Privacy Policy

Weleda New Zealand Limited (“Weleda”, “we”, “us”, “our”) is committed to protecting your privacy and will comply with our obligations under the Privacy Act 2020 (www.privacy.org.nz).

This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website, purchase our products, or interact with us.

By using our services, you agree to this Privacy Policy.

This Privacy Policy is governed by the laws of New Zealand. By providing personal information through our website or services, you acknowledge that your information will be collected, stored, used, and disclosed in accordance with New Zealand law, which may differ from the laws of your country of residence.

Contact us

Weleda New Zealand Limited
  Email: privacy@weleda.co.nz

What information we collect

Depending on how you interact with us, we may collect:

• Name
• Email address (not published for a product review)
• Phone number
• Address
• Billing address
• Details of your enquiry
• Order history
• Account login details
• Optional newsletter preferences (such as interests, pregnancy due date or baby date of birth)
• Details of event
• Date of birth
• Any content you submit (e.g. photos or responses)
• Notes
• Your first name and the first letter of your surname, or username (published) for a product review
• Your product review content

Sensitive information

Sometimes you may choose to share sensitive information (for example, health-related details in a product review). We only use this information with your consent or where required by law.

Information collected automatically

When you use our website, we may collect:

• IP address
• Device and browser type
• Pages visited and how you interact with our site
• Cookies and similar tracking technologies

How we use your information

We use your personal information for business purposes to:

• process and deliver your orders
• manage your account
• communicate with you, including customer support
• improve our products, services, and website
• understand how our website is used
• run promotions, competitions, and events
• send you marketing communications (if you’ve agreed)
• publish your reviews
• personalise content and advertising
• prevent fraud
• protect our legal rights and respond to issues
• meet our legal and regulatory obligations

Who we share your information with

We may disclose personal information within our corporate group (including subsidiaries) and to trusted third-party service providers where necessary, such as:

• IT and website hosting providers
• data storage providers
• payment providers
• customer management systems (e.g. Salesforce)
• delivery and logistics providers such as NZ Couriers.

We may also share your information:

• if required or authorised by law, including for law enforcement, public safety, or regulatory purposes
• to protect or enforce our legal rights
• with your permission
• in connection with a sale, merger, acquisition, or restructuring of our business, in which case your personal information may be transferred to the relevant third party.

All service providers are required to handle personal information in accordance with applicable privacy laws and only to the extent necessary to perform their functions.

Keeping your information accurate

Please make sure the information you provide is accurate and up to date. Let us know if anything changes.

How long we keep your information

We retain personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, including to:

• provide services and maintain our relationship with you;
• comply with legal and regulatory obligations;
• resolve disputes and enforce agreements.

Where information is no longer required, it will be securely deleted or anonymised, unless retention is required by law.

How we protect your information

We take reasonable technical and organisational measures to protect your personal information from loss, unauthorised access, misuse, alteration, or disclosure. These measures include encryption (such as SSL/TLS), secure systems, and restricting access to authorised personnel.

However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security of information transmitted to or from our website.

Weleda can (and you authorise Weleda to) disclose any information about you as required by law, including voluntary disclosures to law enforcement agencies and government officials, where we consider it necessary or appropriate.

Weleda may also disclose or use personal information to investigate and respond to complaints, claims, or suspected unlawful activity.

Overseas Disclosure of Personal Information

We may store or process your personal information in New Zealand or overseas, including through related companies and trusted third-party service providers.

Your personal information may be accessed or processed by authorised personnel or service providers located in other countries where we or our partners operate.

Your personal information may be transferred, stored, or processed outside New Zealand where:

• we use service providers located overseas to support our business operations
• you place an order for delivery outside New Zealand, in which case your information may be shared with shipping and fulfilment providers in the destination country

When we disclose personal information outside New Zealand, we take reasonable steps to ensure that recipients are subject to safeguards comparable to those under the Privacy Act 2020. These steps may include:

• contractual obligations;
• requiring adherence to recognised privacy standards; or
• relying on legal mechanisms that provide comparable protection.

By providing your personal information, you acknowledge and consent to its transfer, storage, and processing outside New Zealand in accordance with this Privacy Policy.

Your rights

You have the right to:

• request access to your personal information;
• request correction of your personal information;
• request deletion of your personal information where appropriate; and
• withdraw consent where processing is based on consent.

To do this, contact us at: privacy@weleda.co.nz

We may require proof of identity before responding to your request.

Complaints & Privacy Breaches

We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse. If a serious privacy breach occurs, we will notify affected individuals and the Privacy Commissioner in accordance with the Privacy Act and take appropriate action in response.

