Privacy Policy
Last updated: 15 June 2025
1. Introduction
("we", "us", "our") operates the website ivoralumessaria.com and the trading name Ivoralumessaria Flowers & Floral Studio located in Auckland, New Zealand. We are committed to protecting the personal information of every person who visits our website or contacts us about our floral services.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. It applies to all visitors and customers who interact with us through our website or by other means of contact.
Our practices are governed by the Privacy Act 2020 (New Zealand) and the Information Privacy Principles contained within it. By using our website, you acknowledge that you have read and understood this policy.
2. Data Controller
The data controller responsible for your personal information is:
- Legal entity name:
- Trading name:Ivoralumessaria Flowers & Floral Studio
- Registered address:
- Company registration number:9482167
- GST number:942 781 536 2847
- Privacy enquiries email:info@ivoralumessaria.com
Any questions, requests, or complaints relating to personal information should be directed to the address or email above.
3. Personal Information We Collect
We collect personal information only to the extent necessary to provide our floral products and services and to operate our website effectively. The categories of information we may collect are described below.
3.1 Contact and Enquiry Information
When you contact us through our website enquiry form, by email, or by any other written means, we may collect:
- Your full name
- Your email address
- Your phone number (if provided voluntarily)
- Your delivery or event address (if relevant to your enquiry)
- The content of your message or enquiry
- Order details, including flower preferences, event dates, and special instructions
3.2 Order and Transaction Information
When you place an order for floral arrangements, bouquets, or studio services, we collect the information needed to fulfil that order, including:
- Billing name and address
- Delivery name and address
- Order contents and specifications
- Payment confirmation references (we do not store full card numbers)
- Recipient details where a gift delivery is requested
3.3 Device and Technical Information
When you visit our website, certain technical information is collected automatically by our web hosting infrastructure and any analytics tools we use. This may include:
- IP address
- Browser type and version
- Operating system
- Referring website or URL
- Pages visited and time spent on those pages
- Date and time of your visit
- Device type (desktop, tablet, or mobile)
This technical information is used in aggregate form to help us understand how visitors use our website and to improve its performance. Where this information can identify you as an individual, it is treated as personal information.
3.4 Consent Records
Where we rely on your consent for any particular use of your personal information (for example, sending you promotional content about our seasonal arrangements or upcoming events), we keep a record of when and how that consent was given, and the specific purpose for which it was collected.
5. Purposes and Legal Bases for Processing
We process personal information for specific, legitimate purposes. Under the Privacy Act 2020, we must have a lawful basis for collecting and using personal information. The list below outlines the main purposes for which we process your information and the corresponding legal basis.
-
Responding to enquiries
- Description: To reply to questions submitted through our contact form or by email regarding our flowers, arrangements, and studio services
- Legal basis: Necessary to take steps at your request before entering into a contract; or our legitimate interests in providing customer service
-
Fulfilling orders
- Description: To process and deliver floral orders, manage delivery logistics, and coordinate event or studio bookings
- Legal basis:Performance of a contract to which you are a party
-
Billing and accounting
- Description: To issue invoices, process payments, and maintain financial records as required by law
- Legal basis: Compliance with legal obligations under New Zealand tax and financial reporting law
-
Website analytics
- Description: To understand how visitors use our website so we can improve our content, layout, and services
- Legal basis: Our legitimate interests in maintaining and improving an effective website
-
Marketing communications
- Description: To send you information about seasonal collections, promotions, or floral studio events that may interest you
- Legal basis: Your explicit consent, which you may withdraw at any time
-
Legal compliance and dispute resolution
- Description: To comply with our legal obligations and to establish, exercise, or defend legal claims
- Legal basis: Compliance with legal obligations; our legitimate interests in protecting our rights
-
Website security
- Description: To detect and prevent fraudulent activity, unauthorised access, or technical vulnerabilities
- Legal basis: Our legitimate interests in keeping our website and systems secure
6. Recipients of Personal Information
We do not sell, rent, or trade your personal information to any third party. We may share your information with the following categories of recipients only to the extent necessary for the purposes described in this policy:
- Service providers and processors: Third-party companies that assist us in operating our website, processing payments, or delivering orders. These providers act on our instructions and are required to handle your information securely and only for the purposes we specify.
- Delivery partners: Courier or logistics providers engaged to deliver floral arrangements to you or to the recipient of a gift order.
- Payment processors: Secure payment platforms used to process transactions. These platforms operate their own security standards and receive only the information needed to process your payment.
