Privacy and Cookie Policy

1. Who this Policy covers

This Policy applies when you:

1. 1.

   visit https://goforth.nz;

2. 2.

   use our website scanner or another FORTH tool;

3. 3.

   submit an enquiry or onboarding form;

4. 4.

   purchase or use FORTH services;

5. 5.

   communicate with us;

6. 6.

   interact with our advertising or marketing;

7. 7.

   are a staff member, contractor, customer, lead, or website user whose information is supplied to us by a FORTH client; or

8. 8.

   otherwise provide personal information to us.

When we handle personal information solely on behalf of a client, that client usually decides why the information is collected and used. You should also read the privacy policy of the relevant client website or business.

2. Our privacy contact

Our privacy contact is responsible for privacy questions, access requests, correction requests, and complaints.

Email: hello@goforth.nz

Postal or physical contact details can be requested by email and are also available through the New Zealand Companies Register where legally required.

3. Personal information we may collect

Depending on your interaction with us, we may collect:

1. 1.

   Identity information, such as your name, role, business name, and authority to act for a business.

2. 2.

   Contact information, such as your email address, telephone number, business address, and communication preferences.

3. 3.

   Account and subscription information, such as your selected package, billing status, support history, portal activity, and service preferences.

4. 4.

   Payment information, such as transaction status, billing address, invoice information, and limited payment method details supplied by our payment processor. We do not need to store your complete card number when payment is processed by Stripe or another payment provider.

5. 5.

   Website and technical information, such as internet protocol address, device type, browser, operating system, approximate location, referring page, pages viewed, session activity, cookie identifiers, form interactions, and security logs.

6. 6.

   Scanner information, such as the website address submitted, scan date, technical observations, scores, recommendations, and contact details submitted with the scan.

7. 7.

   Client Materials, such as branding, website content, photographs, video, documents, product information, access details, and instructions needed to provide services.

8. 8.

   Advertising and analytics information, such as campaign identifiers, click information, conversion events, lead source, audience information, website activity, campaign performance, and information used for attribution.

9. 9.

   Lead and customer information handled for clients, such as names, contact details, enquiry content, form responses, appointment requests, conversion status, and communication history.

10. 10.

    Communication information, such as emails, meeting notes, support requests, feedback, complaints, approvals, and records of consent.

11. 11.

    Public and business information, such as information on a business website, public profile, public register, social media page, advertising library, directory, or other publicly available source.

    We also scan publicly available business websites ourselves, to prepare an honest report of what we found, which we may send to that business. A report contains only information that was public on the website at the time, and says what we checked and what we could not. If you would like a report about your website taken down, email hello@goforth.nz.

12. 12.

    Security and access information, such as account access records, authentication events, permissions, and suspected security incidents.

We aim to collect only information reasonably needed for a lawful business purpose.

4. How we collect personal information

We may collect information:

1. 1.

   directly from you through forms, checkout, email, telephone, meetings, portal use, support, cookies, and website interactions;

2. 2.

   from the business you work for or represent;

3. 3.

   from a FORTH client where we provide website, advertising, lead, analytics, hosting, or support services;

4. 4.

   from authorised service providers and platforms, including payment, analytics, advertising, email, scheduling, and customer management services;

5. 5.

   from public websites, directories, registers, and business profiles; and

6. 6.

   from another person where they are authorised to provide the information or where collection is otherwise permitted by law.

Where we collect personal information indirectly, we will take reasonable steps to ensure the person is aware of the collection and the matters required by information privacy principle 3A, unless an exception applies or the relevant client is responsible for giving the notice.

5. Why we collect and use information

We may use personal information to:

1. 1.

   respond to an enquiry and provide requested information;

2. 2.

   assess a website and generate scanner results;

3. 3.

   prepare a proposal, Order, or recommendation;

4. 4.

   verify identity, authority, and business details;

5. 5.

   design, build, host, maintain, secure, and improve websites and digital services;

6. 6.

   process payments, manage subscriptions, issue invoices, and recover overdue amounts;

7. 7.

   provide support, manage changes, record approvals, and communicate about services;

8. 8.

   create, manage, measure, and improve advertising, search, lead generation, analytics, and email services;

9. 9.

   attribute enquiries, conversions, and sales to advertising or other marketing activity;

10. 10.

    send service communications and, where permitted, marketing communications;

11. 11.

    operate, analyse, secure, test, and improve our website, systems, services, and customer experience;

12. 12.

    prevent fraud, misuse, unauthorised access, and security threats;

13. 13.

    meet legal, tax, accounting, insurance, and regulatory obligations;

14. 14.

    establish, exercise, or defend legal rights;

15. 15.

    manage suppliers, contractors, professional advisers, and business operations; and

16. 16.

    carry out another purpose that you authorise or that is permitted by law.