We will not be liable for the theft, destruction, or disclosure of your personal information where our security safeguards have been breached.

If you believe we have breached your privacy or not complied with this policy or the Privacy Act 2020, please contact us at privacy@weleda.co.nz.

We take privacy concerns seriously and will investigate your complaint promptly. We aim to respond within 14 business days of receiving your complaint.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner.

Updates to this policy

We may update this Privacy Policy from time to time. When we do so, we will revise the “last updated” date in this policy. Changes take effect when posted on our website.

Links to other websites

Our website may contain links to other websites. We are not responsible for their privacy practices.

Content Delivery Networks (CDNs)

We use content delivery network (CDN) services to ensure our website loads quickly, securely, and reliably.

We use services provided by:

• jsDelivr (Prospect One)
• Akamai Technologies, Inc.

A CDN helps deliver website content such as images, scripts, and stylesheets more efficiently by using servers located closer to you. This improves website performance, speed, and reliability.

When you visit our website, your browser may connect to CDN provider servers to load content. This connection may involve the processing of certain technical information.

The following information may be processed by CDN providers:

• your IP address
• browser and device information (such as user agent)
• requests for website content (e.g. pages, images, scripts)

This information is used solely to deliver website content and ensure the security and functionality of our website.

We use CDN services to:

• improve website speed and performance
• ensure reliable and efficient delivery of website content
• enhance website security and stability
• support a consistent user experience globally

CDN providers operate global networks, and your information may be processed outside New Zealand. Where this occurs, we take reasonable steps to ensure that overseas recipients are subject to safeguards comparable to those required under the Privacy Act 2020, including contractual protections where appropriate.

We do not control how long CDN providers retain personal information. Retention is determined by each provider in accordance with their own privacy policies.

Website Analytics (Mouseflow)

We use Mouseflow Analytics, a service provided by Mouseflow, Inc., to analyse how users interact with our website and to improve user experience and website performance.

Mouseflow Analytics uses cookies and similar browser technologies to:

• analyse user behaviour on our website
• recognise returning users
• track interactions such as clicks, mouse movements, and scrolling
• generate heatmaps and session replays
• produce reports and statistical analysis of website usage

This helps us understand how visitors use our website and improve functionality and usability.

Information collected through Mouseflow may be shared with Mouseflow, Inc.

We use Mouseflow Analytics based on your consent, in accordance with the New Zealand Privacy Act 2020 (and equivalent consent requirements for cookies and tracking technologies).

You can manage or withdraw your consent at any time through our cookie settings.

Mouseflow may process personal information outside New Zealand, including in the United States.

Where personal information is transferred overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under the New Zealand Privacy Act 2020.

We do not control how long Mouseflow retains personal information. Retention periods are determined by Mouseflow in accordance with its own privacy policy and operational requirements.

For more information about how Mouseflow handles personal information, please refer to their privacy policy.
 

Customer Relationship Management (CRM) and Personalised Communications

We use a Customer Relationship Management (CRM) system to help manage our relationship with customers and improve the services and experience we provide.

Information we collect and store.

Our CRM system may store personal information such as:

• name
• email address
• phone number
• delivery and billing address
• date of birth and gender (if provided)
• purchase history and order details
• customer service interactions and enquiries

We only collect this information where it is provided by you or generated through your interaction with our website and services.

We use our CRM system to:

• manage customer accounts and orders
• provide customer support and respond to enquiries
• improve our products, services, and website experience
• personalise communications and offers
• send post-purchase communications, including product review requests and feedback surveys
• understand customer preferences and purchasing behaviour

Where appropriate, we may use CRM data to help improve our overall customer experience and product offering.

We may use CRM data (such as email address, name, phone number, and purchase history) to create custom audiences for digital advertising.

This may include advertising platforms such as:

• Meta (Facebook and Instagram)
• Google
• TVNZ advertising services (including via Amazon services)

Where this occurs, your information is shared in a secure hashed format and used only for:

• audience matching
• delivery of relevant advertising
• measurement of advertising performance

No sensitive personal information is shared, and your details are not visible to other users on these platforms.

This processing helps us to:

• deliver more relevant and personalised advertising
• measure and improve the effectiveness of our marketing campaigns
• improve the customer experience and communication relevance
• better understand customer needs and engagement with our brand

We may use your contact details to send:

• order and service communications
• post-purchase emails (such as review or feedback requests)
• marketing communications (where permitted or consented to)

You can opt out of non-essential marketing communications at any time using the unsubscribe link in our emails or by contacting us directly.

We take reasonable steps to ensure CRM data is stored securely and only accessed by authorised personnel. We also ensure that third-party advertising partners handle data in accordance with their own privacy policies and applicable privacy laws.