- Professional advisers: Accountants, lawyers, or insurers engaged in the ordinary course of running our business, subject to confidentiality obligations.
- Government and regulatory authorities: Where we are required by law to disclose information, for example to Inland Revenue or to comply with a court order.
Where we engage third-party processors, we take reasonable steps to ensure they maintain appropriate privacy and security standards consistent with the Privacy Act 2020.
6.1 International Transfers
Some of the service providers we use may store or process data in countries outside New Zealand. Where this occurs, we take reasonable steps to ensure that those providers offer a comparable level of protection for personal information as is required under New Zealand law, including through contractual arrangements or by selecting providers operating in jurisdictions with comparable privacy frameworks.
7. Retention of Personal Information
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention practices are as follows:
-
Enquiry and contact records
- Retention period: Up to 2 years from the date of the last contact, unless a transaction resulted from the enquiry
-
Order and transaction records
- Retention period: 7 years from the date of the transaction, in accordance with New Zealand financial record-keeping requirements
-
Billing and invoice records
- Retention period:7 years from the end of the relevant financial year
-
Marketing consent records
- Retention period: Until consent is withdrawn, plus a reasonable period thereafter to demonstrate compliance
-
Website analytics data
- Retention period:Up to 26 months in aggregate or anonymised form
-
Security and access logs
- Retention period:Up to 12 months
When personal information is no longer required, we take reasonable steps to destroy or permanently de-identify it in a secure manner.
8. Security of Personal Information
We take the security of your personal information seriously and implement reasonable technical and organisational measures to protect it against unauthorised access, disclosure, alteration, or destruction. These measures include:
- Use of secure (HTTPS) encrypted connections for our website
- Access controls that limit who within our business can access personal information
- Secure storage practices for physical and digital records
- Use of reputable, security-conscious third-party service providers
- Regular review of our internal data handling practices
While we take all reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of information transmitted to or from our website. If you have concerns about the security of your information, please contact us at info@ivoralumessaria.com.
In the event of a privacy breach that is likely to cause serious harm, we will notify the affected individuals and the Privacy Commissioner in accordance with the notification requirements of the Privacy Act 2020.
9. Your Privacy Rights
Under the Privacy Act 2020, you have a number of rights in relation to personal information we hold about you. These rights are described below.
9.1 Right of Access
You have the right to request confirmation of whether we hold personal information about you, and to request a copy of that information. We will respond to access requests within 20 working days of receipt, subject to any lawful grounds for withholding information.
9.2 Right to Correction
If you believe that personal information we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct it. We will take reasonable steps to correct information or, where we disagree that a correction is warranted, to attach a notation to the record indicating that you have requested a correction.
9.3 Right to Withdraw Consent
Where we process your personal information on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal. To withdraw consent, please contact us at info@ivoralumessaria.com or use the unsubscribe link included in any marketing email we send you.
9.4 Right to Complain
You have the right to make a complaint if you believe we have handled your personal information in a way that does not comply with the Privacy Act 2020. We encourage you to contact us in the first instance so that we can address your concern directly. See Section 11 for contact details.
9.5 Limits on Rights
There are circumstances under the Privacy Act 2020 where we may be permitted or required to withhold information or decline a request, for example where disclosure would prejudice the safety of another individual, where the information is subject to legal privilege, or where the request is frivolous or vexatious. We will advise you if we are unable to fulfil a request and, where possible, explain the reason.
10. Links to Other Websites
Our website may contain links to external websites operated by third parties, including social media platforms or suppliers. This Privacy Policy applies only to our website and our processing of personal information. We have no control over the content or privacy practices of external websites and encourage you to review the privacy policies of any third-party sites you visit.
11. Complaints and How to Contact Us
If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or have a concern about the way we have handled your personal information, please contact us using the details below:
- Privacy enquiries:info@ivoralumessaria.com
- Postal address:,
We will acknowledge your enquiry promptly and aim to respond fully within 20 working days. If your concern relates to a privacy breach or a complex access request, we will keep you informed of progress where additional time is required.
If you are not satisfied with our response, or if you wish to make a formal complaint about our privacy practices, you may contact the Office of the Privacy Commissioner:
- Office of the Privacy Commissioner:PO Box 10094, The Terrace, Wellington 6143, New Zealand
- Website:www.privacy.org.nz
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically to stay informed about how we are protecting your personal information.
Continued use of our website after any update to this policy constitutes your acknowledgement of the revised terms.