Privacy Policy

1. Introduction and Scope

Refreshactive ("we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy applies to all personal information collected through our website at refreshactive.world, our consultation services, and any related communication channels.

We process personal data in accordance with the General Data Protection Regulation (GDPR) for individuals in the European Economic Area, the UK GDPR for individuals in the United Kingdom, and the Privacy Act 2020 of New Zealand for all users. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

This policy covers all categories of data subjects including website visitors, prospective clients, current clients, and individuals who contact us through any means. It does not apply to third-party websites that may be linked from our platform.

2. Information We Collect

2.1 Information You Provide Directly

When you interact with our website or services, you may voluntarily provide the following categories of personal data:

• Identity data: your full name and title
• Contact data: email address, telephone number, and postal address
• Communication data: messages, inquiries, and feedback submitted through our contact form or email
• Consultation data: dietary preferences, meal descriptions, lifestyle information, and goals you share during educational sessions
• Consent records: your preferences regarding data processing, marketing communications, and cookie usage
• Payment data: billing name and transaction references when you purchase consultation services (payment card details are processed by our secure payment provider and are not stored on our servers)

2.2 Information Collected Automatically

When you visit our website, certain technical information may be collected automatically through cookies and similar technologies, subject to your consent preferences:

• Device data: browser type, operating system, device type, and screen resolution
• Usage data: pages visited, time spent on pages, click patterns, and referral sources
• Network data: IP address (anonymised where required), approximate geographic location, and internet service provider
• Session data: session identifiers, authentication tokens for returning visitors, and cookie consent status

2.3 Information from Third Parties

We may receive limited personal data from third-party sources including payment processors confirming transaction completion, analytics providers supplying aggregated usage reports, and referral partners who have obtained your prior consent to share contact details with us.

3. Legal Basis for Processing

Under the GDPR, we process your personal data only when we have a valid legal basis. The bases we rely upon include:

• Consent: When you submit our contact form, accept cookies, or opt in to marketing communications, you provide explicit consent for the specified processing activities. You may withdraw consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
• Contractual necessity: Processing required to deliver consultation services you have purchased, including scheduling, session delivery, and follow-up communication.
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving our website, preventing fraud, and maintaining security, provided these interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable laws, regulations, court orders, or regulatory requests.

4. How We Use Your Information

We use the personal data we collect for the following specific purposes:

• Responding to your inquiries and providing information about our food balance consultation services
• Scheduling, conducting, and following up on educational consultation sessions
• Creating and delivering personalised educational meal plans and guidance materials
• Processing payments and maintaining financial records
• Sending service-related communications such as appointment confirmations and session summaries
• Analysing website usage to improve user experience and content relevance, subject to cookie consent
• Complying with legal obligations and responding to lawful requests from authorities
• Protecting the security and integrity of our website and services

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. All consultation recommendations are prepared by qualified human consultants based on educational principles.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We may share your information only in the following circumstances:

• Service providers: Trusted third-party processors who assist with hosting, email delivery, payment processing, and analytics. All processors are bound by data processing agreements requiring GDPR-compliant handling.
• Legal requirements: When disclosure is required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity under equivalent privacy protections.
• With your consent: When you have given explicit permission for a specific disclosure.

International data transfers outside the European Economic Area are conducted only where appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or adequacy decisions.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law. Our retention periods are as follows:

• Contact form inquiries: 24 months from the date of submission, unless an ongoing client relationship develops
• Client consultation records: 5 years from the date of the last session, to support continuity of educational guidance
• Payment and financial records: 7 years, in accordance with New Zealand tax and accounting requirements
• Cookie consent preferences: 12 months from the date of your last preference update
• Website analytics data: 26 months, in anonymised or pseudonymised form where possible
• Marketing consent records: Until consent is withdrawn, plus 3 years for audit purposes

When retention periods expire, personal data is securely deleted or irreversibly anonymised. Backup copies may persist for up to 90 additional days before automated purge.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• HTTPS encryption for all data transmitted between your browser and our servers
• Encrypted storage of sensitive data at rest using industry-standard algorithms
• Role-based access controls limiting data access to authorised personnel only
• Regular security assessments and vulnerability monitoring
• Secure disposal procedures for hardware and media containing personal data
• Staff training on data protection principles and incident response procedures
• Incident response plan with notification procedures compliant with GDPR Article 33 and 34

While we take reasonable precautions, no method of electronic transmission or storage is completely secure. We encourage you to use strong passwords and protect your own devices when communicating with us.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data where there is no compelling reason for continued processing
• Right to restrict processing: Request limitation of processing in certain circumstances
• Right to data portability: Receive your data in a structured, commonly used, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent: Withdraw previously given consent at any time
• Right to lodge a complaint: File a complaint with a supervisory authority, such as the Office of the Privacy Commissioner in New Zealand or your local data protection authority in the EU

To exercise any of these rights, contact us at hello@refreshactive.world. We will respond within 30 days, or within one month as required by the GDPR. We may request identity verification before processing your request.

9. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete such information promptly.

Consultation services for minors may be arranged through a parent or legal guardian who provides consent on the child's behalf. In such cases, the guardian's contact information is processed in accordance with this policy.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies as described in our Cookie Policy. You can manage your cookie preferences through our cookie consent banner or by adjusting your browser settings. Essential cookies necessary for website functionality cannot be disabled.

11. Third-Party Links

Our website may contain links to external websites operated by third parties. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. Material changes will be communicated through a notice on our website. The date at the top of this page indicates when the policy was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our data protection contact:

Refreshactive
233A Riverside Drive, Waterloo, Lower Hutt 5011, New Zealand
Email: hello@refreshactive.world
Phone: +64 22 037 1344

We are committed to resolving any privacy-related concerns promptly and transparently.