Payment Providers

When purchasing from Weleda your financial details are passed through a secure server using the latest 128-bit SSL (secure sockets layer) encryption technology. 128-bit SSL encryption is approximated to take at least one trillion years to break and is the industry standard.

We do not store your full payment card details.

• Credit Card via Adyen. Your credit or debit card information will be transmitted directly to Adyen. We do not store credit card numbers. We transfer the information you provide during the ordering process, along with information about your order (e.g., name, address, IBAN, BIC, invoice amount, currency, and transaction number). We have concluded a data processing agreement with Adyen, in which we obligate Adyen to protect our customers' data and not to disclose it to third parties.
• PayPal. All payment data is entered directly into PayPal's system and cannot be read or stored by us. For payment processing, we transmit your name, invoice amount, and delivery address to PayPal. Paypal also collects data if you create an account with them. In this case, you will need to log in to the payment service provider with your access data during the ordering process. The data privacy policy of PayPal applies in this respect.
• Apple Pay. Payments made with Apple Pay are processed via the payment service Apple Inc. In Europe, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland is responsible (hereinafter "Apple Pay"). If you select payment via Apple Pay, the payment details you enter will be transmitted to Apple Pay. Without transmitting your personal data, we cannot process a payment via Apple Pay; however, you can choose a different payment method.
• Google Pay. Payments made with Google Pay are processed via the payment service of Google Inc. For Europe, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible (hereinafter "Google Pay"). Google also processes your data in the USA. Google is certified under the EU-US Data Privacy Framework. You can find more information here:

• If you select payment via Google Pay, the payment details you enter will be transmitted to Google Pay. Without the transmission of your personal data, we cannot process a payment via Google Pay; however, you can choose a different payment method.

Shipping Providers

To fulfill the contract, we will forward your data to our shipping provider – NZ Couriers (and subsequent international carriers if you have ordered from overseas). This data transfer is necessary for the delivery of the ordered goods.

Address Validation (Loqate)

We use an address validation service provided by GB Group plc (Loqate) to help ensure that the address details you enter on our website are accurate and complete.
  When you enter your address in our forms (for example, during checkout), the information you provide may be checked in real time via Loqate’s “Global Address” service.

• Your entered address is compared against Loqate’s address database
• Suggested matches may be displayed to help you select a valid address
• This helps prevent errors and ensures accurate data is recorded in our systems

To provide this service, the following information may be processed:

• the address details you enter
• your IP address

This information is shared with Loqate solely for the purpose of validating and standardising address data.
  We use address validation to:

• maintain accurate customer records
• reduce errors in orders and deliveries
• support efficient processing of purchases and enquiries

Loqate may process your information on servers located outside New Zealand, including in the United Kingdom and the United States.
  Your IP address may be temporarily stored by Loqate for up to 30 days after an address lookup request is made, after which it is deleted.

Product Safety, Quality Complaints and Adverse Events

We collect and process personal information relating to product safety, adverse effects, complaints, and quality issues to meet our legal obligations and ensure the safety and quality of our products.

This includes managing:

• adverse reactions or side effects (including cosmetovigilance and product safety monitoring)
• product complaints or quality defects

We process this information where necessary to:

• comply with legal and regulatory obligations
• investigate and respond to complaints or safety concerns
• monitor and improve product safety and quality

This processing is carried out in accordance with the Privacy Act 2020, including where collection and use is required by law or for legitimate safety and compliance purposes.

Depending on the nature of the report, we may collect:

Reporter details (if provided):

• name and contact details
• profession (e.g. healthcare professional or consumer)

Affected person details (where relevant):

• initials, age, gender, and date or year of birth
• health-related information such as symptoms, diagnosis, and outcomes
• relevant product usage, medications, allergies, or conditions
• other details relating to the reported issue

We may also collect additional information where it is voluntarily provided and relevant to the complaint or safety issue.

We use this information to investigate, assess, and manage complaints and safety issues, and to meet reporting obligations.

Information may be shared with:

• related companies within our group
• regulatory or health authorities where required
• service providers or logistics partners assisting with complaint handling

Where complaints are received by service providers, they may be forwarded to us for processing. We take reasonable steps to ensure personal information is protected and, where practicable, shared in a pseudonymised form.

Information is stored securely in our internal systems.

We retain records:

• for at least 10 years where required for product safety and regulatory purposes, and/or
• for up to 11 years after a complaint or quality issue is resolved

After this period, information is deleted or securely anonymised where deletion is not possible.

