Privacy Policy

‌Effective Date: 12 October 2026‌

1. Introduction

CLOTHING JOURNEY DUNEDIN LIMITED (referred to as “we”, “us” or “our”) is committed to protecting the personal privacy of all users and customers who access our e-commerce website www.dunedinclothing.com (referred to as the “Site”). This Privacy Policy is formulated in full compliance with New Zealand’s Privacy Act 2020, the 2025 Privacy Amendment Act, the Client and Product Data Act, and other applicable data protection regulations, as well as aligned with global leading privacy protection standards such as OECD digital governance frameworks.

This document clearly outlines how we collect, store, process, share and protect your personal information when you use our Site, purchase our products, or interact with our services. It also explains your legal rights over your personal data, and the mechanisms we have in place to ensure your privacy is fully respected and protected. By accessing and using our Site, you acknowledge that you have read, understood and agreed to the terms set out in this Privacy Policy. If you do not agree with any part of this policy, please refrain from using our services.

Our core contact details for all privacy-related inquiries are as follows:

• Full Entity Name: CLOTHING JOURNEY DUNEDIN LIMITED
• Postal and Physical Address: 24 Mackelvie Street, Grey Lynn, Auckland 1021, New Zealand
• Contact Email: [email protected]
• Contact Phone: +64 9 361 0020

2. Types of Personal Information We Collect

We only collect personal information that is necessary to deliver our e-commerce services, process your orders, and enhance your shopping experience. The categories of information we may collect include:

1. ‌Information You Provide Voluntarily‌
   • Account registration details: your full name, email address, contact number, and preferred password when you create an account on our Site
   • Order and transaction information: shipping address, billing address, payment method details, purchase history, and order preferences when you place an order
   • Communication records: information you submit when you contact our customer support team, leave product reviews, participate in our surveys, or sign up for our marketing newsletters
   • Identity verification details: additional information we may request to confirm your identity when you exercise your data rights, prevent fraud, or resolve payment disputes
2. ‌Information Collected Automatically When You Use the Site‌
   • Device and technical information: your IP address, browser type, device model, operating system, language settings, and unique device identifiers
   • Usage data: your browsing history on the Site, pages you viewed, time spent on each page, click-through paths, search queries, and shopping cart activity
   • Location information: approximate geolocation data derived from your IP address, to help us display region-specific shipping options and relevant product recommendations
3. ‌Indirectly Collected Personal Information‌
   In compliance with the Information Privacy Principle 3A (IPP 3A) introduced in New Zealand’s 2025 Privacy Amendment Act, we may also collect your personal information from third-party legitimate channels, including verified payment service providers, delivery partners, trusted social media platforms (if you choose to link your account to our Site), and publicly available information sources permitted by law. We will take all reasonable measures to notify you of this indirect collection activity in line with regulatory requirements, unless a legal exception applies.

3. Purposes of Processing Your Personal Information

We process your personal information only for clearly stated, lawful, legitimate purposes that are directly related to the services we provide, including:

• To process, fulfill and deliver your purchased orders, including verifying your identity, processing payments, arranging shipping, and providing after-sales support
• To maintain and manage your user account, enable smooth login and personalized service functions, and help you track your order status and purchase history
• To optimize and improve our Site performance: analyze user browsing habits to improve website interface design, adjust product offerings, and resolve technical issues to deliver a more user-friendly shopping experience
• To send you service-related notifications, including order confirmations, shipping updates, after-sales service alerts, and important security announcements related to your account
• To conduct fraud prevention, transaction risk assessment, and protect the security of our Site, our users, and our business operations, preventing unauthorized access, identity theft and other illegal activities
• To send you optional marketing communications, including new product launches, exclusive discount information and promotional activities, only if you have explicitly given your consent to receive such content at any time. You may unsubscribe from marketing emails at any time by clicking the unsubscribe link in every marketing message, or contacting us directly via the provided contact details
• To comply with our legal obligations, including responding to valid legal requests from New Zealand regulatory authorities, tax authorities, and judicial bodies, in line with applicable national laws
• To operate our customer loyalty program, process your participation in promotional activities, competitions and feedback surveys, and reward you for your engagement with our brand.

All our processing activities follow the “privacy by design” principle required by New Zealand’s 2025 data privacy regulatory framework. We embed privacy protection mechanisms into every stage of our system design and business workflow, to minimize the collection of unnecessary personal data by default.