6. When information is required

1. 1.

   Some information is optional, while other information is needed to respond, complete checkout, verify authority, process payment, build a website, manage advertising, or provide support.

2. 2.

   If you do not provide required information, we may be unable to provide the relevant result or service.

3. 3.

   A form should identify required fields where practical.

7. Sharing personal information

We may share personal information where reasonably necessary with:

1. 1.

   our personnel and authorised contractors;

2. 2.

   website hosting, cloud storage, security, backup, domain, content management, and software providers;

3. 2A.

   artificial intelligence providers that process text, images and code for us so that we can research, write, design, build, test and review websites, campaigns and change requests (currently Anthropic's Claude and OpenAI's ChatGPT, both in the United States);

4. 3.

   payment and billing providers, including Stripe;

5. 4.

   communication, email, scheduling, customer management, project management, and support providers;

6. 5.

   analytics and advertising providers, including Google and other approved advertising platforms;

7. 6.

   professional advisers, such as lawyers, accountants, insurers, auditors, and information security specialists;

8. 7.

   a FORTH client where the information relates to an enquiry, lead, campaign, website, or service operated for that client;

9. 8.

   a prospective purchaser, investor, lender, or successor in connection with a genuine business transaction, subject to appropriate confidentiality protections;

10. 9.

    regulators, courts, law enforcement, and public authorities where required or permitted by law; and

11. 10.

    another person where you authorise the disclosure.

We do not sell personal information as a standalone product.

8. Google Ads, analytics, and advertising measurement

1. 1.

   We may use Google Analytics, Google Ads, tags, cookies, conversion tracking, enhanced conversions, customer matching, and similar services for our own business or on behalf of a client.

2. 2.

   These services may receive information about website activity, advertising interactions, conversion events, device information, and identifiers.

3. 3.

   Where enhanced conversion or customer matching features are enabled, information you provide, such as an email address, name, telephone number, or address, may be normalised, securely hashed, and sent to Google to match against signed in Google account information, measure conversions, improve attribution, create approved audiences, and optimise advertising.

4. 4.

   Google and other advertising providers act under their own terms and privacy practices. Data may be processed outside New Zealand.

5. 5.

   We will disclose advertising measurement activity and obtain consent where required by law or platform policy. Optional advertising technology should respect the cookie and consent choices presented on the relevant website.

6. 6.

   When acting for a client, the client must ensure its own privacy notice explains the collection and sharing and that it has obtained any required consent.

7. 7.

   We will not knowingly upload information prohibited by applicable advertising platform policies, including restricted sensitive category information.

9. Cookies and similar technology

Cookies are small data files placed on a browser or device. We may also use tags, pixels, local storage, and similar technology.

We may use the following categories:

1. 1.

   Essential technology. This supports security, checkout, forms, session management, preferences required for operation, and core website functions.

2. 2.

   Preference technology. This remembers choices and improves convenience.

3. 3.

   Analytics technology. This helps us understand website use, diagnose performance, and improve content and journeys.

4. 4.

   Advertising technology. This helps measure campaigns, attribute conversions, limit repetition, build approved audiences, and improve advertising relevance.

Where a consent control is presented, optional analytics and advertising technology will be handled according to the available choices. You can also manage cookies through your browser. Blocking some technology may affect website functionality or measurement.

10. Marketing communications

1. 1.

   We may send marketing where you have consented or where another lawful form of consent applies.

2. 2.

   Marketing messages will identify the sender and provide a functional way to unsubscribe.

3. 3.

   You can withdraw marketing consent at any time by using the unsubscribe option or contacting us.

4. 4.

   We will action a valid unsubscribe request within the period required by the Unsolicited Electronic Messages Act 2007.

5. 5.

   Unsubscribing from marketing does not prevent necessary service, billing, security, or transaction communications.

11. Overseas storage and processing

1. 1.