Product Reviews and User Content

You may choose to submit reviews, ratings, or other content about our products or website. Participation is entirely voluntary.
  When you submit a review, we may collect:

• your name or chosen username (pseudonym)
• your email address
• the content of your review (including ratings, text, or images)
• any additional information you choose to include

Providing your real name is not required.

How your review is displayed

• Your review will be published using the username you provide.
• Your email address will not be published.
• Reviews may be moderated before publication to ensure they comply with our guidelines.

  We use the information you provide to:

• publish and manage your review on our website
• allow other customers to benefit from your feedback
• verify that reviews are genuine and not submitted by automated systems or bots
• improve our products, services, and customer experience

If you are not logged into an account when submitting a review, we may use your email address to send a verification message.
  Please avoid including sensitive personal information (such as health information) in reviews. If you choose to include such information, you consent to it being published as part of your review.
  You can request to:

• update or delete your review
• withdraw your consent to the publication of your review

To do so, please contact us using the details provided in this policy.
  We reserve the right to remove reviews that are unlawful, misleading, offensive, or in breach of our terms.

Storage and retention

• Reviews remain visible on our website unless you request removal.
• Personal information associated with reviews will be deleted or anonymised upon request, or when no longer required, in accordance with the Privacy Act 2020.

Newsletter

When you subscribe to our email newsletter, we collect and use your personal information to provide you with updates, offers, and relevant content about Weleda.
  To subscribe, we require your email address. We may also collect:

• your first and last name
• your IP address
• the date and time of your subscription
• any additional information you choose to provide (optional)

Providing additional information is voluntary and helps us personalise communications and respond to enquiries.

We use your information to:

• send you newsletters and promotional communications
• personalise content based on your interests and preferences
• manage your subscription and respond to enquiries
• maintain records to help prevent misuse or fraudulent sign-ups

We may also collect information about how you interact with our emails (such as opens and clicks) using tracking technologies like web beacons or pixels. This helps us understand your interests and improve our communications.
  We use Salesforce as our email marketing platform to manage and send newsletters. Salesforce processes your personal information on our behalf under a data processing agreement and is required to protect your information in accordance with applicable privacy laws. Your data may be stored and processed on secure servers in accordance with Salesforce’s global infrastructure and safeguards.
  You can unsubscribe at any time by:

• clicking the unsubscribe link in any email, or
• contacting us at webshop@weleda.co.nz

  We retain your personal information for as long as you are subscribed to our newsletter. After you unsubscribe, we may retain limited information for record-keeping, compliance, and statistical purposes. Any data used for analytics will be anonymised where possible.

Product Tester Programme

If you are selected to participate as a Weleda product tester, we will collect and use your personal information to administer the programme.
  We may collect:

• your first and last name
• your email address
• your postal address

We use this information to:

• contact you your participation
• send you products for testing
• deliver any related rewards or prizes (if applicable)

Your postal address will only be used for delivery purposes in connection with the product tester programme.
  We may share your details with trusted third-party service providers (such as delivery or logistics providers) where necessary to send products or prizes.
  We retain your personal information only for as long as necessary to administer the product tester programme and fulfil its purpose, unless a longer retention period is required or permitted by law.

Competitions, Promotions and User Content

We may run competitions or promotions on our website and social media channels (including Facebook and Instagram). Participation is voluntary.
  When you enter a competition, we may collect:

• your name and contact details (e.g. email address)
• any content you submit (such as photos, reviews, or comments)
• any additional information required to administer the competition

We use your information to:

• administer the competition and contact winners
• deliver prizes
• verify entries and ensure fair participation
• promote the competition and its outcomes

In some cases, we may share your information with trusted service providers who assist with administering competitions or fulfilling prizes.
  If you enter a competition, you agree that:

• content you submit (such as photos or reviews) may be published on our website or social media channels
• your name or a shortened version of your name (e.g. first name and last initial) may be displayed alongside your entry

Publication will only occur where relevant to the competition and may be used for promotional purposes.

You are responsible for ensuring that any content you submit:

• complies with applicable laws
• does not infringe the rights of others (including image rights and copyright)

We reserve the right to moderate, refuse, or remove any content that is unlawful, inappropriate, or does not meet our requirements.

• Personal information is retained for the duration of the competition and for prize fulfilment.
• After the competition ends, personal information will be deleted or anonymised unless we are required to retain it for legal, record-keeping, or legitimate business purposes.

You can withdraw your consent and withdraw from a competition at any time by contacting us using the details in this policy. This may affect your eligibility to participate or receive a prize.

Image, Audio and Video Recordings (Events)

At Weleda events, we may take photographs, audio recordings, or video footage of attendees, including participants, service providers, and their employees or contractors.

