Privacy Policy.

Privacy Policy

Introduction

We respect your privacy and are committed to protecting your personal information. We have developed this Privacy Policy to inform you about:

• the kind of information collected by us;
• the purposes for which we may collect, hold, use and disclose your Personal Information;
• how we hold, use, and disclose your Personal Information;
• how you can access or correct your Personal Information that is held by us; and
• how you may lodge a complaint and how we will deal with it.

You should read this Privacy Policy in conjunction with our Terms and Conditions of Use, which incorporate this Privacy Policy. You can find them here.

Information About Us

This Privacy Policy is intended to cover Cerebos Gregg’s Limited (Cerebos Gregg’s) and where applicable includes its directors, employees, associated entities and affiliates in New Zealand. References to “we”, “us” or “our” are references to Cerebos Gregg’s.

We are regulated (as relevant) by the Information Privacy Principles, contained within the Privacy Act 1993 (Privacy Act).

Collection of Your Personal Information

"Personal Information" means any information from which your identity is apparent or can be reasonably ascertained.

We may collect, use, store and transfer different kinds of your Personal Information, which could include:

• Identity and contact Information such as first name, last name, marital status, date of birth, gender, home address, email address and telephone numbers;
• Financial Information such as bank account and payment card details;
• Transaction Information which may include details of purchases;
• Technical Information such as an internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website;
• Profile and Usage Information such as your website username and password, purchases or orders made by you, information about your interests, preferences, feedback and survey responses and how you use our website, products and services;
• Marketing and Communications Information such as your preferences in relation to receiving marketing from us and third parties and for the ways we communicate with you;
• Social Media Information such as likes, comments and other interactions with our social media accounts.

Collection of Your Sensitive Information

We collect minimal amounts of sensitive information (which could include information about your race, ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, or biometric data). We will only collect sensitive information (for example, information regarding your health) which is provided to us by you (or is provided to us with your consent) and which is reasonably necessary to fulfil our legal obligations.

How Your Personal Information is Collected

We use various methods to collect your personal information, including:

• Directly from you – where you give us Personal Information by filling in forms or by communicating with us. This includes Personal Information you provide when you:

1. create an account on our website;
2. request marketing material to be sent to you;
3. enter a competition, promotion or survey; or
4. provide feedback or raise a concern or complaint.

When you contact us by phone, email or social media we may keep a record of that communication.

• By automated means – when you interact with our website, we may automatically collect technical information such as your IP address or information about browsing actions and patterns. We collect this Personal Information by using cookies and other similar technologies. We may also receive information about you if you visit other websites employing our cookies.

• From third parties and publicly available sources. In some instances, we may collect your Personal Information from various third parties that may include:

• analytics providers such as Google; and
• providers of technical, payment and delivery services.

How We Use or Disclose Your Personal Information

We collect, use and disclose your Personal Information for a range of purposes. These purposes depend largely upon your relationship with us. Most commonly, we will use your Personal Information for the following purposes:

• where necessary to establish and perform your contract with us, such as where you buy products directly from us;
• to notify you of products and services that may assist you, including any special offers available;
• to deal with any queries;
• to comply with our mandatory legal obligations, which can arise in a variety of ways such as in connection with health and safety, transfer of a business, regulatory investigations, legal proceedings or disclosure to a law enforcement agency;
• to improve the quality and level of our products and services;

We may, where necessary for our business, contract our various services associated with our functions and activities. This may involve the disclosure and sharing of your Personal Information (subject to this Privacy Policy and the provisions of the Privacy Act 1993) to other persons or organisations that we engage on our behalf or to other companies within our group of companies.

Please be assured that our service providers and subcontractors are contractually obliged to comply with the Privacy Act and to ensure that your Personal Information is handled in a manner consistent with our obligations under this Privacy Policy.

The types of persons and organisations to which we may disclose your Personal Information include the following:

• organisations with whom we have arrangements or agreements for the purpose of promoting our products or services and any agents used by us in administering such arrangements or agreements;
• our agents, contractors and external advisers who carry out our functions and activities or who assist us to carry out our functions and activities from time to time; and
• other parties to whom we are authorised or required by law to disclose information such as law enforcement agencies, regulatory bodies and other government agencies.

