Privacy Policy
Last updated: 2026-07-31
1. Who We Are
The Stonebridge Review Ltd ("we", "us", "our") operates the website at https://skeletonrinse.world/. We are incorporated in New Zealand (NZBN 9429048723156), with our registered address at 17 Commerce Street, Auckland 1010, New Zealand.
Contact for privacy matters: info@skeletonrinse.world
2. Applicable Law
This Privacy Policy is governed by the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Where we process personal data of individuals in the European Economic Area or the United Kingdom, we also observe the principles of the UK/EU General Data Protection Regulation (UK/EU GDPR) to the extent applicable.
3. What Personal Data We Collect
We collect the following categories of personal information:
| Category | Examples | How collected |
|---|---|---|
| Identity data | Full name | Order form, contact form |
| Contact data | Phone number, email address, delivery address | Order form, contact form |
| Transaction data | Product ordered, price, SKU, order reference | Order form (hidden fields) |
| Marketing attribution | UTM parameters, Google Click ID (gclid) | URL query string, hidden form fields |
| Technical data | IP address, browser type, operating system, pages visited, referrer URL | Server logs, cookies/analytics |
| Cookie/consent data | Consent status and timestamp | Cookie banner interaction |
We do not intentionally collect sensitive information (health data, financial account details, etc.). If you voluntarily include health-related information in a contact message, we will treat it with particular care and will not use it for any purpose other than responding to your enquiry.
4. Purposes and Legal Bases for Processing
| Purpose | Legal basis (GDPR) | IPP basis (NZ) |
|---|---|---|
| Processing and fulfilling your order; calling to confirm | Performance of contract (Art. 6(1)(b)) | IPP 1, 10 |
| Responding to contact/enquiry messages | Legitimate interests (Art. 6(1)(f)) | IPP 1, 10 |
| Analytics and website improvement | Consent (Art. 6(1)(a)) where cookies used | IPP 1, 2 |
| Marketing analytics and ad attribution | Consent (Art. 6(1)(a)) | IPP 1, 2 |
| Legal compliance and fraud prevention | Legal obligation / legitimate interests (Art. 6(1)(c)/(f)) | IPP 1, 10 |
5. Cookies and Tracking
We use cookies and similar tracking technologies. For full details, see our Cookie Policy. We implement Google Consent Mode v2: advertising and analytics cookies are set to denied by default and only activated if you click "Accept All" on the cookie banner.
6. Sharing of Personal Data
We may share your personal data with the following third parties:
- Delivery/logistics providers - to fulfil your order (name and delivery address only).
- Payment processors - if applicable (where pay-on-delivery is not selected).
- Google LLC - analytics and advertising services (subject to your consent choice). Google may process data in the United States; appropriate safeguards apply (Standard Contractual Clauses).
- IT and hosting providers - for website hosting and infrastructure, under data processing agreements.
- Professional advisers - lawyers, accountants, auditors, as necessary.
- Regulatory authorities - where required by law.
We do not sell personal data to third parties.
7. International Transfers
Some of our third-party service providers are based outside New Zealand (for example, Google LLC in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards including Standard Contractual Clauses (for EEA/UK transfers) and we satisfy ourselves that recipients are subject to comparable privacy obligations.
8. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
- Order data: 7 years (for GST and tax record-keeping obligations under NZ law).
- Contact/enquiry data: 2 years from last contact.
- Analytics data: as per Google Analytics retention settings (default 26 months).
- Cookie consent records: 3 years.
9. Your Rights
Under the New Zealand Privacy Act 2020 and (where applicable) UK/EU GDPR, you have the following rights:
- Access - to request a copy of the personal information we hold about you (IPP 6; GDPR Art. 15).
- Correction - to request correction of inaccurate or out-of-date personal information (IPP 7; GDPR Art. 16).
- Erasure - to request deletion of your personal data in certain circumstances (GDPR Art. 17; NZ Privacy Act s.22).
- Restriction - to restrict processing in certain circumstances (GDPR Art. 18).
- Portability - to receive your data in a structured, machine-readable format (GDPR Art. 20).
- Object - to object to processing based on legitimate interests or for direct marketing (GDPR Art. 21).
- Withdraw consent - at any time where processing is based on consent, without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at info@skeletonrinse.world. We will respond within 20 working days (as required by the NZ Privacy Act 2020).
10. Right to Complain
If you believe we have not handled your personal information in accordance with the Privacy Act 2020, you may make a complaint to the Office of the Privacy Commissioner (OPC):
- Website: privacy.org.nz
- Phone: 0800 803 909 (NZ)
- Post: PO Box 10094, Wellington 6143, New Zealand
We ask that you contact us first so we can attempt to resolve your concern directly.
11. Security
We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction. Our website is served over HTTPS. Access to personal data is restricted to staff who need it to perform their duties. However, no internet transmission is completely secure, and we cannot guarantee absolute security.
12. Children
Our website and products are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Material changes will be notified via a prominent notice on our website.