Privacy Policy

1. Who We Are

City Green is a family-owned fresh produce and grocery store based in Porirua, New Zealand. We operate an in-store retail business and an online ordering platform at citygreen.nz, offering delivery to Porirua and Wellington, and click & collect from our store at Elsdon, Porirua.

We are committed to protecting your personal information and handling it responsibly under the New Zealand Privacy Act 2020.

2. Information We Collect

We only collect information that we genuinely need to provide our services.

Personal and contact details

• Full name
• Phone number
• Email address (optional for online orders)
• Delivery address and suburb

Order and transaction data

• Items ordered, quantities, and prices
• Order reference numbers and history
• Delivery or click & collect preference
• Special instructions or requests
• Payment confirmation status (we do not store card numbers)

Website usage data

• IP address and approximate location
• Browser type and device information
• Pages visited and time spent on site
• Referring website or search terms

In-store data

If you contact us by phone, email, or in person, we may record details from that interaction to assist with your query or order.

3. How We Collect Information

• Online orders: When you place an order through citygreen.nz, you provide your contact and delivery details directly
• Phone and email enquiries: When you contact us, we may note your name, number, and the nature of your request
• In-store purchases: If you provide contact details for an in-store transaction, delivery, or loyalty programme
• Cookies: Our website uses browser storage (localStorage) to keep your shopping cart and login session — see section 6 for details
• Payment processors: When you pay online, your payment details are handled directly by our payment provider (e.g. Stripe). We receive a confirmation of payment only

4. Why We Collect Information

We collect personal information to:

• Process and fulfil your order — confirm your purchase, prepare it, and arrange delivery or collection
• Deliver your groceries — share your address with our delivery team so they can find you
• Contact you about your order — call or message you to confirm, update, or resolve issues
• Process payments and issue refunds — ensure transactions are completed correctly
• Meet legal and accounting obligations — maintain records as required by New Zealand law
• Improve our website and service — understand how customers use our site and identify areas for improvement
• Prevent fraud — detect and investigate suspicious activity

We do not use your personal information for unsolicited marketing without your consent.

5. Sharing Your Information

We may share your information with trusted third parties only where necessary to operate our business:

Delivery team

Your name, phone number, and delivery address are shared with our delivery drivers so they can complete your order.

Payment processors

Payment details are handled by secure third-party processors (such as Stripe). We receive only payment confirmation and do not store your card details.

Website and hosting providers

Our website is hosted by a third-party hosting provider. They may have incidental access to data stored on our servers as part of their service.

Email service providers

If we send you transactional emails (such as order confirmations), these are sent via a third-party email service. Your email address is used only for that purpose.

Legal obligations

We may disclose your information if required by law, a court order, or to protect the safety of our staff or customers.

6. Cookies & Tracking

Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences and understand how you use it.

Essential cookies

Our website uses your browser's localStorage to keep your shopping cart and order details between pages. Without this, the cart would not work. This data stays on your device and is not sent to our servers unless you place an order.

Your options

You can clear your browser's localStorage at any time via your browser settings. Note that this will empty your shopping cart and sign you out of your account.

7. Data Storage & Security

We take reasonable steps to protect your personal information from unauthorised access, loss, or misuse. These measures include:

• Secure HTTPS connections for all website traffic
• Access controls — only authorised staff can access customer order data
• Passwords and credentials are stored using industry-standard hashing (never in plain text)
• Payment data is handled by our payment processor, not stored on our systems

8. Data Retention

We keep your personal information only for as long as it is needed for the purpose it was collected.

• Order records: Retained for 7 years to meet New Zealand tax and accounting requirements under the Tax Administration Act 1994
• Customer contact details: Kept while you are an active customer and for a reasonable period after your last interaction
• Enquiry records: Retained for up to 2 years after the enquiry is resolved

When information is no longer needed, we delete or de-identify it securely.

9. Your Rights Under the NZ Privacy Act 2020

Right to access your information

You can ask us what personal information we hold about you and receive a copy of it. We will respond within 20 working days as required by law.

Right to correct your information

If you believe information we hold about you is incorrect, incomplete, or outdated, you can ask us to correct it. We will either make the correction or note your disagreement on the record.

Right to request deletion

You can ask us to delete your personal information where we are not legally required to keep it. We will assess your request and respond accordingly.

Right to complain

If you believe we have breached the Privacy Act, you can complain to us directly. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner:

• Website: www.privacy.org.nz
• Phone: 0800 803 909

How to exercise your rights

Contact us using the details in section 14. Please provide enough information to verify your identity so we can locate your records.

10. Third-Party Services

Our website and business operations use the following third-party services, each with their own privacy policies:

Payments

Stripe — processes card payments securely. Stripe is PCI-DSS compliant. See stripe.com/nz/privacy.

Website hosting

Our website is hosted on a third-party server. The hosting provider may process connection data (IP addresses, request logs) as part of normal server operations.

Email

Transactional emails (such as order confirmations) may be sent via a third-party email delivery service. Your email is used only for that transaction.

Delivery

Your name, phone, and delivery address are shared with our delivery team (employed or contracted by City Green) for the purpose of completing your delivery.

11. Embedded Content

Some pages on our website may include embedded content — such as maps, videos, or social media posts — from other websites (e.g. Google Maps, YouTube).

Embedded content from other sites behaves as if you visited those sites directly. Those sites may collect data about you, use cookies, and track your interaction with the embedded content, subject to their own privacy policies.

12. Data Breach Response

If we become aware of a data breach that poses a risk of serious harm, we will:

• Investigate and contain the breach as quickly as possible
• Notify affected individuals if required under the Privacy Act 2020
• Report the breach to the Office of the Privacy Commissioner if it meets the threshold for mandatory notification
• Take steps to prevent a recurrence

If you believe your information held by us may have been compromised, please contact us immediately at citygreenporirua@gmail.com.

13. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the effective date at the top of this page.

We encourage you to review this policy periodically. Continued use of our website or services after changes are published constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy, want to access or correct your information, or have a privacy concern, please get in touch:

We aim to respond to all privacy requests within 20 working days as required by the Privacy Act 2020.