   The providers we use, and where they hold information: Supabase (our database and file storage) in Sydney, Australia; Vercel (hosting for our app and for client websites) in Sydney with a worldwide content delivery network; Cloudflare (domain name services) and GitHub (source code storage), United States; Resend (email sending), Stripe (payments), Google (Analytics, Ads, Search Console), Anthropic (Claude, artificial intelligence) and OpenAI (ChatGPT, artificial intelligence), United States. Where a provider holds information outside New Zealand, we rely on the provider's contractual safeguards and on information privacy principle 12.

2. 2.

   Before disclosing personal information outside New Zealand, we will take reasonable steps required by information privacy principle 12, including using a provider subject to comparable safeguards, entering appropriate contractual protections, relying on another permitted basis, or obtaining express authorisation after explaining the potential risk.

3. 3.

   A provider that stores or processes information solely as our agent may hold information in another country while we remain responsible for its handling under New Zealand privacy law.

12. Security

1. 1.

   We use reasonable technical and organisational safeguards appropriate to the nature of the information and Services.

2. 2.

   Measures may include access controls, individual accounts, multifactor authentication, encryption in transit, managed hosting, logging, backups, software updates, and restricted contractor access.

3. 3.

   No online system can be guaranteed completely secure. You should use secure devices, strong unique passwords, and appropriate controls when sharing access or information.

4. 4.

   If a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by law.

13. Retention

We keep personal information only for as long as reasonably needed for the purpose of collection, a related lawful purpose, or a legal requirement.

Our general retention approach is:

1. 1.

   Enquiry and scanner information may be kept for up to 24 months after the last meaningful interaction unless it becomes part of an active client relationship or must be retained longer for a lawful reason.

2. 2.

   Active client information is kept for the duration of the relationship and for a reasonable period afterwards.

3. 3.

   Website source and content archives may be kept after a client leaves, or deleted; we do not promise either. Enquiry and lead information handled for a client is deleted or anonymised 24 months after the client relationship ends unless the client has asked for it or we must keep it.

4. 4.

   Contracts, invoices, payment records, and core business records may be kept for the period required by tax, company, insurance, and limitation laws.

5. 5.

   Advertising, lead, analytics, and campaign information handled for a client is kept for the campaign or service period and then deleted, anonymised, returned, or retained according to the client instructions, platform settings, backup cycles, and legal requirements.

6. 6.

   Security logs and backups are retained according to reasonable security and system cycles.

7. 7.

   Marketing contact information may be kept until consent is withdrawn or the information is no longer reasonably needed. We may retain a suppression record to ensure an unsubscribe request continues to be honoured.

14. Access and correction

You may ask whether we hold personal information about you and request access to or correction of that information.

Email your request to hello@goforth.nz.

We may need to verify your identity and authority. We will respond within the time required by the Privacy Act 2020. If we do not make a requested correction, you may ask us to attach a statement of correction to the information where the law provides that right.

15. Client website information

1. 1.

   If you submit information through a website operated by a FORTH client, the client is usually responsible for deciding why the information is collected and how it is used.

2. 2.

   FORTH may host, transmit, store, secure, analyse, or support that information on the client's instructions.

3. 3.

   Privacy requests about a client business should normally be directed to that client. We will reasonably assist the client where our systems are involved.

16. Information about other people

If you provide personal information about another person, you confirm that you have authority to do so and that you have given any notice required by law. This includes information about employees, contractors, customers, leads, and authorised contacts.

17. Children and sensitive information

1. 1.

   Our website and standard Services are designed for businesses and are not directed to children.

2. 2.

   Do not send us highly sensitive personal information unless it is necessary for an agreed Service and suitable safeguards have been confirmed.

3. 3.

   If you believe information has been provided inappropriately, contact us promptly.

18. Complaints

1. 1.

   Please contact us first so we can investigate and attempt to resolve a privacy concern.

2. 2.

   You may also complain to the Office of the Privacy Commissioner at https://privacy.org.nz.

19. Changes to this Policy

1. 1.

   We may update this Policy to reflect legal, operational, technology, or service changes.

2. 2.

   The latest version will be published with its effective date.

3. 3.

   If a change materially affects how we use information already collected, we will give additional notice where reasonably required.

20. Contact

Go Forth Limited, trading as FORTH

Email: hello@goforth.nz

Website: https://goforth.nz