Cookie Policy

1. Who we are and when this Policy applies

In this Policy, “Criollo”, “we”, “us” and “our” mean Criollo Designer Cakes NZ Ltd, trading as Criollo Designer Cakes. We are a New Zealand business based in Dunedin, Otago, New Zealand, and the agency responsible for personal information collected through this website and our direct dealings with customers.

This Policy applies when you browse our website, use its shop, cart or checkout, submit a form, follow an embedded feature, or otherwise interact with technology placed or requested through our website. It should be read with our Privacy Statement and Terms and Conditions.

2. What cookies and similar technologies are

A cookie is a small data file that a website or service may store in your browser. Cookies can recognise a browser, keep a shopping cart available, remember a choice, protect a payment, or help measure how a website is used. A session cookie normally expires when a browsing session ends. A persistent cookie remains until its stated expiry, until it is replaced, or until you delete it.

“Similar technologies” include local storage, session storage, tags, pixels, software development tools, embedded content and scripts. These may store or read an identifier, or transmit information such as an IP address, browser and device details, referring page, pages viewed, approximate location, interactions and time information.

Some information is not identifying by itself but may become personal information when combined with an account, order, device identifier or other information. We handle such information in accordance with our Privacy Statement and applicable law.

3. The categories we use

4. Cookies and related technologies currently associated with our website

The table below describes the visitor-facing cookie families and related technologies we reasonably expect from our present website configuration. A name ending in an asterisk is a family whose final characters can vary. Not every item is used on every visit; use depends on the page, feature, browser, logged-in state and choices you make.

Durations are typical maximums based on the provider or present configuration and may be shorter because of browser controls, consent withdrawal, provider changes or deletion. A browser or service may also use security identifiers not visible to us by their final name.

Services and recipients

5. Consent and how to control cookies

Our consent tool

On your first visit, our cookie banner offers controls for the categories available on the site. Choosing “Accept”, “Deny” or saving selected preferences records that choice for the browser and device you are using. Strictly necessary technology remains available where it is required to provide a service you request or to secure the website.

You can review or change optional choices at any time through the Manage consent control at the bottom of the website. A changed choice applies from that point forward. It may not automatically erase information previously received and lawfully retained by us or a provider, so you may also delete cookies through your browser.

Browser and device controls

• You can block, limit or delete cookies through your browser or device settings.
• You can use private-browsing controls and available tracking-protection settings.
• You can avoid opening or activating an optional map, social-media or messaging feature.
• You may contact our Privacy Officer if the website does not respect a saved optional choice.

If you clear browser storage, change browser, use another device, or browse privately, we may not be able to recognise an earlier choice and may ask again. Blocking strictly necessary technology can cause the cart, checkout, account, payment, security or consent controls to fail.

6. What information we receive and why we use it

Depending on the feature and your choices, cookie-derived information may include:

• IP address, browser type, device type, operating system and broad location;
• pages viewed, referring page, landing page, dates, times and interaction events;
• cart, checkout, login, payment-security and consent-status identifiers;
• advertising, campaign or conversion identifiers where marketing tools are enabled; and
• information you intentionally provide through a shop, account, form, chat or external service.

We use relevant information for lawful purposes including to:

• deliver pages and functions you request;
• operate the cart, checkout, payments and customer accounts;
• secure the website, detect misuse, prevent fraud and manage disputes;
• remember privacy and display choices;
• diagnose errors and improve website content and performance;
• measure visits, referrals, orders and advertising performance where permitted; and
• comply with legal, accounting, regulatory and enforcement obligations.

We collect only information reasonably necessary for a lawful business purpose and do not use cookie-derived personal information for a materially different purpose unless permitted by law or we take reasonable steps to notify you and obtain authorisation where required.

7. Sharing, third-party features and independent websites

We may make relevant information available to service providers that operate, secure, analyse or support the website, store consent choices, process payments, prevent fraud, provide maps, display social content, support communication, or assist our professional and legal functions. We disclose only what is reasonably required for the relevant lawful purpose.

We may also disclose information where required or permitted by law, including to respond to a lawful court order, regulator, Police request, payment dispute, fraud investigation, legal claim, or a transaction involving the business. We do not sell, rent or trade customer or cookie-derived personal information to unrelated businesses for their own marketing.