We may use these recordings for:

• event documentation
• marketing and promotional purposes
• editorial and reporting purposes
• publication in print and digital media (including our website and social media channels)

If you do not wish to be photographed or recorded, please:

• inform event staff at the time of the event, or
• contact us using the details in this policy

Where reasonably practicable, we will take steps to respect your preference.
  We retain recordings only for as long as necessary for the purposes outlined above, unless a longer retention period is required or permitted by law.

Microsoft Services

We use services provided by Microsoft Corporation to support our marketing, communications, and business operations. These services may include Microsoft Advertising (Bing Ads), Microsoft Teams, and Microsoft Forms.

Microsoft Advertising (Bing Ads)

We use Microsoft Advertising to deliver relevant advertisements and measure the effectiveness of our marketing campaigns.
  Microsoft Advertising uses cookies and similar technologies to:

• recognise returning users
• analyse how users interact with our website
• measure advertising performance
• display advertisements based on your interests, behaviour, and general location

This may involve collecting information about your activity across websites to help build advertising profiles.
  Information processed may include:

• your IP address
• browser and device information (e.g. user agent)
• pages visited and interactions on our website
• approximate geographic location
• advertising and browsing behaviour

This information may be shared with Microsoft for advertising and analytics purposes.
  We use Microsoft Advertising cookies and tracking technologies only where you have provided consent through our cookie settings. You can withdraw or update your preferences at any time.

Microsoft Teams (Online Meetings and Webinars)

We use Microsoft Teams to host online meetings, webinars, and virtual events.

Depending on your participation, we may process:

• your name, email address, and profile details (if provided)
• meeting metadata (e.g. date, time, meeting ID)
• audio, video, and chat content shared during the session
• any information you choose to provide during the meeting

You can choose whether to enable your camera and microphone at any time.
  We use this information to:

• facilitate and manage online meetings and events
• communicate with participants
• provide relevant content and follow-up

If we intend to record a session, we will notify you in advance and seek your consent where required.

Microsoft Forms

We use Microsoft Forms to collect information, such as event registrations, feedback, or survey responses.
  This may include:

• your name and contact details
• responses you provide in forms or surveys
• any additional information you choose to submit

We use this information to:

• manage registrations and participation in events
• gather feedback and insights
• improve our products, services, and customer experience

Microsoft operates globally, and your personal information may be processed outside New Zealand, including in the United States and other countries where Microsoft or its service providers operate.

When personal information is transferred overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under the New Zealand Privacy Act 2020.

We do not control how long Microsoft retains personal information processed through its services. Retention periods are determined by Microsoft in accordance with its own privacy practices.

Cookies and Tracking

We use cookies and similar technologies to provide you with a smooth, personalised online experience.
  Cookies are small text files containing an alphanumeric identifier that are stored on your device when you visit a website. They help the website recognise your browser and remember certain information about your visit.
  We use cookies and similar technologies to:

• ensure our website functions properly
• enable core features such as logging into your account and maintaining your shopping cart
• remember your preferences and settings
• understand how our website is used and improve performance
• support marketing and advertising activities

Some cookies are necessary for the website to operate, while others help us improve your experience.

Cookies may be used to collect information such as:

• pages visited and interactions on our website
• browser type and device information
• general location based on your IP address

Your IP address is automatically transmitted when you access our website. We may store IP addresses for security purposes (for example, when completing a transaction), but otherwise do not use them to directly identify you unless you provide your information.

We may also use trusted third-party service providers to analyse website usage and performance.

You can control or disable cookies through your browser settings at any time. However:

• disabling cookies may affect the functionality of the website
• some features (such as login or checkout) may not work properly

For more detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Overview.

Managing your cookie consent (OneTrust)

We use a tool called OneTrust to manage cookie consent.

This allows you to:

• choose which cookies you accept
• withdraw your consent at any time

This tool may store:

• IP address: Technical delivery of a DSGVO-compliant cookie toolbar. Not stored.
• your consent preferences
• a pseudonymous browser ID
• basic device information such as browser, country, device type.

The software is operated by OneTrust as software as a service in the cloud.

Place of processing:
  European Union

Retention period cookie:
  1 year

Data retention period:
  1 year

Data recipient:
  OneTrust Technology Limited

Transfer to third countries:
  Worldwide

Further Information:

OneTrust Technology Limited
  82 St. John Street, London
  England, EC 1M 4JN
  Data protection officer email: dpo@onetrust.com.

OneTrust Privacy Policy.

Google and YouTube Advertising, Analytics and Website Services

We use services provided by Google LLC (including YouTube) to support our advertising, analytics, website functionality, and security.

