Privacy Policy
Your privacy matters to us. This policy explains what data we collect, why we collect it, and how we protect it.
Last updated: 20 July 2026
1 Who We Are
Nekki Digital ("we", "our", "us") is a digital marketing agency registered and operating in New Zealand. We provide SEO, paid advertising, social media marketing, web design, and marketing automation services to businesses primarily in New Zealand and internationally.
- Business Name: Nekki Digital
- Primary Office: 9E/34 Kingston Street, Auckland, New Zealand
- Email: [email protected]
- Phone (NZ): +64 22 653 6446
2 Information We Collect
We collect information in two ways: directly from you and automatically through your use of our website.
2.1 Information You Provide
- Contact forms & enquiries: Name, email address, phone number, company name, and message content.
- Newsletter subscriptions: Email address and phone number.
- Free marketing audit requests: Name, email, phone, website URL, and business details you share.
- Client onboarding: Business information, platform credentials (provided securely), billing details, and project requirements.
2.2 Information Collected Automatically
- Device & browser data: IP address, browser type, operating system, screen resolution, and device type.
- Usage data: Pages visited, time spent on pages, referral source, click paths, and scroll depth.
- Cookies & similar technologies: Session identifiers, preference cookies, and analytics/marketing tracking pixels (see Section 5).
- UTM parameters: Campaign source, medium, and content values from marketing links, stored as first-party cookies for lead attribution.
3 How We Use Your Data
- Respond to your enquiries and provide requested services.
- Manage and deliver contracted digital marketing campaigns.
- Send newsletters and marketing insights you have opted into.
- Analyse website performance and improve user experience.
- Run remarketing and retargeting campaigns through advertising platforms.
- Measure advertising effectiveness and calculate return on ad spend.
- Prevent spam and fraudulent form submissions (via Cloudflare Turnstile).
- Comply with legal and regulatory obligations.
4 Legal Basis for Processing
We process personal information under the following legal bases:
- Consent: When you submit a form, subscribe to our newsletter, or accept cookies, you consent to the processing described at the point of collection.
- Contractual necessity: To deliver services under a signed proposal or service agreement.
- Legitimate interest: To improve our website, analyse campaign performance, and protect against fraud — where these interests do not override your privacy rights.
- Legal obligation: To comply with the New Zealand Privacy Act 2020, the Consumer Guarantees Act 1993, tax laws, and applicable international regulations (GDPR, CCPA).
6 Third-Party Services
We use the following third-party services that may process your data according to their own privacy policies:
- Google LLC — Analytics 4, Tag Manager, Google Ads, Search Console. Google Privacy Policy
- Meta Platforms, Inc. — Facebook Pixel, Meta Ads. Meta Privacy Policy
- Cloudflare, Inc. — CDN, DDoS protection, Turnstile CAPTCHA. Cloudflare Privacy Policy
- Hostinger International Ltd — Web hosting, server infrastructure, email services.
- WordPress / Automattic — Blog CMS platform (self-hosted, no data sent to Automattic).
7 Data Sharing & Disclosure
We do not sell, rent, or trade your personal information.
We may share your data only in the following circumstances:
- Service delivery: With trusted third-party tools and platforms strictly necessary to perform contracted services (e.g., setting up your Google Ads account).
- Internal operations: Between our Auckland (NZ) and India offices for campaign management and technical support.
- Legal compliance: When required by law, court order, or regulatory authority.
- Business transfer: In the event of a merger, acquisition, or asset sale, your data may be transferred as part of the transaction. You will be notified in advance.
8 Data Retention
We retain personal information only as long as necessary for the purposes outlined in this policy:
- Contact form submissions: 24 months from the date of submission, unless a client relationship is established.
- Client project data: Duration of the service agreement plus 36 months for reference and legal compliance.
- Newsletter subscribers: Until you unsubscribe or request deletion.
- Analytics data: Governed by platform-specific retention settings (GA4: 14 months by default).
- Financial records: 7 years as required by New Zealand tax law (Tax Administration Act 1994).
9 International Data Transfers
Our primary office is in Auckland, New Zealand. We also have team members based in India who assist with campaign management and technical development.
Third-party services we use (Google, Meta, Cloudflare) may process data in the United States and other jurisdictions. These providers maintain appropriate safeguards including Standard Contractual Clauses (SCCs) and certified compliance frameworks.
Under the NZ Privacy Act 2020 (Information Privacy Principle 12), we ensure that any overseas recipient is subject to comparable privacy protections before transferring personal information.
10 Your Privacy Rights
Under the NZ Privacy Act 2020
- Access: You can request a copy of the personal information we hold about you (IPP 6).
- Correction: You can ask us to correct any inaccurate or incomplete information (IPP 7).
- Complaint: You can lodge a complaint with the Office of the Privacy Commissioner if you believe we have breached the Privacy Act.
Under the GDPR (EU/UK Residents)
- Right of access, rectification, and erasure ("right to be forgotten").
- Right to restrict or object to processing.
- Right to data portability.
- Right to withdraw consent at any time.
Under the CCPA (California Residents)
- Right to know what personal information is collected and how it is used.
- Right to request deletion of personal information.
- Right to opt out of the sale of personal information. Note: We do not sell personal information.
- Right to non-discrimination for exercising your privacy rights.
To exercise any of these rights, email us at [email protected] with the subject line "Privacy Request". We will respond within 20 working days (NZ Privacy Act) or 30 days (GDPR/CCPA).
11 Data Security
We implement appropriate technical and organisational measures to protect your personal information, including:
- SSL/TLS encryption on all pages (HTTPS enforced site-wide).
- Cloudflare WAF and DDoS protection.
- CSRF token protection on all forms.
- Bot detection via Cloudflare Turnstile on form submissions.
- Access controls and restricted directory permissions on the server.
- Regular security audits and software updates.
While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
12 Children's Privacy
Our services are designed for businesses and professionals. We do not knowingly collect personal information from anyone under the age of 16. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].
13 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or services. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our website after changes constitutes acceptance of the revised policy.
14 Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us:
- Email: [email protected]
- Phone (NZ): +64 22 653 6446
- Post: Nekki Digital, 9E/34 Kingston Street, Auckland, New Zealand
- Data Deletion: Request data deletion