Privacy Policy
Last updated: 2 November 2026
GreenLeaf Pumps ("GreenLeaf Pumps", "we", "us", "our") sells residential macerator pumps to customers throughout New Zealand from our Auckland base. We handle personal information in accordance with the New Zealand Privacy Act 2020 (the "Act") and its 13 Information Privacy Principles.
This policy explains what personal information we collect when you use greenleafpumps.co.nz, our Shopify-hosted checkout at checkout.greenleafpumps.co.nz, or contact us; why we collect it; who we share it with; and how you can access and correct it.
1. What we collect
Information you give us
- Orders: your name, email address, phone number, delivery and billing addresses, the products you buy and your order history.
- Payment details: payments are processed by Shopify and its payment providers. We receive confirmation of payment and the last four digits of your card. We never see or store your full card number.
- Account details: if you create an account, your name, email address and password (stored by Shopify in encrypted form).
- Enquiries and support: anything you send us through the contact form, by email or by phone, including details of your installation and any warranty claim.
- Marketing preferences: whether you have agreed to receive email or SMS marketing from us.
Information collected automatically
- Device and usage data: IP address, browser and device type, pages viewed, the site that referred you, and the date and time of your visit.
- Cookies and similar technologies: described in section 4.
- Advertising identifiers: campaign tags (UTM parameters) and click identifiers from Google (gclid, gbraid, wbraid), Meta (fbclid, _fbp, _fbc) and Microsoft (msclkid) when you arrive from an advertisement.
Information from others
- Shopify provides us with your order and payment status.
- Couriers provide delivery status and proof of delivery.
- Google and Meta provide aggregated reports on how our advertising performs. These reports do not identify you to us.
We do not knowingly collect personal information from children under 16. Our products and website are intended for adults.
2. Why we collect it
We collect personal information only for purposes connected with our business, which are:
- processing, delivering and tracking your order, and sending order and shipping confirmations;
- providing technical support, installation advice, servicing and warranty cover for your pump;
- responding to your enquiries;
- operating your account, if you create one;
- sending marketing communications where you have agreed to receive them;
- measuring and improving our website, products and advertising, including confirming which advertisements lead to sales;
- preventing fraud and keeping our systems secure; and
- meeting our legal obligations, including tax and consumer law record-keeping.
Where it is practical to do so we collect information directly from you. If you choose not to provide information we ask for, we may not be able to complete your order or respond to your enquiry.
3. Who we share it with
We do not sell or rent personal information. We share it only as described here.
- Shopify hosts our product catalogue, checkout, customer accounts and order records, and processes payments through its payment providers. Shopify's own privacy policy also applies: shopify.com/legal/privacy/customers.
- Courier companies receive your name, address and phone number to deliver your order.
- JXM Studio, our website developer, operates the service that receives and stores contact form submissions and forwards them to us.
- Google (Tag Manager, Analytics, Ads and Merchant Center) and Meta (Facebook and Instagram) receive usage and advertising data described in section 4. When an order is completed we may also send Meta a record of the purchase in which your email address, phone number and name are converted to a one-way hash before they leave our systems, so that Meta can match the sale to an advertisement you clicked.
- Vercel hosts our website and provides aggregated, anonymised visitor statistics. Cloudinary hosts images.
- Professional advisers, such as our accountants and lawyers, where needed.
- Government agencies, courts and regulators where the law requires or permits it, for example to comply with a court order or to prevent a serious threat to someone's safety.
- A purchaser of our business, if the business or its assets are sold, in which case this policy continues to apply.
Each of these organisations is only permitted to use your information for the purpose we provide it.
4. Cookies and tracking
Our website uses the following cookies and similar technologies.
| Cookie or technology | Set by | Purpose | Lifetime |
|---|---|---|---|
| cartId | GreenLeaf Pumps | Remembers the items in your cart | Session, or until the cart expires |
| token | GreenLeaf Pumps | Keeps you signed in to your account | Until you sign out or it expires |
| glp_attr | GreenLeaf Pumps | Stores the campaign tags and click identifiers you arrived with so the sale can be attributed to the right advertisement | 90 days |
| Google Tag Manager and Google Analytics (_ga and related) | Measures how visitors use the site and which advertisements lead to sales | Up to 2 years | |
| Meta Pixel (_fbp, _fbc) | Meta | Measures advertising on Facebook and Instagram and allows us to show you relevant advertisements there | Up to 90 days |
| Shopify cookies | Shopify | Operate the checkout, detect fraud and remember your preferences | Varies; see Shopify's cookie policy |
You can block or delete cookies through your browser settings. The site will still work, but your cart may not persist between visits. You can also limit advertising cookies through Google's Ads Settings, Meta's Ad Preferences, and the Google Analytics opt-out add-on.
5. Information sent overseas
Some of the organisations in section 3 store or process information outside New Zealand, including Shopify (Canada and the United States), Google, Meta, Vercel and Cloudinary (United States and other countries where they operate).
Before disclosing personal information overseas we take reasonable steps to ensure it will be protected to a standard comparable to the Act, including by relying on the recipient's contractual commitments and published privacy safeguards. By placing an order or using our website you authorise these disclosures.
6. How we keep it secure
We protect personal information against loss, unauthorised access, use, modification and disclosure by:
- using encrypted (HTTPS) connections for the whole website and checkout;
- never storing full payment card details;
- limiting access to customer records to staff who need them for their work;
- using providers with recognised security certifications, such as Shopify's PCI DSS Level 1 compliance; and
- securing our contact form service against spam and abuse.
No system is completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as the Act requires.
7. How long we keep it
We keep personal information only as long as it is needed for the purposes in section 2, then delete or anonymise it. In particular:
- order, payment and warranty records are kept for at least seven years to meet tax and consumer law obligations and to honour our 24-month warranty;
- contact form enquiries are kept while we are assisting you and for a reasonable period afterwards in case of follow-up; and
- marketing contact details are kept until you unsubscribe.
8. Your rights: access and correction
You have the right under the Act to ask for a copy of the personal information we hold about you, and to ask us to correct it if you believe it is wrong. We will respond within 20 working days and will not normally charge a fee. If we decline to make a correction you may ask us to attach a note to the record recording the correction you sought.
You can also ask us to delete your information. We will do so unless we are required to keep it, for example for tax records.
To make a request, contact our Privacy Officer using the details in section 11. We may ask you to verify your identity first.
9. Marketing
We only send email or SMS marketing to people who have agreed to receive it. Every marketing message includes an unsubscribe link or instructions, in line with the Unsolicited Electronic Messages Act 2007. You can also opt out at any time by emailing sales@greenleafpumps.co.nz. Opting out of marketing does not stop order confirmations, shipping updates or warranty communications.
10. Complaints
If you are concerned about how we have handled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint promptly and aim to resolve it within 20 working days.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:
- Website: privacy.org.nz
- Phone: 0800 803 909
- Post: PO Box 10094, Wellington 6143
11. Contact us
Privacy Officer, GreenLeaf Pumps
Email: sales@greenleafpumps.co.nz
Phone: 0800 110 063
Address: 111 Newton Road, Auckland 1010, New Zealand
12. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page with its "last updated" date. If a change materially affects how we use your personal information we will tell existing customers by email where we are able to.