have the right to access and request correction of your personal information. If you believe we have breached your privacy, you may complain to the Office of the Privacy Commissioner.

12.2 European Economic Area and United Kingdom (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your personal data ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with your local data protection authority

12.3 United States

Residents of certain US states (including California, Virginia, Colorado and Connecticut) may have additional rights, such as the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale or sharing. We do not sell your personal information.

12.4 Australia (Privacy Act 1988)

You have the right to access and correct your personal information under the Australian Privacy Principles, and may lodge a complaint with the Office of the Australian Information Commissioner.

12.5 Canada (PIPEDA)

You have the right to access, correct and challenge the accuracy of your personal information, and may file a complaint with the Office of the Privacy Commissioner of Canada.

13. Data security

We take reasonable technical and organisational measures to protect your personal information, including:

TLS encryption on every page of the Site
Payment processing through Stripe, a PCI-DSS compliant provider, so card details never reach our servers
Access to personal data limited to the people who need it to do their job

No method of transmission or storage on the internet is completely secure. We work to protect your information, and we cannot guarantee absolute security.

14. Children's privacy

The Site is not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe we have inadvertently collected information from a child, contact us and we will delete it promptly.

15. Third-party links and social media

The Site may link to websites we do not operate, and we are not responsible for their privacy practices. We also keep pages on Facebook and Instagram. When you interact with those pages, Meta processes that activity under its own privacy policy, and we may use it to answer your enquiries and run promotions.

16. Changes to this policy

We may update this policy as our practices, tools or legal obligations change. When we make material changes we update the "Last updated" date at the top of this page. We encourage you to review it from time to time.

17. Contact us

Obsessed ASF Ltd, trading as KiwiKandy
Auckland, New Zealand
Contact: our contact form
Website: kiwikandy.com