Aroha Bears

Your information

Privacy
Policy

Last updated: [To be dated at launch]

Aroha Bears & Friends ("we", "us", "our") is an online business based in Christchurch, New Zealand, specialising in vintage, collectible and pre-owned bears and soft toys. We are an online-only business and do not receive visitors.

Your privacy matters to us. This policy explains what personal information we collect when you use our website, why we collect it, and how we look after it. It has been written to comply with the New Zealand Privacy Act 2020 and the Information Privacy Principles.

If you have any questions about this policy or your personal information, please contact us at hello@arohabears.com.

1. What information we collect

We only collect information that we genuinely need. Depending on how you use the site, this may include:

  • When you place an order — your name, delivery address, email address, phone number (optional), the items in your order, and any notes you add for us.
  • When you contact us — the name, email address and message you send through our contact form.
  • When you sign up for our newsletter or Bear Finding Service — your email address, and, for the Bear Finding Service, any preferences you share about the kind of bear you're hoping to find.
  • When you make a payment — payment is processed by PayPal. We do not see or store your card details, bank details or PayPal login. We receive a confirmation from PayPal that includes the payment amount, a PayPal transaction ID, and the shipping address you approved.
  • Automatically, when you visit the site — a small anonymous visitor cookie (aroha_vid) that helps us count unique visitors to the Bear Parlour without identifying you personally. We also record basic technical information such as the pages you view and the approximate time of your visit, in order to keep the site running smoothly.

We do not knowingly collect information from children. Our website is intended for adults purchasing collectibles or gifts. If we become aware that personal information has been submitted by a child without appropriate consent, we will delete it.

2. Why we collect it and how we use it

We use your information only for the purpose you provided it, including:

  • Processing your order, arranging shipping, and keeping you updated about its progress
  • Sending you an order confirmation and a shipping notification with tracking details
  • Responding to enquiries you send us
  • Sending newsletters or Bear Finding Service updates that you have specifically asked to receive (you can unsubscribe at any time by emailing us)
  • Understanding, in a general sense, how many people visit the site so we know whether our little corner of the internet is finding its people
  • Keeping records that we are legally required to keep, such as tax and sales records

We do not sell your information, we do not rent it, and we do not share it with advertisers.

3. Who we share information with

We share the minimum information necessary with the following service providers so that the site can work:

  • PayPal — payment processing. Governed by PayPal's own privacy policy.
  • Resend — sends the transactional emails from us to you (order confirmations, shipping updates, contact form replies). Governed by Resend's privacy policy.
  • Our hosting provider (Emergent) — hosts the website and the database in which order and enquiry records are stored.
  • New Zealand Post or the courier used for your order — receives the delivery name and address so your bear can travel.
  • Our accountant, or the Inland Revenue Department, if required by New Zealand tax law.

We may also share information if we are legally required to do so, for example in response to a valid court order or investigation.

Some of these providers (PayPal, Resend and our hosting provider) store data on servers located outside New Zealand, including in Australia, the United States and the European Union. By using our site, you understand that your information may be processed in these countries. We only use providers that offer privacy protections comparable to the New Zealand Privacy Act 2020.

4. Cookies and analytics

We use a single essential cookie called aroha_vid. It contains a random ID (not your name, not your email) and is used only to count unique visitors to the homepage. It expires after 365 days.

We do not currently use third-party advertising cookies, retargeting pixels or behavioural tracking.

You can clear or block cookies through your browser settings at any time. Blocking aroha_vid will not affect your ability to shop.

5. How long we keep your information

  • Order records — 7 years, to meet Inland Revenue record-keeping requirements
  • Contact form messages — up to 2 years after your enquiry is resolved
  • Newsletter and Bear Finding Service signups — until you unsubscribe or ask us to delete them
  • Visitor counter — the cookie expires after 365 days. Anonymous visitor statistics may be retained for historical reporting purposes.

6. Keeping your information safe

We take reasonable steps to protect the information we hold, including:

  • Encrypted connections (HTTPS) across the entire site
  • Passwords hashed with bcrypt — we cannot read admin passwords, and neither can anyone who accessed the database
  • Access to customer data restricted to the site owner
  • Regular backups stored securely

No system is perfectly secure, but we take our responsibility to your information seriously.

7. Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

  • Ask what information we hold about you — we'll reply within 20 working days
  • Ask us to correct information that is wrong or out of date
  • Ask us to delete your information, unless we're legally required to keep it (for example, order records)
  • Unsubscribe from newsletters at any time, using the unsubscribe link in the email or by emailing us

To make a request, email hello@arohabears.com with the subject "Privacy request". We may ask you to verify your identity before releasing information.

8. If something goes wrong

If we ever become aware of a privacy breach that is likely to cause you serious harm, we will notify you as soon as reasonably possible and notify the Office of the Privacy Commissioner, as required by the Privacy Act 2020.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will always show when the current version took effect. Significant changes will be communicated by email to newsletter subscribers.

10. Contact

For any questions, requests or concerns about your privacy, please contact:

Aroha Bears & Friends
Christchurch, New Zealand
Email: hello@arohabears.com

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner: