Privacy Policy – The Formational
Last Updated: 1 January 2026
This Privacy Policy explains how The Formational New Zealand collects, uses, and protects personal information in accordance with the New Zealand Privacy Act 2020 and, where applicable, the EU General Data Protection Regulation (GDPR).
This document can be printed for reference by using the print command in the settings of any browser.
Owner and Data Controller
The Formational New Zealand
Contact email: support@theformational.com
Location: New Zealand
Applicable Law
This Privacy Policy is primarily governed by the New Zealand Privacy Act 2020. Where this Website collects personal information from individuals located in the European Union or European Economic Area, the EU General Data Protection Regulation (GDPR) also applies.
If you have a concern about how we handle your personal information, you have the right to contact the New Zealand Office of the Privacy Commissioner:
- Website: www.privacy.org.nz
- Phone: 0800 803 909
- Email: enquiries@privacy.org.nz
Types of Data Collected
Among the types of personal data this Website collects, by itself or through third parties, are:
- Email address
- First name
- Last name
- Billing address
- Payment information
- Trackers (cookies and similar technologies)
- Usage data
Complete details on each type of personal data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed before data collection occurs.
Personal data may be freely provided by the user, or, in the case of usage data, collected automatically when using this Website.
Unless specified otherwise, all data requested by this Website is mandatory. Failure to provide this data may make it impossible for this Website to provide its services. Where this Website specifically states that some data is not mandatory, users are free not to provide it without consequences to the availability or functioning of the service.
Users are responsible for any third-party personal data obtained, published, or shared through this Website and confirm that they have the third party’s consent to provide the data to the Owner.
Mode and Place of Processing
Methods of Processing
The Owner takes appropriate security measures to prevent unauthorised access, disclosure, modification, or destruction of data.
Data processing is carried out using computers and IT-enabled tools, following organisational procedures strictly related to the purposes described in this policy. In addition to the Owner, data may be accessible to certain persons involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, and communications agencies) appointed as Data Processors where necessary.
The updated list of these parties may be requested from the Owner at any time.
Legal Basis of Processing
The Owner may process personal data relating to users where one or more of the following applies:
- The user has given their consent for one or more specific purposes.
- Provision of data is necessary for the performance of an agreement with the user or for pre-contractual obligations.
- Processing is necessary for compliance with a legal obligation to which the Owner is subject.
- Processing is necessary for the purposes of legitimate interests pursued by the Owner or a third party.
Under the New Zealand Privacy Act 2020, personal information must be collected for a lawful purpose connected with a function or activity of the Owner, and collection must be necessary for that purpose.
Place of Processing
Data is processed at the Owner’s operating location in New Zealand and in any other places where parties involved in processing are located. Some third-party services (including Stripe) process data in the United States. Where data is transferred outside New Zealand, the Owner takes reasonable steps to ensure the recipient is subject to comparable privacy protections, consistent with the requirements of the Privacy Act 2020.
Retention Time
Personal data will be processed and stored for as long as required by the purpose for which it was collected:
- Personal data collected for the performance of a contract will be retained until the contract has been fully performed.
- Personal data collected for legitimate interests will be retained as long as needed to fulfil those purposes.
The Owner may retain personal data for a longer period where the user has given consent, or where required by law. Once the retention period expires, personal data will be deleted.
Purposes of Processing
Data is collected to allow the Owner to provide its service, comply with legal obligations, respond to enforcement requests, protect its rights and interests (or those of users or third parties), detect malicious or fraudulent activity, and for the following purposes:
- Processing payments
- Contacting the user
- Analytics
- Managing contacts and sending messages
- Displaying content from external platforms
Detailed Information on Data Processing
Payment Processing
Payment processing services allow this Website to process payments by credit card or other means. Payment data is collected and processed directly by the payment processor.
Stripe (Stripe Inc.)
Stripe is a payment service provided by Stripe Inc. Stripe processes payments on behalf of this Website and is compliant with PCI-DSS standards. Data transfers to the United States are subject to Stripe’s data protection measures.
Personal data processed: payment information, billing address, email address, first name, last name.
Place of processing: United States. See Stripe’s Privacy Policy at stripe.com/privacy.
Analytics
The services in this section allow the Owner to monitor and analyse web traffic and user behaviour.
Google Analytics (Google Ireland Limited)
Google Analytics is a web analysis service provided by Google Ireland Limited. Google uses the data collected to track and examine use of this Website and prepare reports on its activities.
Personal data processed: Trackers; Usage data.
Place of processing: Ireland. See Google’s Privacy Policy at policies.google.com/privacy.
Managing Contacts and Sending Messages
These services manage a database of contacts to communicate with users. They may also collect data on when messages were viewed and when users interacted with them (for example, by clicking links).
FluentCRM (WPManageNinja LLC)
FluentCRM is a customer relationship management and email marketing plugin operated on this Website’s own server infrastructure. It is used to manage contact lists, automate email sequences, and track subscriber activity.
Personal data processed: email address, first name, usage data.
Place of processing: New Zealand (self-hosted).
