Privacy Policy

This Privacy Policy explains how Xelqoravinthessa collects, uses, stores and discloses personal information when you visit our website, contact the bakery, request a quote or place an order. We aim to handle personal information openly, fairly and only to the extent reasonably needed for our bakery operations.

1. Who is responsible for your information

The business responsible for the personal information described in this policy is Xelqoravinthessa Limited (“Xelqoravinthessa”, “we”, “us” or “our”). Our business address is The Tannery, 3 Garlands Road, Woolston, Christchurch 8023, New Zealand.

For privacy enquiries, requests to access or correct information, or concerns about our handling of personal information, contact info@xelqoravinthessa.com.

2. The laws and standards that guide this policy

Our primary privacy framework in New Zealand is the Privacy Act 2020 and its Information Privacy Principles. These principles govern why personal information may be collected, how it is collected, what people must be told, how information is protected, how long it may be kept, and when it may be used or disclosed.

Where we collect personal information indirectly, we will take reasonable steps to provide the notices required by Information Privacy Principle 3A, which came into force on 1 May 2026, unless a statutory exception applies.

The European Union General Data Protection Regulation (“GDPR”) may also apply to particular processing activities if we offer goods or services to people in the European Economic Area or monitor the behaviour of people there. The GDPR does not automatically apply to every visit from overseas. Where it applies, we will process the relevant personal data in accordance with its requirements in addition to applicable New Zealand law.

3. Personal information we may collect

The information we collect depends on how you interact with us. It may include:

• Contact details: your name, email address, telephone number and preferred way for us to respond.
• Enquiry and order details: the products you ask about, quantities, collection dates, delivery requests, event dates, guest numbers, design preferences, correspondence and order history.
• Dietary and allergen information: details you choose to share about ingredients, dietary requirements or allergies relevant to an order. Please share only information needed to discuss the food you are considering.
• Payment and transaction details: order totals, payment status, invoice information and limited transaction references. If payment is handled by a payment provider, that provider may collect and process card or account details under its own terms and privacy notice. We do not intend to store full payment card numbers or security codes.
• Communications and feedback: messages, reviews, complaints, requests and information you provide when speaking with our team.
• Technical information: basic server and security logs such as the date and time of a request, requested page, browser type, device information and approximate network information, where these are made available by our hosting environment.

We do not ask for sensitive personal information unless it is genuinely relevant to an enquiry or order. If you provide information about an allergy or dietary requirement, we use it only to assess and respond to that request and to help manage the relevant order.

4. How information is collected

We may collect information directly when you email us, telephone the bakery, visit in person, request a quote, place an order or otherwise communicate with us. We may also receive information from a person placing an order on your behalf, a business arranging catering, a delivery provider or another source where this is lawful and relevant to the service requested.

If you use the enquiry form on this website, your browser prepares an email addressed to info@xelqoravinthessa.com. The details are sent to us only if you choose to send that email from your email application. The website itself does not retain the text entered into the form.

Where information is obtained from another source, we will take reasonable steps to make sure you are aware of the matters required by New Zealand privacy law, including the source and purpose of collection where applicable.

5. Why we use personal information

We use personal information for purposes connected with operating the bakery, including to:

• respond to enquiries and provide product, ingredient and availability information;
• prepare quotes and confirm product selections, quantities, prices and collection arrangements;
• make, package and supply bread, pastries, cakes and catering orders;
• communicate about order changes, collection times, delivery arrangements, payments or customer service matters;
• consider dietary or allergen information you provide when discussing a product or order;
• maintain accounting, tax, business and food-safety records;
• protect our website, premises, staff, customers and business from fraud, misuse or security incidents;
• review feedback and improve our products, service and website; and
• send promotional messages only where we have a lawful basis and, where required, your consent.

6. Legal bases where the GDPR applies

If the GDPR applies to a particular processing activity, we rely on one or more of the following legal bases, depending on the circumstances:

• Contract: processing needed to respond to a request, prepare an order, supply products or take steps at your request before entering into a contract.
• Legal obligation: processing needed to meet applicable tax, accounting, food-safety, consumer or other legal requirements.
• Legitimate interests: processing needed for reasonable business purposes such as handling customer enquiries, maintaining business records, securing our website and improving our service, provided those interests are not overridden by your rights.
• Consent: processing based on your freely given consent, such as optional marketing where consent is required. You may withdraw consent at any time; withdrawal does not affect processing carried out before it was withdrawn.

