Privacy Policy | Dropcatch NZ

This policy explains how Dropcatch NZ([PLACEHOLDER: registered company name]) collects, uses, and protects personal information, in accordance with the New ZealandPrivacy Act 2020 and its Information Privacy Principles.

What we collect

Account details: your name, email address and password (stored as a salted cryptographic hash - we never see or store your actual password).
Order details: the domain names you order and the history of those orders.
Billing details: your account ledger (charges, payments, adjustments). We do not collect or store card numbers - payment is by bank transfer.
Correspondence: messages you send us via the contact form or email.
Technical data: IP address and basic request information, used for security (e.g. rate limiting, abuse prevention) and troubleshooting.

What we use it for

Operating your account and processing your catch orders;
Sending you transactional email about your orders and account (order received, confirmed, caught/missed, receipts, password resets);
Billing and collecting payment;
Completing domain handover, which involves providing registrant details to the .nz registry/registrar as required to register a domain in your name;
Preventing fraud and abuse of the service;
Meeting our legal obligations.

We do not sell personal information, and we don’t send marketing email unless you’ve opted in.

Who we share it with

Cloudflare, Inc. - our hosting and infrastructure provider. Data is processed and stored on Cloudflare’s global network, which includes servers outside New Zealand.
Our email delivery provider (currently Resend) - to deliver transactional email; they process your email address and message content.
The .nz registry and registrars - registrant details, when registering or transferring a caught domain to you. Note that .nz registrant details may appear in the public WHOIS subject to the registry’s privacy options.
Professional advisers or authorities - where required by law.

Where information is held offshore by our service providers, we take reasonable steps to ensure it is subject to protections comparable to the Privacy Act 2020.

Cookies

We use only functional cookies: a session cookie to keep you logged in, and a simple logged-in indicator. No advertising or cross-site tracking cookies, and no third-party analytics that identify you.

Security

Passwords are hashed with an industry-standard key-derivation function; sessions use secure, HTTP-only cookies; all traffic is encrypted with TLS; and access to customer data is limited to staff who need it to run the service.

Retention

We keep account and order information while your account is active and for up to 7 years afterwards where needed for tax, accounting and dispute purposes, then delete or anonymise it.

Your rights

Under the Privacy Act 2020 you may request access to, and correction of, the personal information we hold about you. Emailsupport@dropcatching.nz and we’ll respond within 20 working days. If you’re not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

Changes

We’ll post any changes to this policy here and update the date above; material changes will be emailed to account holders.

Contact

Privacy Officer, Dropcatch NZ ·support@dropcatching.nz ·[PLACEHOLDER: registered office address]