Privacy policy

Gecko Creationz — Privacy Policy

Last updated: 23 April 2026

1. Who We Are

Gecko Creationz is a trading name of Straw Lodge Vineyard Limited, a New Zealand-based skincare business. We make and sell handcrafted tallow-based skincare products through our online store at geckocreationz.com (the "Store").

Our Store is hosted on Shopify, which provides the e-commerce platform that enables us to sell our products to you. This means that when you use our Store, both Gecko Creationz and Shopify process your personal information.

Business address: 17 Fareham Lane, Renwick 7271, Marlborough, New Zealand Email: ecoshine@geckocreationz.com Phone: +64 021 127 0292

2. About This Policy

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights under the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988 (for our Australian customers).

We may update this policy from time to time. If we make significant changes, we will post a notice on our Store. The "Last updated" date at the top tells you when this policy was last revised.

By using our Store, you acknowledge that you have read and understood this Privacy Policy. If our Terms of Service conflict with this Privacy Policy on a privacy matter, this Privacy Policy takes precedence.

3. What Personal Information We Collect

We collect different types of personal information depending on how you interact with us.

Information you give us directly

Contact details. Your name, email address, phone number, and postal address (when you place an order, create an account, or contact us).
Delivery information. Shipping and billing addresses you provide at checkout.
Communications. Your questions, feedback, product reviews, and any other messages you send us.
Account details. If you create an account, your username, password, and preferences.

Information collected automatically

Device and browser data. Your IP address, browser type and version, operating system, and device type.
Usage data. Pages you visit on our Store, products you view or add to your cart, time spent on pages, and referring websites.
Cookies. We use cookies and similar tracking technologies to collect this information. See Section 7 (Cookies and Tracking) for details.

Information from third parties

Shopify. Shopify provides us with analytics about Store usage and transactions.
Social media. If you interact with our social media pages, the platform may share limited information with us (such as your public profile).

Payment information

When you make a purchase, your payment card details are processed securely by our payment provider (Shopify Payments, which is powered by Stripe). We do not see, receive, or store your full card number, CVV, or bank account details. We only receive confirmation that payment was successful, along with the last four digits of your card and the card type, for order reference purposes.

4. Why We Collect Your Information and How We Use It

Under the New Zealand Privacy Act 2020, we must only collect personal information for a lawful purpose connected to our business, and the collection must be necessary for that purpose. Here is how we use the information we collect.

To fulfil your orders

We use your name, address, email, and phone number to process and deliver your orders, handle returns or exchanges, and send you order confirmations and shipping updates. This is necessary to perform our contract with you.

To communicate with you

We use your contact details to respond to your enquiries, provide customer support, and notify you about changes to your order or account.

To send you marketing (with your consent)

If you sign up to our mailing list or opt in at checkout, we may send you emails about new products, promotions, and skincare tips. You can unsubscribe at any time using the link in every marketing email. We comply with the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Australia) — we will never send you marketing emails without your consent, and every email includes a working unsubscribe option.

To improve our Store and products

We use usage data and analytics to understand how customers browse our Store, which products are popular, and how we can improve the shopping experience. This data is generally aggregated and does not identify you personally.

To show you relevant advertising

We use cookies from Google Analytics and Meta (Facebook Pixel) to understand how visitors find and use our Store, and to show you relevant advertisements on other websites and social media platforms. See Section 7 for how to opt out of this tracking.

To prevent fraud and protect security

We use device and transaction data to detect and prevent fraudulent orders, unauthorised access, and other security threats.

To comply with the law

We may use or disclose your information where required by law, such as to comply with tax obligations, respond to a court order, or cooperate with law enforcement. We retain order and financial records for seven years as required by New Zealand tax law (Tax Administration Act 1994).

5. Who We Share Your Information With

We do not sell your personal information. We share your information only with the following parties, and only to the extent necessary.