7. When we share information

We do not sell personal information. We may disclose information only where reasonably necessary for the purposes described in this policy, including to:

• website hosting, email, IT support and security providers who help us operate our business systems;
• payment providers and financial institutions where a payment or refund is processed;
• couriers or delivery providers where delivery has been requested or agreed;
• professional advisers, insurers and auditors where they need information to provide services to us;
• government agencies, regulators, courts or law-enforcement bodies where disclosure is required or authorised by law; and
• a purchaser or successor entity if our business is reorganised, sold or transferred, subject to appropriate confidentiality and legal safeguards.

Where a service provider processes personal information on our behalf, we expect it to use the information only for the agreed service, protect it appropriately and return or delete it when it is no longer required, subject to legal retention obligations.

8. Overseas processing and transfers

Some service providers may store or process information outside New Zealand. Before disclosing personal information overseas, we take reasonable steps to ensure the disclosure is permitted under the Privacy Act 2020, including Information Privacy Principle 12. This may involve assessing the recipient's privacy safeguards, using contractual protections or relying on another lawful basis for the transfer.

Where the GDPR applies, transfers of personal data outside the European Economic Area will be made only where an appropriate transfer mechanism or other permitted safeguard is available, such as an adequacy decision, approved contractual clauses or another lawful exception.

9. How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, or for a period required by law. Retention periods vary according to the type of record and the reason it is held.

• General enquiries are normally retained for up to 24 months after the last meaningful contact, unless a longer period is needed to resolve a matter.
• Order, invoice, payment and accounting records are kept for the period required by applicable tax and accounting laws.
• Information about a custom order is retained for as long as needed to fulfil the order, handle follow-up questions and meet relevant recordkeeping requirements.
• Security logs are retained for a limited period appropriate to website security, troubleshooting and incident investigation.
• Marketing preferences are kept while you remain subscribed or until we no longer need the record to demonstrate your preference.

When information is no longer required, we take reasonable steps to securely delete it, destroy it or de-identify it.

10. Security and privacy incidents

We use reasonable physical, organisational and technical safeguards designed to protect personal information against loss, unauthorised access, use, modification or disclosure. These safeguards may include access controls, limited staff access, secure service providers and appropriate handling of paper and electronic records.

No website, email service or method of electronic storage can be guaranteed to be completely secure. If a privacy breach occurs, we will assess the risk and take steps required by law. Under New Zealand law, a breach that has caused or is likely to cause serious harm must be notified to the Privacy Commissioner and affected individuals as required. Where the GDPR applies, we will also meet its breach notification requirements, including notification to the relevant supervisory authority within the applicable timeframe where required.

11. Your privacy rights in New Zealand

Under the Privacy Act 2020, you may request access to personal information we hold about you and ask us to correct information that is inaccurate, incomplete or misleading. You may also ask us to attach a statement of correction if we do not agree to make a requested change.

We may need to verify your identity before responding. We will respond within the timeframe required by law. In limited circumstances, a request may be refused or restricted under a legal exception. If that happens, we will explain the reason where we are permitted to do so and tell you how to raise a concern with the Office of the Privacy Commissioner.

12. Additional rights where the GDPR applies

Where the GDPR applies to our processing of your personal data, you may also have the right to request rectification or erasure, restrict processing, object to processing based on legitimate interests, receive certain data in a portable format, withdraw consent and lodge a complaint with a competent data protection supervisory authority.

These rights are subject to the conditions and exceptions in the GDPR. For example, we may need to retain certain order or accounting records to comply with legal obligations even if you request deletion. We will assess each request in light of the applicable law.

13. Children and young people

Our website and bakery services are intended for a general audience and are not designed to collect personal information directly from children. We ask that a parent or guardian contact us on behalf of a child where an order or enquiry requires personal details. If we become aware that we have collected information from a child in circumstances where it should not have been collected, we will take reasonable steps to address it.

14. Links to other websites

Our website may contain links to websites or services operated by other organisations. Those organisations have their own privacy practices and policies. We are not responsible for their content or handling of personal information, and we encourage you to review their policies before providing information to them.

15. Changes to this policy

We may update this Privacy Policy when our services, systems or legal obligations change. The revised version will be published on this page with an updated date. If a change materially affects how we use personal information already held, we will take any additional steps required by law.