These services may include:

• Google Ads (including conversion tracking, remarketing, and user lists)
• YouTube advertising and embedded video content
• Google Analytics
• Google DoubleClick (Google Marketing Platform)
• Google Ad User Lists and Dynamic Remarketing
• Enhanced Conversions
• Google Maps
• Google reCAPTCHA
• Google Fonts
• Google Content Delivery Network (CDN)
• Google Tag Manager
• Google AdSense

We use these services to:

• show relevant and personalised advertising on Google and YouTube
• measure and improve advertising performance
• understand how users interact with our website
• analyse website traffic and usage
• deliver website content efficiently and securely
• protect our website from spam, fraud, and misuse

Our website uses cookies, pixels, tags, and similar technologies that create a direct connection between your browser and Google’s servers.

Information collected may include:

• IP address
• device and browser information (including user agent)
• pages visited and actions taken
• time spent on pages and navigation behaviour

Google may associate this information with a unique identifier (such as a cookie or device advertising ID), allowing your browser or device to be recognised across different websites and services, including YouTube.

We do not have visibility of your activity on other websites.

Google Analytics

We use Google Analytics to evaluate how users interact with our website, including visitor numbers, pages viewed, and time spent on the site.

Google Analytics uses cookies and similar technologies to recognise returning users and generate reports on website activity.

We rely on your consent to use Google Analytics.

Google Ads, DoubleClick and Conversion Tracking

We use Google Ads and related services (including DoubleClick) to display and optimise advertising.

These services allow us to:

• show interest-based advertisements
• track ad interactions and conversions
• prevent duplicate advertisements
• measure the effectiveness of campaigns

When you click on a Google advertisement, a conversion tracking cookie may be set. This allows us to generate aggregated statistics about ad performance without identifying individual users.

Google may collect and process:

• IP address
• device and browser data
• interactions with advertisements and our website

If you are logged into a Google account, your activity may be associated with your account.

Remarketing and Ad User Lists

We use Google Ad User Lists and Dynamic Remarketing to display advertisements to users who have previously visited our website.

These tools:

• assign a unique identifier (via cookies or device IDs)
• recognise users across websites and apps
• enable targeted advertising based on prior interactions

We do not have visibility of your activity on other websites.

Enhanced Conversions

Where you have provided consent, we use Enhanced Conversions.

This allows hashed personal data (such as your name or email address) to be securely transmitted to Google to improve conversion tracking and advertising performance.

YouTube (embedded content)

We embed video content from YouTube.

When you access embedded videos:

• your browser connects to YouTube/Google servers
• your IP address and browser information may be transmitted
• YouTube may collect usage data and associate it with your account if logged in

Where possible, we use YouTube’s enhanced privacy mode:

• cookies are not initially stored when the page loads
• data (such as IP address) is still transmitted
• cookies may be set once you play a video

Google Maps

We use Google Maps to provide location and directions functionality. This requires your browser to connect to Google servers and may involve the transmission of your IP address and device information.

Google reCAPTCHA

We use Google reCAPTCHA to protect our website from spam and automated misuse. This service analyses user behaviour (such as mouse movements and time spent on pages) and may collect IP address and browser data.

Google Fonts and CDN

We use Google Fonts and Google’s Content Delivery Network (CDN) to ensure our website loads efficiently and displays correctly. This may involve transmitting your IP address and technical data to Google servers.

Google Tag Manager

We use Google Tag Manager to manage and deploy tracking technologies. Tag Manager itself does not collect personal information but facilitates the operation of other services.

Google AdSense

We may use Google AdSense to display advertisements. AdSense uses cookies and web beacons to analyse usage, deliver relevant ads, and measure performance.

Cookies and cross-site tracking

Google technologies use cookies and similar tools to:

• store and access information on your device
• track activity across websites, apps, and devices over time

This enables personalised and interest-based advertising.

We rely on your consent (via our cookie banner) where required.

Information collected through these services is shared with and processed by Google LLC.

This may include transferring your personal information outside New Zealand, including to the United States and other countries. We take reasonable steps to ensure that any overseas recipients provide safeguards comparable to those required under the Privacy Act 2020.

We do not control how Google uses information it collects for its own purposes or how long it retains that information.

You can manage how your information is used by:

• adjusting your advertising preferences in your Google account (including YouTube settings)
• opting out of personalised advertising via Google Ads settings
• adjusting your browser settings to refuse cookies
• using device-level privacy controls

Meta (Facebook and Instagram) Advertising and Tracking

“Facebook Custom Audiences” and “Facebook Pixel” are products of Meta Platforms, Inc., with a regional office at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

We use these tools to support our advertising, analytics, and marketing activities.