Shopify. Our e-commerce platform. Shopify hosts our Store and processes your orders, payments, and account information on our behalf. Shopify has its own privacy obligations — you can read their consumer privacy policy at privacy.shopify.com.
Payment processors. Your payment is processed by Shopify Payments (powered by Stripe). They receive your payment card details directly — we never see or store them.
Shipping and delivery. We share your name, address, and phone number with NZ Post or our courier partner to deliver your orders.
Analytics and advertising. We use Google Analytics and Meta (Facebook) Pixel to analyse website traffic and advertising performance. These services collect data through cookies on our Store. See Section 7 for details and opt-out options.
Email marketing. We use a third-party email marketing provider to manage our mailing list and send marketing emails. If you subscribe, your email address and name are shared with this provider.
Legal requirements. If required by law, court order, or to protect safety, we may disclose your information to law enforcement, regulatory bodies, or government agencies.
Business transfers. If our business is sold, merged, or restructured, your information may be transferred to the new owner as part of the business assets. We will notify you if this happens.

6. Overseas Transfers of Your Information

Because we use Shopify, your personal information is stored and processed on servers located in Canada and the United States. Our analytics providers (Google, Meta) and email marketing tools also process data overseas.

Under the New Zealand Privacy Act 2020 (Information Privacy Principle 12), we may only disclose your personal information to an overseas person or organisation if we are satisfied that they are subject to privacy protections comparable to those in New Zealand, or if you authorise the disclosure, or if another exception applies.

Shopify, Google, and Meta are established technology companies with comprehensive privacy and data protection programmes. We are satisfied that they provide a level of privacy protection that is broadly comparable to New Zealand law. However, we cannot guarantee that overseas laws will protect your information to the same standard as New Zealand law.

For our Australian customers: information transferred overseas is handled in accordance with Australian Privacy Principle 8 of the Privacy Act 1988 (Cth).

7. Cookies and Tracking Technologies

Our Store uses cookies (small text files stored on your device) and similar technologies. Here is what we use and why.

Essential cookies (required)

These are set by Shopify and are necessary for the Store to function. They remember your cart contents, keep you logged in, and process checkout. You cannot opt out of these without breaking the Store.

Analytics cookies (Google Analytics)

We use Google Analytics to understand how visitors find and use our Store — which pages are popular, how long people stay, and where visitors come from. Google Analytics collects your IP address, browser type, pages visited, and referral source. This data is aggregated and used to improve our Store. Google may also use this data in accordance with their own privacy policy (policies.google.com/privacy).

Advertising cookies (Meta / Facebook Pixel)

We use the Meta (Facebook) Pixel to measure the effectiveness of our Facebook and Instagram advertising, and to show relevant ads to people who have visited our Store. The Pixel collects data about your browsing activity on our Store and shares it with Meta. Meta uses this data in accordance with their own privacy policy (facebook.com/privacy).

How to manage cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, blocking essential cookies will prevent our Store from working properly. You can also opt out of specific tracking:

Google Analytics: Install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout)
Facebook: Adjust your ad preferences at facebook.com/adpreferences
General: Visit youronlinechoices.com.au (Australia) or youradchoices.com (general) to opt out of interest-based advertising from multiple providers

8. How Long We Keep Your Information

Under the New Zealand Privacy Act 2020 (Information Privacy Principle 9), we must not keep your personal information for longer than necessary for the purpose it was collected.

Order and financial records. We retain order records, transaction details, and invoices for seven years from the date of the transaction, as required by New Zealand tax law.
Account information. If you have an account, we keep your account information for as long as your account is active. You can request deletion at any time (see Section 9).
Marketing data. If you subscribe to our mailing list, we keep your email address until you unsubscribe. After unsubscribing, we retain a record that you opted out (to ensure we do not re-subscribe you) but delete all other marketing data within 30 days.
Analytics data. Server logs and analytics data are retained in aggregated (non-identifying) form. Raw data that could identify you is deleted or anonymised within 26 months (Google Analytics default retention period).
Customer support communications. If you contact us with a question or complaint, we keep the correspondence for two years after the matter is resolved, unless a longer period is required by law.

