privacy policy

Our aim is to build a business that makes friends out of strangers over remarkable coffee. How we work with you makes a big difference.

We offer a range of delicious coffee products, brewing tools, gifts, merchandise, services related to the operation and use of the Underground Coffee Roasters website and services to help you (“Services”).

This “Privacy Policy” covers the information that we collect about you through your use of the Services and when you purchase our products, including through our Underground Coffee Roasters website. We will collect, hold, use and share your personal information in order to provide you with delicious coffee, great customer service and to provide you with information about products and services that may be of interest to you.

This Privacy Policy has been prepared to help you understand:

• The information we collect about you
• When we use your personal information and the legal grounds that we rely on to do so
• Our use of cookies
• How and why we use your information
• How and where we share information we collect
• How long we keep information
• How you can access your personal information, contact us and make complaints
• Our data retention and security policies
• Changes to this Privacy Policy

You should read this Privacy Policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and privacy policies and is not intended to override them.

“Personal Data” or “Personal Information” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

“Data Protection Legislation” means the UK’s General Data Protection Regulation and the UK Data Protection Act 2018 together with the New Zealand Privacy Act 2020, the Australian Privacy Act 1988, the Singapore Personal Data Protection Act 2012 and Japans Act on Protection of Personal Information.

Underground Coffee Roasters, “we”, “our” and “us” refers to Underground Coffee Company Limited.

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out in section 11.

If you do not agree with the terms of this Privacy Policy, you should not access or use our Services. Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract or to provide our Services. In this case, we may have to stop providing a Service.

1. Information we collect about you

We collect Personal Information when you use our Services or buy our products, when you provide information to us and when other sources provide it to us. The type of Personal Information we collect includes your:

• Name – so that we can identify you.
• Address – so that we are able to deliver our great coffee to you.
• Country of residence – because some of our products and shipping prices may vary depending on where you are.
• Telephone number and email – so that we can contact you.

2. When we collect Personal Information

We collect Personal Information in the following circumstances:

• Information you provide to us:
  We collect Personal Information when you interact with our website, place orders with us and when you give us information as part of using the Services.
• Account and Profile Information:
  We collect Personal Information about you when you register for an account, create or modify your profile and sign-up for email newsletters. For example, you provide your name and email address when registering an account. You can also add other details to your profile information, such as billing and shipping addresses.
  We also collect Personal Information when you provide feedback on our Services or when you participate in any interactive features, surveys, contests, promotions or events run by us.
• Information you provide through our support channels:
  You can submit Personal Information to us regarding a problem that you may be experiencing with a Service. For example, if you speak to us directly or engage with our support team, you may be asked to provide your contact information, a summary of the problem you have and any other related information that will help us resolve the issue.
• Information collected when you use our Services:
  We automatically collect Personal Information when you browse and interact with our website and interact with marketing communications This information includes the features you use on our website; the links you click on our website and the links you click in marketing communications we provide to you.
• Device and connection information:
  We collect information about the computer, phone, tablet, or other devices you use to access our Services. This device information includes your operating system, browser type, IP address, URLs of referring/exit pages and device identifiers.
  We also collect and use your IP address and/or country preference in order to approximate your location so that we can provide you with a better service experience. How much of this information we collect depends on the type and settings of the device you use to access our Services.
• Information we receive from other sources:
  We receive Personal Information from third-party service providers, from our related companies set out above, and from our channel partners (for example when you click on one of our advertisements)
  We work with a network of partners and companies who help us market and promote our products and generate leads for us. These partners are Google, Facebook and Mailchimp. We may receive information that you have chosen to provide to these partners for these purposes, such as contact information, and what country you are in.

3. Cookies and Tracking Technologies

We use cookies to personalise our services and website to you.

“Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit the ‘All About Cookies’ website.

Underground Coffee Roasters and our third-party partners, such as our advertising and analytics partners (Google Analytics, Facebook and Mail Chimp) use cookies and other tracking technologies (e.g. device identifiers and pixels) to enable us to recognise you across different services and devices so that we can provide you with information that is customised to you and to keep track of what you have in your cart.