If you intentionally leave our website or open a separate payment, mapping, Instagram, Facebook, WhatsApp or other third-party service, that provider may collect information under its own terms and privacy policy. A provider’s separate policy does not remove any responsibility that New Zealand law places on us for our own collection, use or disclosure.

8. Overseas processing and safeguards

Some website, payment, analytics, advertising, mapping, font, consent and social-media providers may process or store information outside New Zealand, including in the United States and other countries in which they or their service providers operate. Their local privacy rules may differ from New Zealand law, and lawful overseas authorities may be able to require access.

Where Information Privacy Principle 12 applies to a disclosure by us, we take reasonable steps to establish that the overseas recipient is subject to the New Zealand Privacy Act 2020, provides comparable safeguards, or is bound by appropriate contractual protections. If those grounds are unavailable and the law permits reliance on informed authorisation, we will explain that the overseas recipient may not be required to protect the information in a way that is comparable to New Zealand law before seeking that authorisation.

In some circumstances an overseas provider holds or processes information solely as our agent and does not use or disclose it for its own purposes. The legal treatment of that arrangement differs from a disclosure to an independent overseas recipient, but we still take reasonable steps to use reputable providers and appropriate privacy and security terms.

9. Retention and security

Browser-side cookies and storage remain for the periods described in section 4 unless they are deleted earlier, replaced, blocked, shortened by a browser, or removed when a service changes. We retain cookie-derived information only for as long as reasonably required for the lawful purpose for which it was collected, including security, analysis, transaction records, legal compliance and dispute management.

Aggregated or de-identified reporting may be retained where it no longer identifies an individual. Relevant records may be kept longer for an active complaint, chargeback, debt, fraud matter, insurance matter, investigation, court proceeding, statutory duty or reasonably anticipated legal claim.

We use safeguards reasonable for the nature of the information and our business, including secured website connections, access controls, maintained website software and reputable service providers. No internet transmission, browser storage or online system can be guaranteed completely secure, and this Policy does not make such a guarantee.

10. Your New Zealand privacy rights

Under the New Zealand Privacy Act 2020, you may:

• ask whether we hold personal information about you;
• request access to personal information we hold about you;
• ask us to correct information that is inaccurate, incomplete or misleading;
• provide a statement of correction if we do not make a requested correction;
• ask us to delete information no longer needed, subject to lawful retention requirements;
• withdraw optional cookie or marketing permission for future processing; and
• complain about how we have handled your personal information.

Before releasing or changing personal information, we may request reasonable evidence of identity or authority. We will make and communicate a decision on an access or correction request as soon as reasonably practicable and no later than 20 working days, unless a lawful extension applies. Access may be withheld only where permitted by the Privacy Act.

We encourage you to contact our Privacy Officer first so we can investigate and try to resolve the issue. You may also complain to the Office of the Privacy Commissioner. Contacting us first does not remove a right to approach a regulator or tribunal where the law permits.

11. New Zealand focus, overseas visitors and applicable law

Our business, production and website administration are based in New Zealand. Our products and services are offered for collection or delivery in New Zealand locations agreed by us. The website’s technical availability in another country does not, by itself, mean that we direct our products or services to that country.

This Policy is designed primarily for the New Zealand Privacy Act 2020 and other applicable New Zealand law. We do not use this Policy or a cookie choice to exclude, waive or reduce any right, remedy, jurisdiction or obligation that cannot lawfully be excluded under New Zealand law or any mandatory overseas law that validly applies.

To the extent that a choice of law or forum can lawfully apply to a dispute about this Policy or our website cookie practices, New Zealand law governs and the courts and tribunals of New Zealand have exclusive jurisdiction. This clause is subject to any mandatory law that gives a person a non-excludable right to use another regulator, court or forum.

12. Changes to this Policy

Website tools, providers and cookie names can change. We may update this Policy when our website, providers, practices or legal obligations change. The current version will be posted at this URL with a revised effective date. If a material change affects how we intend to use personal information already collected, we will take reasonable steps to notify affected people and obtain authorisation where required.

Provider-set names and durations can change without our direct control. A description such as “provider-set” is not permission for unlimited retention: our own retention and provider-management obligations continue to apply. If you believe an unlisted or misclassified technology is operating, please tell our Privacy Officer so we can investigate and correct the notice or configuration where necessary.