Privacy policy

Draft wording, under review before launch.

Last updated: 26 October 2026

Who we are

Roof Painted Wellington is operated by [TBC: Legal Entity] (NZBN [TBC: Nzbn]), [TBC: Postal Address]. We run a quote-matching service: we pass your enquiry to independent roofing businesses so they can quote. We are not a roofer or builder. This policy explains how we handle personal information under the Privacy Act 2020 and its 13 information privacy principles (IPPs).

Privacy officer: [TBC: Privacy Officer Name], [TBC: Privacy Email], [TBC: Postal Address].

What we collect (IPP1–IPP4)

• Things you give us: name, phone, email, property address or suburb, roof details, photos, timing, budget, and anything you type into the form or chat.
• Things collected automatically: IP address, browser/device type, pages viewed, referring page, and approximate location. We collect these through our hosting provider's logs and no separate analytics tool (none is installed).
• Information from other people (IPP3A): if someone sends an enquiry for a property they do not live in (a landlord, family member, or property manager, for example), we may receive information about you indirectly. Since 1 May 2026, we will tell you about this as soon as reasonably practicable, unless an exception in IPP3A applies. We will tell you what we hold, why we hold it, who receives it, who we are, and that you can see and correct it. Please only send another person's details if they know you are doing so.

We only collect what we need to arrange quotes. You don't have to give us information, but without contact details we can't connect you with a roofer.

Why we use it

• To pass your enquiry to up to N (TBC) roofing providers that service your area so they can contact you and quote.
• To reply to you, including through automated messages.
• To run, secure and improve the site, and to prevent spam and fraud.
• To keep records of what happened with each enquiry, including feedback on providers.

Who we share it with (IPP11)

• Roofing providers: independent businesses chosen for your area and job. They use your information to contact you and quote, and are responsible for it under their own privacy obligations once they receive it. Ask us which providers received your enquiry.
• Service providers who process data for us: our hosting/CDN, edge computing and AI provider Cloudflare, Inc. (Cloudflare Pages, Workers, Workers AI).
• Anyone else the law requires or allows (for example, under a lawful request).

We do not sell your personal information.

Overseas storage and processing (IPP12)

Our service providers, including Cloudflare, may store or process your information outside New Zealand, for example in the United States and other countries where Cloudflare runs data centres. Where an overseas provider uses information only to provide a service to us, the Privacy Act treats that as us still holding it (s 11), and we remain responsible for it. If we ever *disclose* information to an overseas organisation for its own purposes, we will only do so where IPP12 allows. That means the recipient must be subject to comparable safeguards, or we tell you and get your authorisation first.

AI chat and automated replies

The on-site chat assistant and some email/SMS replies are generated automatically using AI (Cloudflare Workers AI). Messages are not written by a person in real time. Your chat messages are processed to answer you and may be kept with your enquiry. AI answers are general information and may be wrong. They are not quotes or professional advice. Don't put sensitive information (such as health or financial details) into the chat. You can ask for a person at [TBC: Contact Email].

Cookies and analytics

We do not use advertising, tracking or analytics cookies, and no analytics tool is currently installed. We use essential browser storage only.

Marketing messages

We only send follow-up or marketing emails or texts with your consent, as the Unsolicited Electronic Messages Act 2007 requires. Every such message will identify us and include a working unsubscribe option. We will act on unsubscribe requests within 5 working days.

Security (IPP5)

We use reasonable safeguards, including HTTPS, access controls and limited staff access. If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and the people affected, as Part 6 of the Act requires.

How long we keep it (IPP9)

Enquiry and chat records are kept for 24 (TBC) months after your last contact, then deleted or de-identified. Server and security logs are kept for 30–90 (TBC) days. We may keep information longer where the law requires it.

Accuracy, access and correction (IPP6, IPP7, IPP8)

You can ask to see the personal information we hold about you, or ask us to correct it. Contact our privacy officer. We will respond within 20 working days, and we may need to confirm who you are first. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner: privacy.org.nz, 0800 803 909.

Use, disclosure and unique identifiers (IPP10, IPP11, IPP13)

We only use and disclose information for the purposes above, or as the Act allows. We do not assign government-style unique identifiers.

Changes

We will post updates here and change the "Last updated" date.

Sources (checked 26 Oct 2026)

• Privacy Act 2020, s 22 (IPPs), s 11, Part 6: www.legislation.govt.nz
• Privacy Amendment Act 2025, s 2 (Part 1, including IPP3A, in force 1 May 2026) and new s 25A: www.legislation.govt.nz
• OPC, IPP3A guidance: www.privacy.org.nz
• Ministry of Justice, "New privacy information principle now in force": www.justice.govt.nz
• OPC, IPP12 cross-border disclosure: www.privacy.org.nz
• Unsolicited Electronic Messages Act 2007: www.legislation.govt.nz