Do not track (“DNT”) is a feature offered by some browsers and devices. If you enable DNT, it will send a signal to websites to request that your browsing is not tracked, for example by third party advertisers, social networks or analytic companies. While our website does not currently respond to DNT requests, you can opt out of tracking and analytics on this website by changing your browser and/or device settings. You can also opt out of Google Analytics here.

If you do not wish to enable cookies, that may mean that your experience of our website will be impaired (for example, you might not be able to keep track of the delicious coffee that you have in your cart).

4. When we use your personal information

We will only use Personal Information when the law allows us to. This will be with your consent or to:

• comply with our contractual obligations;
• identify and develop new products and services that may be helpful to you;
• conduct market research;
• improve the functionality of our website;
• undertake internal management (such as training and systems development and testing);
• consider a potential acquisition or merger involving our business;
• comply with a legal obligation.

We may also use Personal Information in pursuit of our legitimate interests, in a way which might reasonably be expected as part of our normal business operations and which does not override your rights or freedoms. For example, we may rely on the pursuit of our legitimate interests in order to identify and prevent fraudulent activity or breaches of our Terms of Service.

5. How we use your Personal Information

How and why we use Personal Information depends in part on which Services you use, how you use them, and any preferences you have communicated to us. The purposes for which we use Personal Information include:

• To provide our Services and personalise your experience:
  We use information about you to provide our Services to you, including to process transactions with you, authenticate you when you log in to your account and to provide customer support to you. We also combine information about you and your activities on our website to provide a seamless experience and to present relevant product information as you browse our website.
• For research and development:
  We are always looking to make our Services smarter, faster, secure, and more useful to you. We collect information about how people use our Services, as well as direct feedback provided to us, in order to troubleshoot problems and to identify usage patterns and areas for improvement. We analyse and aggregate frequently viewed and purchased products to improve the accuracy and relevance of suggestions that we may make to you regarding our Services. We will also sometimes test and analyze new features with a small group of users on an anonymised basis, before rolling out features for all users.
• To communicate with you:
  We use your contact information to send transactional communications via email and through your online account portal, including to confirm your purchase, respond to your comments, questions and requests, provide customer support and to send you notices about our Services.
• For marketing, to promote and drive engagement:
  We may use your contact details and information about usage of our Services to communicate with you about news, promotions and contests that we think may be of interest to you where you have consented to those communications.
  We may use your Personal Information together with usage and profile data to form a view on what we think you may want or need or what may be of interest to you. This is how we decide which products, Services and offers may be relevant to you.
  You will receive marketing communications from us if you have requested information from us or purchased products or used the Services and have not opted out of receiving that marketing.
  You can control the marketing communications you receive by using the unsubscribe link in any electronic communications we send you and by exercising your rights set out in section 11.
  We will obtain your express opt-in consent before we share your Personal Data with any third party for marketing purposes.
• For safety and security:
  We use information about you and your use of our Services to verify accounts and activity, to monitor suspicious or fraudulent activity and to identify violations of this Privacy Policy or our Terms of Service.
• To protect our business interests and legal rights:
  Where required by law or where we believe it is necessary to protect our legal rights, interests and the interests of others, we may use information about you in connection with legal claims, compliance, regulatory, and audit functions and in connection with any potential acquisition, merger or sale of our business.

6. Sharing your Personal Information

Sometimes we might need to share your Personal Information, but we will only do so for the purposes set out above and to parties who also comply with the Data Protection Legislation. The parties with whom we will share your personal information are:

• Related entities

We are based in New Zealand. We may share your information with our group companies (which are listed on the first page of this Privacy Policy) to help us provide Services to you and for the purposes described in this Privacy Policy.

• Service Providers

In order to be able to deliver you great coffee, communicate with you and provide you with any other Services, we share your information with:

• Our website operator, WordPress. You can read more about how WordPress uses your information here.
• IT companies who support our Services and internal administrative and business functions.
• Operational service providers, such as delivery companies.
• Data management companies who host, manage and store data for us.
• Payment processors and merchants to process your payments and orders. For example, Paypal. You can read more about how Paypal use your information here.
• Marketing companies to help us manage and customise our communications with you.
• Courier companies to deliver our coffee to you.
• Our partners who will process your personal information for the purposes set out above. Depending on where you are located, they are:

• Law enforcement, government and regulatory authorities
  We may need to share your information with law enforcement and regulatory bodies and our advisors to manage illegal activities (such as fraud), in response to a valid request from a law enforcement, government or regulatory authority or if we consider it necessary to enforce our Terms of Service or this Privacy Policy and to protect the integrity of our Services.

7. Third party links

This website may include links to third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share your data. We do not control those third-party websites and are not responsible for how those third parties manage your data. When you leave our website, we encourage you to read the privacy policy of every website you visit.

8. Data retention

When we collect personal information from you, we will only keep it as long for as long as we reasonably need it for the purpose we collected it for or to satisfy any legal, regulatory, tax, accounting or reporting requirements.

We will keep your account information for as long as your account is active, accounts that are inactive for two year's are automatically deleted along with any transaction or data linked to it.

If you have elected to receive marketing emails from us, we retain information about your marketing preferences until you unsubscribe from our Services and then we will keep a record of that, so we do not send you more emails you do not want. We retain information derived from cookies and other tracking technologies for 26 months from the date such information was created.

To determine the appropriate retention period for personal data we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use of disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal, regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our clients and customers for seven years after they cease to be clients and customers for tax purposes. We may retain your data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

Once we no longer need your information, we will delete or anonymise it, or, if this is not possible (for example, because the information has been stored in backup archives), then we will endeavour to keep your information as safe as possible until we can delete it

Where we retain information for service improvement and development, we take steps to eliminate information that directly identifies you, and we only use the information to uncover collective insights about the use of our Services, not to specifically analyse personal characteristics about individuals.

9. Data security

We have put in place appropriate security measures to prevent your Personal Data being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a legitimate reason to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any appropriate regulator of a breach where we are legally required to do so.

10. Accessing and Controlling your Information

You have rights and choices available to you when it comes to your Personal Information. Our Services give you the ability to access and update certain information about you from within the Service. For example, you can access your profile and billing/shipping information from your account.

If you do not want to use our Services anymore, then we understand. You can deactivate your account by changing your account settings (though please be aware that deactivating your account does not delete your information).

You can also unsubscribe from our marketing emails at any time by clicking the ‘unsubscribe’ link in any of those marketing emails or contacting us. If you withdraw consent, then that will not affect any use that you had already consented to.

In addition, you can request:

• access to and copies of the personal information that we hold about you (commonly called a “data subject access request”);
• the correction of your personal information;
• that we do not process your information in certain circumstances, such as where you have objected to that processing or where you think it needs to be corrected;
• that we delete the information we hold about you, such as when we no longer need that information for the purposes that we collected it for;
• that we restrict our processing of your personal information;
• that we transfer your personal information to another entity; and
• when you have given consent to use your personal information, that we stop that use.

You will not have to pay a fee to access your personal information (or to exercise your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request.

We may need to request specific information from you to help us to confirm your identify and ensure your right to access your personal information (or to exercise other rights). We may also contact you to ask you for further information in relation to any request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take longer if your request is particularly complex or you have made a number of requests. In this case we will notify you and keep you updated.

When we use your personal information for a legitimate interest that we have, you can object to that processing and request that we stop that use. We will then stop using your personal information unless we consider that we have an overriding and legitimate reason to continue using it (for example, if that information was relevant to any investigation of fraud).

You can exercise these rights at any time by contacting us. Our contact details are below at section 11. If we consider that we cannot comply with any request you make, then we will provide you with information to explain our reasons and details about how you can make a complaint if you wish to do so.

11. How you can contact us and make complaints

If you want to contact us, including to make a complaint about how we use your Personal Information, please contact our Data Privacy Manager in the following ways using the following details:

eMail: web@undergroundcoffee.co.nz
Phone: +643 353 0267

If you are in New Zealand, you can also make complaints directly to the Office of the New Zealand Privacy Commissioner:
eMail: investigations@privacy.org.nz
Web: privacy.org.nz
Phone: 04 474 7590 or 09 302 8680

12. Changes to our Privacy Policy

We keep our privacy policy under review and may change this from time to time. We will post any changes on this page and, if the changes are significant, we will notify account holders by sending an email notification summarising the relevant changes.
This Privacy Policy was last updated in March 2021.