We use Meta technologies to:

• understand how users interact with our website
• measure the effectiveness of our advertising
• deliver advertising that is relevant to your interests
• optimise our marketing campaigns

Our website uses the Facebook Pixel, which establishes a direct connection between your browser and Meta’s servers.

This allows us to:

• track behaviour after you click on a Facebook or Instagram advertisement
• understand how our marketing is performing
• improve and optimise our advertising

Through this integration, Meta may receive information including:

• pages visited and actions taken on our website
• your IP address
• device, browser, and technical information

If you are logged into Facebook or Instagram, Meta may associate this information with your account. Even if you are not logged in, Meta may still collect certain identifying information.

We do not control the scope or further use of data collected by Meta through this tool.

Custom Audiences and Lookalike Audiences

Where you have given consent, we may use your personal information (such as your email address or phone number) to create “Custom Audiences”.

This involves:

• securely hashing (encrypting) your contact details before sharing them with Meta
• matching that data with Meta users

This enables us to:

• show advertising to users who have interacted with us
• target users who may be interested in our products or services
• create “Lookalike Audiences” to reach people with similar characteristics

We use Enhanced Matching where you have consented.

This allows us to send hashed personal data (such as names and email addresses) alongside Pixel data to Meta.

This helps us:

• improve conversion tracking accuracy
• better measure advertising performance
• expand our Custom Audiences and reach more relevant users

All personal data shared in this way is hashed before transmission to help protect your information.

The Facebook Pixel and related tools use cookies and similar technologies to store and access information on your device and track activity across websites and devices over time.

We rely on your consent (via our cookie banner) to use these technologies.

Information collected through these tools is shared with and processed by Meta in accordance with its Data Policy.

This may include transferring your personal information outside New Zealand, including to countries such as the United States. We take reasonable steps to ensure that any overseas recipients protect your information in a way that is comparable to the safeguards required under the Privacy Act 2020.

We do not control how Meta uses information it collects for its own purposes.

You can control how your information is used by:

• adjusting your advertising preferences within your Facebook or Instagram account
• using Meta’s tools such as “Activity Log” and “Download Your Data”
• changing your browser settings to refuse cookies
• contacting us to opt out of the use of your information for Custom Audiences

For more information about how Meta handles your personal information, please refer to its Data Policy.

TikTok

We use TikTok advertising services, including the TikTok Pixel provided by TikTok Technology Limited, to support our marketing activities and measure the effectiveness of our advertising campaigns.

The TikTok Pixel uses cookies and similar tracking technologies to:

• measure the performance of our TikTok advertising campaigns
• understand how users interact with our website after viewing or clicking an ad
• create audience segments (Custom Audiences) for advertising purposes
• deliver more relevant advertising to users on TikTok

These technologies may track your activity across websites and over time to support personalised advertising.

TikTok may collect and process information such as:

• your IP address
• device and browser information
• pages visited on our website
• actions taken on our website (e.g. purchases, clicks, or views)
• cookie and advertising identifiers

This information is collected through cookies, pixels, and similar technologies.

We use TikTok Pixel data to:

• deliver relevant advertising on TikTok
• measure and improve the performance of our advertising campaigns
• better understand how users engage with our website
• create aggregated audience insights for marketing optimisation

We only use TikTok Pixel and related tracking technologies where you have provided consent through our cookie settings. You can withdraw or change your preferences at any time.

Information collected via TikTok may be processed outside New Zealand, including in countries where TikTok or its service providers operate.

When personal information is transferred overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under the New Zealand Privacy Act 2020.

You can manage how TikTok and similar services use your information by:

• adjusting your browser settings to block or delete cookies
• managing your advertising preferences in your TikTok account
• opting out of personalised advertising where available

We do not control how long TikTok retains information collected through its services. Retention is determined by TikTok in accordance with its own privacy policy.

For more information about how TikTok handles personal information, please refer to TikTok’s privacy policy.

TVNZ

We use advertising and remarketing services provided by TVNZ to deliver relevant advertisements and measure the effectiveness of our marketing campaigns.

As part of this process, we may also use secure data handling and cloud infrastructure provided by

Amazon Web Services (AWS) to upload and process customer information in a privacy-protective manner.

We may use your information to:

• Deliver more relevant advertising to you on TVNZ platforms and other digital channels
• Measure and improve the performance of our advertising campaigns
• Match our existing customer data with audiences on TVNZ and other platforms

This may include personal information such as:

• Name
• Email address
• Phone number
• Purchase history and interactions with our brand

Before sharing, personal information such as email addresses is hashed (converted into an encrypted code) to help protect your identity.