4. Sharing and Disclosure of Your Personal Information

We will never sell, rent or trade your personal information to third parties for their independent marketing purposes without your explicit prior consent. We may only share your data with trusted third parties under the following limited circumstances:

1. ‌Service Providers Necessary for Order Fulfillment‌
   We share necessary information with our verified, pre-vetted third-party service providers who help us operate our business, including payment processing platforms, courier and logistics partners, cloud service providers, e-commerce technology supporting vendors, and customer service outsourcing teams. All these third parties are bound by strict data processing agreements with us, requiring them to protect your personal information to the same or higher standard as required by New Zealand privacy laws, and prohibiting them from processing your data for any purposes outside the scope explicitly agreed with us.
2. ‌Disclosure Under Legal Requirements‌
   We may disclose your personal information if we are required to do so by New Zealand law, court order, or valid official request from a competent government authority. This includes situations where disclosure is necessary to protect public health or public safety, prevent immediate harm to any person’s life, health or safety, or assist in legal law enforcement proceedings.
3. ‌Data Sharing Under the Consumer Data Right (CDR) Framework‌
   In line with New Zealand’s 2025 Client and Product Data Act, you may submit a formal request to share your relevant customer data we hold with an accredited third-party requester certified by the New Zealand administrative authority. We will respond to such requests in full compliance with regulatory requirements, after verifying your clear, specific authorization and confirming the identity of the accredited requester. We may lawfully reject such requests only under permitted circumstances explicitly stated in the act, including when the request may pose severe threats to public security, cause serious economic harm to relevant parties, or is submitted through fraudulent means.
4. ‌Business Transaction Transfer‌
   In the event of a merger, acquisition, full or partial asset transfer, or other business restructuring involving our company, your personal information may be transferred as part of the business assets. We will ensure that the subsequent recipient of your data is bound by equivalent privacy protection obligations, and notify you of any material changes to the data controller arrangements in a timely manner.

5. Data Security Protection Measures

We implement comprehensive industry-leading technical, administrative and physical security measures to protect your personal information against unauthorized access, modification, disclosure, destruction, accidental loss or misuse:

• All sensitive personal data including payment information, contact details and identity verification documents are encrypted during transmission and at rest using up-to-date AES-256 encryption technology
• Our information systems are equipped with multi-factor authentication, real-time intrusion detection systems, regular vulnerability scanning, and continuous security monitoring as required by the Client and Product Data Act, ensuring the stability, security and integrity of all systems processing your personal data
• All our employees who have access to your personal data have received mandatory privacy protection training, and are bound by strict confidentiality obligations. Any unauthorized access to personal data by internal staff is prohibited and will trigger disciplinary actions and corresponding legal liabilities
• We conduct regular privacy impact assessments for all new business processes and system updates, especially for high-risk processing scenarios that may involve vulnerable user groups. We also follow the regulatory requirements to conduct assessment of cultural impact for Māori data subjects, in alignment with New Zealand’s Te Mana Raraunga (Māori Data Sovereignty) principles, to avoid potential discriminatory risks in our data processing activities
• We maintain strict data retention policies, and will only keep your personal information for as long as it is necessary to fulfill the original collection purposes, meet legal regulatory requirements, resolve disputes, and enforce our contractual agreements. After the retention period expires, we will securely anonymize or permanently delete your personal data in line with applicable data protection rules.

6. Your Rights Over Your Personal Information

Under New Zealand’s Privacy Act 2020 and the 2025 Privacy Amendment Act, you have a series of enforceable legal rights over your personal information we hold:

1. ‌Right of Access‌: You may submit a request to obtain a copy of all the personal information we hold about you, as well as clear information about how we process this data
2. ‌Right to Correction‌: If you find that the personal information we hold about you is inaccurate, incomplete or out of date, you have the right to request us to correct and update that data free of charge
3. ‌Right to Withdraw Consent‌: You may withdraw your previously given consent for us to process your personal information for specific purposes at any time, including unsubscribing from marketing communications. This withdrawal will not affect the lawfulness of processing activities we conducted before your consent was withdrawn
4. ‌Right to Erasure‌: Under permitted circumstances, you may request us to delete your personal information from our systems, for example when the information is no longer necessary for the original purposes we collected it for, or when you withdraw your consent and there is no other lawful ground for us to retain the data
5. ‌Right to Data Portability‌: You may request us to provide your personal data that you have submitted to us, in a structured, commonly used and machine-readable format, or request us to transfer this data directly to another data controller where technically feasible
6. ‌Right to Restriction of Processing‌: You have the right to request us to restrict the processing of your personal information when you contest the accuracy of the data, when our processing is unlawful, or when we no longer need the data for our original purposes but you require us to retain it for legal claim purposes

