Privacy Policy

Effective date: 13 April 2026
Business: FernHouse NZ
Website: fernhouse.co.nz
Contact: support@fernhouse.co.nz

FernHouse NZ is a New Zealand-based online store. We are committed to protecting your personal information and handling it responsibly in accordance with the Privacy Act 2020 and its Information Privacy Principles (IPPs). This policy explains what information we collect, why we collect it, who we share it with, and what rights you have.

What personal information we collect

When you shop with us or contact us, we may collect the following:

Name — used to address you and label your order
Email address — for order confirmations, shipping updates, and responding to enquiries
Postal and shipping address — to fulfil and deliver your order
Phone number — optional, used only if your courier requires contact for delivery
Payment information — card payments are processed by Stripe. We never see or store your full card number; Stripe handles all payment data securely
IP address and browsing behaviour — collected automatically when you visit our website, including pages viewed and time spent on site
Order history — a record of what you have purchased from us

We only collect information that is necessary for the purposes described in this policy (IPP 1), and we collect it directly from you wherever possible (IPP 2).

How we collect your information

Directly from you — when you place an order, create an account, or contact us via email
Automatically — via cookies and analytics tools when you browse our website (see the Cookies section below)

Why we collect your information

We collect and use your personal information for the following purposes (IPP 3):

To process and fulfil your orders
To arrange shipping and delivery through our fulfilment partner
To send you order confirmations, shipping updates, and relevant communications
To respond to your questions and support requests
To improve our website and understand how customers use it
To meet our legal obligations, including keeping financial records for tax purposes

We do not use your information for unsolicited marketing, and we do not sell your data to third parties.

Who we share your information with

We share your personal information only with trusted third-party service providers who help us operate our business. Each provider handles data in accordance with their own privacy policies.

Stripe — payment processing

When you pay by card, your payment details are sent directly to Stripe and processed on their secure platform. Stripe is PCI-DSS compliant. We never receive or store your full card number. See stripe.com/privacy.

CJDropshipping — order fulfilment and shipping

We use CJDropshipping to source and dispatch products. Your name and shipping address are shared with them so they can pick, pack, and ship your order. They do not receive your payment details.

Amazon Web Services (AWS)

Our website is hosted on AWS infrastructure. We also use AWS Simple Email Service (SES) to send transactional emails and AWS S3 for media storage. Your data may be stored on AWS servers; we apply appropriate access controls to protect it.

Google Analytics

We use Google Analytics to understand how visitors use our website. The data collected is anonymised and aggregated — it does not identify you personally. This helps us improve our site and the products we stock.

Cookies

Our website uses cookies — small text files stored in your browser. We use the following types:

Essential cookies — required for the site to function, including your shopping cart and session state. You cannot opt out of these without disabling the site.
Analytics cookies — used by Google Analytics to collect anonymised data about how visitors use our site (pages visited, time on site, general location by country).

We do not use advertising or tracking cookies. New Zealand law does not require a cookie consent banner, but we believe in being transparent about what we collect and why.

How we protect your information

We take reasonable steps to keep your personal information secure (IPP 5), including:

SSL encryption — all data transmitted between your browser and our website is encrypted via HTTPS
PCI-DSS compliant payment processing — Stripe handles all card data to the highest security standard
Server access controls — our servers are accessed via SSH key authentication only; password login is disabled
Web Application Firewall (WAF) — protection against common web-based attacks
Limited access — only authorised personnel can access customer data, and only where necessary

No system is completely immune to risk, but we are committed to keeping your data as secure as reasonably practicable.

How long we keep your information

We retain your personal information only for as long as necessary (IPP 9 and 10):

Order records — we retain order data for 7 years to meet our tax and accounting obligations under New Zealand law. After this period, personal details are deleted or anonymised.
Customer account data — retained while your account is active. You can request deletion at any time (subject to the above retention requirements).
Support correspondence — retained for a reasonable period in case of follow-up queries, then deleted.

We keep personal information accurate and up to date as far as reasonably practicable (IPP 8).

Your rights under the Privacy Act 2020

You have the following rights regarding your personal information:

Access — you can request a copy of the personal information we hold about you (IPP 6)
Correction — you can ask us to correct any inaccurate or outdated information (IPP 7)
Deletion — you can request that we delete your personal information, subject to any legal retention obligations (such as the 7-year tax record requirement)
Complaint — if you believe we have breached the Privacy Act 2020, you can lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz

To exercise any of these rights, please contact us at support@fernhouse.co.nz. We will respond within a reasonable timeframe.

Contact us

If you have any questions about this privacy policy or how we handle your personal information, please get in touch:

Email: support@fernhouse.co.nz
Post: FernHouse NZ, Kumeu, Auckland, New Zealand

This policy may be updated from time to time. The current version will always be available on this page, with the effective date shown at the top.