Privacy policy

Privacy and Data Protection Notice

This Policy sets out how Elite Spec processes personal information in accordance with applicable privacy laws and industry best practice.

Last updated: 10 September 2026

1. Introduction and scope

This Privacy Policy ("Policy") describes how Rhys Ambler, trading as Elite Spec, a sole trader based in New Zealand ("Elite Spec", "we", "us", or "our"), collects, uses, stores, shares, and protects personal information when providing our website design, hosting, automation, and related professional services (collectively, the "Services"). This Policy applies to personal information processed when you visit our websites, engage us for a project or subscription, interact with our support team, participate in research, connect third-party integrations, or otherwise communicate with us. By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described, you should not use the Services. This Policy supplements the Terms & Conditions that govern your contractual relationship with Elite Spec.

2. Definitions

"Applicable Privacy Law" means all data protection and privacy legislation applicable to our processing of personal information, including (where relevant) the New Zealand Privacy Act 2020, the Australian Privacy Act 1988 (Cth), the UK GDPR, and the EU GDPR. "Personal information" means any information relating to an identified or identifiable natural person. "Processing" has the meaning given under applicable law and includes collection, storage, use, disclosure, and deletion.

3. Categories of personal information we collect

We collect and process personal information that falls into the following broad categories: • Contact and identification details – name, email address, phone number, job title, industry, and related business profile information. • Account and authentication details – usernames, hashed passwords, access tokens, security logs, and multi-factor authentication preferences. • Transaction and billing data – invoicing address, payment method information supplied via our payment processors, subscription choices, and billing history. • Client project data – website copy, imagery, branding assets, structured content, configuration files, integration tokens, and any other information you authorise us to access in order to deliver the Services. • Usage and analytics data – IP address, device identifiers, browser type, operating system, language settings, referring URLs, pages viewed, actions taken, error logs, and timestamps generated through use of the Services. • Communications – support tickets, chat transcripts, emails, call notes, survey responses, and testimonials.

4. Methods of collection

We collect personal information directly from you when you complete web forms, sign contracts, upload resources, attend workshops, or communicate with us. We also collect information automatically through cookies and similar technologies when you access the Services. Additionally, we may receive information about you from third-party service providers (for example, analytics tools, CRM systems, booking platforms, or payment processors) where you have authorised the transfer.

5. Lawful bases for processing

We rely on the following lawful bases to process personal information under applicable privacy law: (a) performance of a contract where processing is necessary to deliver the Services you requested; (b) our legitimate interests in operating, securing, and improving the Services, provided those interests are not overridden by your rights; (c) compliance with legal obligations, such as maintaining tax records or responding to lawful requests; and (d) your consent for specific activities such as optional marketing communications or certain analytics cookies. Where consent is the lawful basis, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

6. Purposes for which we use personal information

We use personal information to: deliver, configure, and maintain the Services; develop project proposals, roadmaps, and implementation plans; set up hosting, automation, and integration environments; provide technical and strategic support; process payments and manage subscriptions; monitor usage, performance, and security; conduct product research and user testing; comply with auditing, reporting, and regulatory requirements; and communicate updates, service announcements, and marketing content consistent with your preferences. Where we process information for analytics or product improvement, we aggregate or pseudonymise data wherever feasible to minimise risk.

7. Cookies and tracking technologies

We use first-party and third-party cookies, pixels, and similar technologies to authenticate users, remember preferences, analyse traffic, measure campaign effectiveness, and improve the Services. Necessary cookies are required for core functionality and cannot be disabled. Analytics and marketing cookies are optional. You can adjust browser settings to limit cookies; however, doing so may affect the availability of certain features.

8. Sharing and disclosure

We disclose personal information to: • Service providers and subprocessors that perform hosting, infrastructure, analytics, storage, communications, payment processing, customer support, and automation functions on our behalf. • Professional advisers, insurers, auditors, and regulators where required for compliance or legal purposes. • A successor entity in connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate safeguards. • Law enforcement or government authorities if required by law or when we believe disclosure is necessary to protect the rights, safety, or property of Elite Spec, our clients, or the public. We do not sell personal information to third parties.

9. International data transfers

Personal information may be transferred to and processed in jurisdictions that may have data protection laws different from those in your jurisdiction. When we transfer personal information internationally, we rely on safeguards such as standard contractual clauses approved by the European Commission, adequacy decisions, or equivalent legal mechanisms. We also ensure that subprocessors provide a level of protection comparable to that required under applicable privacy laws.

10. Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, to comply with legal and tax obligations, to resolve disputes, and to enforce agreements. When personal information is no longer required, we securely delete or anonymise it in accordance with our data retention schedule. Where deletion is not technically feasible, we will securely store and isolate the data until deletion is possible.

11. Security

We implement industry-standard administrative, technical, and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, and destruction. These measures include encrypted transport, access controls, logging, vulnerability management, least-privilege practices, and regular review of subprocessors. Despite these measures, no system can be guaranteed to be fully secure, and you share responsibility for maintaining the confidentiality of credentials used to access the Services.

12. Your rights

Depending on your jurisdiction, you may have rights to: request access to personal information; request correction or rectification of incomplete or inaccurate data; request deletion or erasure; restrict or object to processing; request data portability; and not be subject to decisions based solely on automated processing. Requests can be submitted to hello@elitespec.co.nz. We will respond within the timeframe required by applicable law and may require verification of identity. Certain rights may be limited where we have overriding legitimate grounds or legal obligations.

13. Marketing preferences

We may send you marketing communications about new features, services, or events when permitted by law. You can withdraw consent or opt out at any time by following the unsubscribe instructions in the communication or contacting us directly. Opting out will not affect the delivery of essential service-related communications.

14. Third-party websites and services

The Services may include links to third-party websites or enable integrations with third-party platforms. We are not responsible for the privacy practices of those third parties. We encourage you to review their policies before providing personal information or enabling integrations.

15. Children

The Services are not intended for individuals under the age of sixteen (16). We do not knowingly collect personal information from children. If you become aware that a child has provided personal information to us, please contact hello@elitespec.co.nz so that we can take appropriate steps to delete the information.

16. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will post the updated Policy on our website and update the "Last updated" date. Where required by law, we will provide additional notice or seek your consent.

17. Contact

Questions, concerns, or requests regarding this Policy or our privacy practices can be directed to: Rhys Ambler, Elite Spec, Hamilton, New Zealand, or hello@elitespec.co.nz.