Legal
Privacy Policy
This policy explains what personal information Miece Agency collects, why we collect it, who we share it with and what you can do about it. We handle personal information under the New Zealand Privacy Act 2020.
Miece Agency Ltd is a marketing agency based in Rotorua, New Zealand. We run paid advertising on Facebook and Instagram, build websites, and provide brand strategy for New Zealand and Australian businesses.
1. Who this policy applies to
This policy covers three different groups, and what we collect is different for each.
- Visitors to mieceagency.co.nz.
- Enquirers who fill in a form or contact us about our services.
- Clients whose advertising, websites or accounts we manage.
It also explains, in section 7, how we handle information belonging to our clients' customers, because that is a common question and the answer is not obvious.
2. What we collect
When you visit the website
We use Google Analytics 4 to understand how people find and use the site. It records things like the pages you view, roughly how long you stay, the type of device and browser you use, the site or ad that sent you, and an approximate location based on your IP address. Google Analytics sets cookies in your browser to do this.
We do not know who you are from analytics alone. We do not sell this information, and we do not use it to build a profile of you as an individual.
When you contact us
Our booking form asks for your name, email address, phone number, business name, the service you are interested in and your message. Our client questionnaire asks for your email, phone, location, budget, goals, tagline, desired features and your Facebook and Instagram details.
You choose what to put in these forms. If you would rather not use a form, email or phone works just as well, and the contact details are in section 12.
When you become a client
To run your advertising and build your site we hold your business and contact details, billing information, access to the advertising and analytics accounts you grant us, the brand and content assets you send us, and our correspondence with you.
We never take payment card details. You attach your own card directly to your own advertising account, so your card details go to Meta and never pass through us. Invoices are handled through Xero.
3. Why we collect it
- To answer your enquiry and, if it goes ahead, to quote and get you set up.
- To deliver the work you have engaged us to do.
- To invoice you and keep the financial records the law requires us to keep.
- To measure and improve our own website and marketing.
- To meet legal obligations, including tax and record keeping.
We do not sell personal information to anyone, and we do not add enquirers to a marketing list.
4. Cookies and analytics
Cookies are small files a website stores in your browser. Ours are used for Google Analytics as described above.
You can block or delete cookies in your browser settings, and you can opt out of Google Analytics entirely using Google's browser opt-out add-on. The site works normally either way.
We may also use advertising measurement tools, such as the Meta Pixel, to understand which ads bring people to this site. Where we do, they are covered by this section and by the cookie controls above.
5. Who we share it with
We use other companies to run parts of our business. They only get what they need to do their job, and they are not permitted to use it for their own purposes.
| Who | What they handle | Where |
|---|---|---|
| Netlify | Website hosting and form submissions | United States |
| Analytics, email and documents | United States | |
| Meta | Advertising delivery and lead forms | United States |
| Xero | Invoicing and accounting records | United States. Xero is a New Zealand company but hosts on Amazon Web Services |
| Stripe | Card payments, where used | United States |
We may also disclose information where the law requires it, or where it is necessary to protect someone's safety.
Information held overseas. Every provider above stores information outside New Zealand, in the United States. Overseas privacy laws are not always the same as ours.
Principle 12 of the Privacy Act lets us do this where the receiving party is subject to comparable safeguards. Our basis is that each provider publishes binding data processing terms that apply to us as a customer, and each operates under recognised international privacy and security frameworks. We rely on those published terms rather than on a separate agreement negotiated by us. If you want to see the terms we rely on for a particular provider, ask and we will send you the link.
6. How long we keep it
- Enquiries that do not proceed: we review enquiry records periodically and delete what we no longer have a reason to keep. If you want yours removed sooner, ask and we will do it.
- Client records: for the length of the engagement, then seven years, which is the period New Zealand tax law requires for business records.
- Analytics: Google deletes the individual level analytics data automatically on the retention period set for our property. The anonymous totals, such as how many people visited a page in a month, are kept beyond that.
Some of our clients work in regulated industries and have their own record keeping obligations, including anti money laundering rules. Where a client is required to retain something for longer, their obligation applies to that information and overrides the periods above.
7. Information belonging to our clients' customers
When we run advertising for a client, people sometimes submit their details through a Meta lead form or a form on the client's website. The client is the business responsible for that information, and they decide what happens to it. We act on their instructions.
We are not only a bystander, though, and it would be misleading to suggest otherwise. To set up, test and report on campaigns we sometimes download lead data. Where we hold a copy, we are responsible for that copy and this policy applies to it. We keep it only for as long as the reporting requires, we do not use it for our own marketing, and we never pass it to another client.
If you submitted your details to an ad or a website we manage, you can contact either the business you enquired with or us. If you come to us, we will deal with anything we hold ourselves and pass the rest to the client so it gets handled properly. If you are not sure which business you enquired with, ask us and we will tell you.
8. Advertising we run for clients
Campaigns we build for clients may use the Meta Pixel or similar tracking on the client's own website, and may use audiences built from a client's own customer list. That activity happens on the client's site under the client's privacy policy, so that is the document to read for it.
We will not run a lead campaign for a client who does not have a privacy policy telling people what happens to their details. Meta enforces this too, but it is a condition of working with us either way. If you are one of our clients and you do not have one yet, we will tell you before we build anything.
9. Your rights, and how to get your information deleted
Under the Privacy Act 2020 you have two rights, and we will tell you plainly what they are rather than borrowing language from overseas laws that do not apply here.
- Access. Ask what we hold about you and get a copy.
- Correction. Ask us to fix it if it is wrong.
New Zealand law does not give a general right to have information erased, the way European law does. What it does require is that we do not keep information for longer than we need it.
So our own commitment goes further than the Act: if you ask us to delete your information and we have no ongoing need or legal obligation to keep it, we will delete it. If something has to stay, for example a paid invoice we are required to keep for seven years, we will tell you what it is and why.
Email ashton@mieceagency.co.nz for any of the above. We will respond within 20 working days, the timeframe the Act sets, and there is no charge. We may need to confirm who you are first, so that we do not hand your information to someone else.
We will not add you to a marketing list, and we will not cold call you. If you contact us about our services we will reply about that, and nothing else.
10. Keeping it secure
We limit access to client accounts to the people who need it, use multi-factor authentication where a provider supports it, and keep credentials out of shared documents. No system is completely secure, and we will not pretend otherwise. If a privacy breach occurs that is likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner, as the Privacy Act requires.
11. Making a complaint
If you are unhappy with how we have handled your information, tell us first at ashton@mieceagency.co.nz and we will work through it with you.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:
- Website: privacy.org.nz
- Phone: 0800 803 909
- Email: enquiries@privacy.org.nz
12. Contact us
Our Privacy Officer is Ashton Tipiwai, and privacy questions, access requests, correction requests and deletion requests all go to him.
Miece Agency Ltd
Privacy Officer: Ashton Tipiwai
Rotorua, New Zealand
Email: ashton@mieceagency.co.nz
Phone: 027 8123 907
13. Changes to this policy
We update this policy when what we do changes. The date at the top always shows the current version. If we make a change that materially affects how we handle your information, we will tell affected clients directly rather than relying on you to notice.