Mailing List and Newsletter
By registering on the mailing list or subscribing to the newsletter, the user’s email address will be added to the contact list of those who may receive email messages containing information of a commercial or promotional nature. The user’s email address may also be added as a result of signing up to this Website or after making a purchase.
Personal data processed: email address, first name.
Displaying Content from External Platforms
These services allow content hosted on external platforms to be displayed directly on pages of this Website.
YouTube Video Widget (Google Ireland Limited)
YouTube is a video content service provided by Google Ireland Limited that allows this Website to embed video content.
Personal data processed: Trackers; Usage data.
Place of processing: Ireland. See Google’s Privacy Policy at policies.google.com/privacy.
Vimeo Video (Vimeo, LLC)
Vimeo is a video content service provided by Vimeo, LLC that allows this Website to embed video content.
Personal data processed: Trackers; Usage data.
Place of processing: United States. See Vimeo’s Privacy Policy at vimeo.com/privacy.
Cookie Policy
This Website uses cookies and similar tracking technologies. Cookies are small data files placed on your device when you visit a website. They help the Website function correctly and allow the Owner to understand how visitors use the site.
Types of Cookies Used
Strictly Necessary Cookies
These cookies are required for the Website to function and cannot be disabled. They are typically set in response to actions you take, such as setting your privacy preferences, logging in, or filling in forms.
Analytics Cookies
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of the Website. They help us understand which pages are most and least popular. All information collected is aggregated and anonymised. If you do not allow these cookies, we will not know when you have visited our site.
Service: Google Analytics (Google Ireland Limited)
Functional Cookies
These cookies enable the Website to provide enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we have added to our pages.
Payment and Third-Party Service Cookies
When you make a purchase or interact with embedded content, third-party services (including Stripe, YouTube, and Vimeo) may set cookies on your device. These are governed by the respective third-party privacy policies.
Managing Cookies
You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Note that disabling certain cookies may affect the functionality of this Website.
For more information about managing cookies, visit www.allaboutcookies.org.
The Rights of Users
Under the New Zealand Privacy Act 2020 and, where applicable, the GDPR, users have the following rights regarding their personal data:
- Access their data – the right to confirm whether data is being processed and to receive a copy.
- Correct their data – the right to request correction of inaccurate or incomplete information.
- Delete their data – the right, under certain circumstances, to request deletion of personal data.
- Restrict processing – the right, in certain circumstances, to limit how data is used.
- Object to processing – the right to object where processing is based on legitimate interests or direct marketing.
- Data portability – the right to receive data in a structured, commonly used, machine-readable format (where GDPR applies).
- Withdraw consent – where processing is based on consent, the right to withdraw that consent at any time.
- Lodge a complaint – the right to contact the New Zealand Privacy Commissioner or, where applicable, a relevant EU data protection authority.
Any request to exercise these rights can be directed to the Owner using the contact details provided in this document. Requests will be addressed as early as possible and within one month. There is no charge for making a request.
Children’s Privacy
This Website and its services are not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at support@theformational.com and we will delete it promptly.
Legal Action and System Logs
Personal data may be used for legal purposes by the Owner in court or in the stages leading to possible legal action arising from improper use of this Website or its services. The Owner may be required to disclose personal data upon request of public authorities.
For operation and maintenance purposes, this Website and any third-party services may collect system log files that record interactions with this Website and may use other personal data (such as IP address) for this purpose.
How Do Not Track Requests Are Handled
This Website does not support Do Not Track requests. To determine whether any third-party services used by this Website honour Do Not Track requests, please refer to their respective privacy policies.
Changes to This Privacy Policy
The Owner reserves the right to make changes to this privacy policy at any time by notifying users on this page and, where technically and legally feasible, by sending a notice via any contact information available. It is recommended that users check this page regularly, referring to the date of the last modification listed at the top.
Where changes affect processing activities based on the user’s consent, the Owner will collect new consent from the user where required.
Definitions
Personal Data
Any information that directly, indirectly, or in connection with other information allows for the identification of a natural person.
Usage Data
Information collected automatically through this Website, which may include: IP addresses, domain names, URI addresses, time of request, method used to submit the request, file size received in response, server status codes, country of origin, browser and operating system details, time spent on pages, and other device and environment parameters.
User
The individual using this Website who, unless otherwise specified, is the data subject.
Data Processor
A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Data Controller, as described in this privacy policy.
Data Controller / Owner
The natural or legal person that determines the purposes and means of processing personal data. Unless otherwise specified, the Data Controller is the Owner of this Website.
This Website
The means by which personal data of users is collected and processed.
Tracker
Any technology (including cookies, unique identifiers, web beacons, embedded scripts, e-tags, and fingerprinting) that enables the tracking of users by accessing or storing information on their device.
Contact Us
For any questions, requests, or complaints regarding this privacy policy or the handling of your personal information, please contact:
The Formational New Zealand
Email: support@theformational.com
New Zealand
To contact the New Zealand Office of the Privacy Commissioner:
- Website: www.privacy.org.nz
- Phone: 0800 803 909
This privacy policy relates solely to this Website, unless otherwise stated within this document.