9. Your Rights

For New Zealand customers

Under the Privacy Act 2020, you have the right to:

Access your information. Request access to the personal information we hold about you (Information Privacy Principle 6). We will respond within 20 working days.
Correct your information. Ask us to correct any personal information that is inaccurate, incomplete, or misleading (Information Privacy Principle 7).
Request deletion. Ask us to delete personal information we no longer need. Note that we cannot delete information we are legally required to keep (such as tax records).
Opt out of marketing. Unsubscribe from marketing emails at any time using the link in any email, or by contacting us directly.

For Australian customers

Under the Australian Privacy Act 1988, you have similar rights to access and correct your personal information. You also have the right to complain about how we handle your information (see Section 15).

How to make a request

To exercise any of these rights, email us at ecoshine@geckocreationz.com with the subject line "Privacy Request." We may need to verify your identity before processing your request — we will ask you to confirm details that only the account holder would know (such as recent order numbers). We will never ask for your password.

We will respond to all requests within 20 working days. If we cannot fulfil your request (for example, because we are legally required to keep the information), we will explain why.

10. How We Protect Your Information

We take reasonable steps to protect your personal information from unauthorised access, loss, misuse, or disclosure. Our security measures include:

Encryption in transit. All data transmitted between your browser and our Store is encrypted using SSL/TLS (you will see the padlock icon in your browser).
Secure payment processing. Payment card details are handled entirely by Shopify Payments (Stripe), which is PCI DSS Level 1 certified — the highest level of payment security certification.
Access controls. Access to customer data is limited to authorised personnel who need it to fulfil orders and provide customer support.

No method of electronic storage or transmission is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. We recommend that you use a strong, unique password for your account and do not share your login details with anyone.

11. Data Breaches

Under the Privacy Act 2020, we are required to notify the Office of the Privacy Commissioner and affected individuals if a privacy breach occurs that is likely to cause serious harm. If we become aware of a notifiable breach, we will:

Notify the Office of the Privacy Commissioner as soon as practicable
Notify affected individuals as soon as practicable, with details of the breach, what information was affected, and what steps we are taking
Take reasonable steps to contain the breach and prevent further harm

12. Children

Our Store is not directed at children, and we do not knowingly collect personal information from children under the age of 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at ecoshine@geckocreationz.com and we will delete it promptly.

13. Links to Other Websites

Our Store may contain links to other websites (such as our social media pages, supplier websites, or review platforms). We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing them with your information.

14. Shopify's Role

Our Store is built on Shopify. Shopify collects and processes personal information about your use of our Store in order to provide and improve its e-commerce platform. This includes data about your browsing activity, device information, and transactions.

Shopify may also use data from your interactions with our Store (and other Shopify-powered stores) to improve its services, provide analytics, and support advertising features. When Shopify processes your data for its own purposes, Shopify is responsible for that processing and for responding to any privacy requests related to it.

You can read Shopify's consumer privacy policy at privacy.shopify.com. If you want to exercise your privacy rights in relation to data Shopify holds, you can do so through Shopify's privacy portal at privacy.shopify.com/en.

15. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at ecoshine@geckocreationz.com. We will investigate your complaint and respond within 20 working days.

If you are not satisfied with our response, you can lodge a complaint with:

New Zealand

Office of the Privacy Commissioner Website: privacy.org.nz Phone: 0800 803 909 (free within NZ) Email: enquiries@privacy.org.nz

Australia

Office of the Australian Information Commissioner (OAIC) Website: oaic.gov.au Phone: 1300 363 992 Email: enquiries@oaic.gov.au

16. Contact Us

If you have any questions about this Privacy Policy, or if you would like to exercise any of your privacy rights, please contact us:

Gecko Creationz A trading name of Straw Lodge Vineyard Limited 17 Fareham Lane, Renwick 7271, Marlborough, New Zealand Email: ecoshine@geckocreationz.com Phone: +64 021 127 0292