You may submit any of the above requests by contacting us via the email [email protected]. We will respond to your request within a maximum of 30 working days, and we will not charge you any fee for processing reasonable access and rights requests. We may only extend the response period or reject your request for lawful, clearly explained reasons permitted by New Zealand privacy regulations. If you are not satisfied with our handling of your request, you have the right to lodge a complaint to the New Zealand Office of the Privacy Commissioner (OPC).

7. Protection of Minors’ Privacy

We attach great importance to the privacy protection of children and adolescent vulnerable groups, in line with New Zealand’s regulatory provisions for protecting underage users. Our Site is not designed or intended for users under the age of 16, and we do not knowingly collect personal information from anyone under the age of 16 without verified explicit parental or guardian consent. If we confirm that we have accidentally collected personal information from a user under 16 without proper consent, we will immediately delete that relevant data from all our servers without delay. If you believe we may hold personal information of a minor under 16, please contact us immediately so that we can take appropriate action.

8. Cross-Border Data Transfers

Your personal information will generally be stored and processed on servers located in New Zealand and other regions with equivalent data protection standards recognized by the New Zealand regulatory authority. In the event that we need to transfer your personal data to a location outside of New Zealand, we will ensure that the transfer is conducted in full compliance with applicable legal requirements, and implement appropriate safeguards to protect your data, including executing standard data protection clauses approved by relevant authorities, or confirming that the destination country provides an adequate level of privacy protection consistent with New Zealand’s legal standards. We will never transfer your personal information to a third country without ensuring the security of the transfer.

9. Cookies and Similar Tracking Technologies

Our Site uses cookies, web beacons and other similar tracking technologies to enhance your browsing experience, analyze Site traffic, and deliver personalized product recommendations. Cookies are small text files stored on your device when you visit our Site. You can adjust your browser settings to refuse all cookies, or to alert you when a cookie is being sent. Please note that if you choose to disable cookies, some functional features of our Site may not work properly, which may affect your normal shopping experience on our platform. We categorize the cookies we use as follows:

• Strictly Necessary Cookies: These cookies are essential for the basic functions of our Site to work, enabling you to browse the pages, add items to your shopping cart, and complete the checkout process. They do not store any personally identifiable browsing information
• Performance Cookies: These cookies help us understand how visitors interact with our Site, collect anonymous statistical information to optimize our Site structure and performance
• Functional Cookies: These cookies remember your preference settings, such as your preferred language and region, to provide more customized user experience
• Marketing Cookies: These cookies are used to display targeted product advertisements that may be of interest to you on third-party platforms, based on your browsing behavior on our Site. We will only use these marketing cookies if you have given your explicit consent.

10. Amendments to This Privacy Policy

We may update and revise this Privacy Policy from time to time to reflect changes in our business operations, new regulatory requirements, or adjustments to our service processes. When we make material changes to this policy, we will prominently post the updated version on the homepage of our Site, revise the “Effective Date” marked at the top of the policy, and notify you through appropriate channels such as email notifications or in-site pop-up reminders before the new revised terms take effect. Your continued use of our Site after the revised policy comes into effect will be regarded as your acknowledgement and acceptance of the updated terms. We encourage you to review this Privacy Policy periodically to stay informed of the latest arrangements for how we protect your personal information.

11. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy, or any matters related to how we process your personal information, please do not hesitate to contact us through the following channels:

• Full Entity Name: CLOTHING JOURNEY DUNEDIN LIMITED
• Physical and Postal Address: 24 Mackelvie Street, Grey Lynn, Auckland 1021, New Zealand
• Contact Email: [email protected]
• Contact Phone: +64 9 361 0020

We will respond to all your privacy-related inquiries as soon as possible, and work with you to resolve any concerns you may have about our data processing practices within a reasonable period of time.