Unsolicited Personal Information

We do not generally receive any Personal Information without requesting it.

If we do receive your Personal Information without requesting it (unsolicited), we will treat such information in the same way as if we had asked for it, that is, in accordance with this Privacy Policy and the Privacy Act.

If within a reasonable time, we determine that the unsolicited Personal Information received by us is not reasonably necessary for one or more of our functions or activities or where it is it collected by unlawful and unfair means or without your consent, we will destroy or de-identify your Personal Information as soon as is practicable, but only if it is lawful and reasonable to do so and if the information is not contained in a government record.

Security of Your Personal Information

We take reasonable steps to protect your Personal Information from misuse, interference and loss and from unauthorised access, modification or disclosure. We do this by means of various physical and electronic security measures, including restricting physical access to Our offices and implementing several technological and security policies and procedures.

We may use servers outside New Zealand (for example Australia, USA or UK) to route through and store your Personal Information. A number of policies and procedures are in place to ensure the safety and secure storage of your Personal Information handled and stored by Us.

Data Retention

We are required by law to retain various types of records for different periods, depending on their contents.

We will therefore keep Personal Information for as long as we reasonably consider we may need to in connection with those obligations.

Where we no longer require your Personal Information for the purpose for which this information was collected, we will take all steps reasonable in the circumstances to destroy the information.

Use of Your Personal Information for Direct Marketing

We only use or disclose your Personal Information for direct marketing purposes (that is, to communicate with you directly to promote our goods and services) when we have your permission to do so, or where you have a reasonable expectation that your Personal Information will be used for this purpose and where you have not opted out from Us contacting you.

In cases where you would not expect Us to use your Personal Information for direct marketing purposes or the information has been collected by Us from a third party, we will use or disclose your information for direct marketing purposes with your consent and within each communication provide you with a simple and obvious means by which you may easily opt out or unsubscribe from receiving further communications from us.

Access to Your Personal Information

You may request details of the Personal Information we hold about you by writing to us. We will respond to your request within a reasonable period of time and give you access to the information in the manner requested by you if it is reasonable and practicable to do so.

In general, we will allow you access to the Personal Information we hold about you, unless a specific exception applies, and will take such steps as are reasonable to provide you with the information in the form you require.

If we deny you access to any Personal Information following an access request or provide you with access not in the manner requested by you, we will give you a written notice that will set out the reasons for the denial and the mechanisms available to you to complain about our refusal.

We will not charge any fee for the provision of this information, except when we are required to spend an unreasonable amount of time or effort to provide you with the information. If there is a charge, it will not be excessive and will not apply to the making of the request.

Where your consent has already been provided, you may withdraw consent to our use of your Personal Information at any time. We will respond to your request within a reasonable period of time and give you access to the information in the manner requested by you if it is reasonable to do so.

We will take all reasonable steps to ensure that your Personal Information that is in our possession is accurate, up-to-date and complete. If you are aware that any of your Personal Information is inaccurate, incomplete or out of date, please inform us so that we can update our records.

Information About Our Complaints Resolution Process

If you have a complaint about the way we collect, store or handle your Personal Information please contact us via PrivacyNZ@kraftheinz.com

Within a reasonable period after the complaint has been made, we will follow up and investigate the complaint with a view to resolving it with you directly.

We will provide you with a written note with the results of our investigation and the mechanisms available to you to complain if you are not satisfied with our investigation or proposed resolution.

You can also contact The Office of the Privacy Commissioner (http://www.privacy.org.nz) if you believe that your privacy has been interfered with or if you are not satisfied with the results of our investigation.

Changes to the Privacy Policy

Our Privacy Policy is reviewed on a regular basis. We may change our policies and update the Privacy Policy from time to time. We may send you updated the Privacy Policy using methods we choose from time to time, and the most up-to-date copy will be published on our website at https://www.greggs.co.nz/

This policy was last updated on 26 August 2020.

Enquiries

If you have any concerns or enquiries about how we deal with your Personal Information, you should contact us:

Privacy Officer
Cerebos Gregg’s Limited

By email: PrivacyNZ@kraftheinz.com

513 King Street North,

Hastings, 4122 New Zealand

Updated 26 August 2020