Hashed data may be securely shared with TVNZ and processed using AWS infrastructure. This information may be stored or processed outside New Zealand. Where this occurs, we take reasonable steps to ensure your information is protected in accordance with the New Zealand Privacy Act 2020, including appropriate safeguards for international data transfers.

We use TVNZ’s advertising tools to understand the effectiveness of our television advertising.

These tools may:

• Analyse aggregated website visits, orders, and sales following TV advertising
• Measure campaign performance and reach
• Use anonymised or aggregated data wherever possible

This information does not directly identify you and is used solely for statistical analysis and optimisation of our advertising.

You can:

• Request that your information is not used for targeted advertising by contacting us
• Unsubscribe from marketing communications at any time
• Manage your advertising preferences through TVNZ or other platforms where available.

Taboola Advertising

We use Taboola Ads, a service provided by Taboola, Inc., to display personalised and relevant advertising on our website and across the internet.

Taboola uses cookies and similar tracking technologies to:

• analyse how users interact with our website and other websites
• recognise returning users
• deliver personalised and interest-based advertising
• optimise the relevance and performance of advertisements
• build audience segments based on browsing behaviour and general location

These technologies may track your activity across different websites over time.

Taboola may collect and process information such as:

• your IP address
• browser and device information (e.g. user agent)
• pages visited and interactions on our website
• cookie and advertising identifiers
• general geographic location and browsing behaviour

This information may be used to support targeted advertising and analytics.

We use Taboola Ads to:

• deliver more relevant advertising to users
• measure and improve the performance of our advertising campaigns
• understand user engagement with our website
• support marketing optimisation and audience insights

We only use Taboola cookies and tracking technologies where you have provided consent through our cookie settings. You can withdraw or change your preferences at any time.

Information collected through Taboola may be processed outside New Zealand, including in the United States.

Where personal information is transferred overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under the New Zealand Privacy Act 2020.

We do not control how long Taboola retains personal information collected through its services. Retention is determined by Taboola in accordance with its own privacy policy.

For more information about how Taboola handles personal information, please refer to its privacy policy.

Social Media

We maintain a presence on social media platforms such as Facebook, Instagram, YouTube, LinkedIn, Pinterest, and TikTok to promote our products and services, and to communicate with customers, users, and the public.

When you interact with our social media pages, the platform providers may collect and process your personal information.

This can include:

• your IP address and device information
• your interactions (such as likes, comments, shares, and views)
• browsing behaviour across websites and platforms
• location information and profile data

These platforms use cookies and similar technologies to track user behaviour and may create profiles for advertising and market research purposes. Each platform operates under its own privacy policy and independently determines how your information is processed.
  We may process information you make publicly available on social media to:

• respond to your comments, messages, or enquiries
• engage with users and provide customer support
• run promotions or competitions (where applicable)
• understand general engagement through aggregated analytics (“insights”)

We only have access to limited information (such as your public profile and interactions with our content). We do not have access to the full data held by social media platforms about you.
  Social media platforms provide us with aggregated, non-identifiable insights about how users interact with our content. These insights help us understand audience engagement but do not allow us to identify individual users.
  Any content you post on our social media pages (such as comments, images, or messages) may be publicly visible. Please avoid sharing sensitive personal information through these channels.

We may process:

• your username and publicly available profile information
• comments, messages, or content you submit
    for the purpose of engagement, moderation, and communication.

We reserve the right to moderate or remove content that is unlawful, inappropriate, or breaches our guidelines. In some cases, we may retain records of removed content for legal or evidentiary purposes.
  Social media platforms operate globally, and your personal information may be processed outside New Zealand. This may include countries where privacy protections differ from those in New Zealand.

Where we share personal information with social media providers, we take reasonable steps to ensure appropriate safeguards are in place, in line with the New Zealand Privacy Act 2020.
  As social media platforms control most of the data processing, you should contact the relevant platform directly to:

• access your personal information
• request deletion or correction
• manage your privacy settings

You can also adjust your privacy and advertising preferences within your social media account settings.

Social Sharing Buttons

Our website includes social sharing buttons that allow you to share content on social media platforms. To protect your privacy, we use a privacy-friendly solution known as Shariff.
  Shariff ensures that:

• no personal information is automatically shared with social media platforms when you visit our website
• no data is transmitted to social networks unless you actively click on a sharing button
• simply browsing our website does not trigger data collection by social media providers through these buttons

If you choose to click on a social sharing button:

• a connection is made to the selected social media platform
• your data (such as your IP address or browser information) may then be transmitted to that platform
• the platform may process your information in accordance with its own privacy policy

We do not control how these third-party platforms use your information once you interact with them.
  Weleda does not collect or store personal information through the social sharing buttons themselves.
  For more information about how Shariff works, please refer to the provider’s website.