Privacy Policy

1. Introduction and Data Controller
   Welcome to www.timbertraycraft.com (the “Site”). We value your privacy and are committed to protecting your personal data. This Privacy Policy outlines how we collect, use, process, and safeguard your personal information when you visit our Site or purchase our wooden serving trays and tableware.

For the purposes of applicable data protection legislation, including the New Zealand Privacy Act 2020 and the European Union General Data Protection Regulation (GDPR), the data controller responsible for your personal data is:

KASTARA ENTERPRISES LIMITED

Registration No.: 9374151 / 9429053149237

Address: 57 Commerce St, Kaitaia, Far North 0410, New Zealand

Email: serving@timbertraycraft.com

Phone: +64 94084320

2. Information We Collect
   We collect personal information necessary to manage your interactions with us, facilitate transactions, and provide our services. This includes:

Identity and Contact Data: Name, billing address, delivery address, email address, and telephone number.

Transaction Data: Details regarding the specific items purchased, order totals, and purchase history.

Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, operating system, and platform used to access the Site.

3. Legal Basis and Purposes of Data Processing
   We process personal data in accordance with the legal frameworks of New Zealand and the European Union. Processing is conducted under the following lawful bases:

Performance of a Contract: To process, fulfill, and deliver your orders, and manage customer service communications.

Compliance with Legal Obligations: To maintain accurate financial, tax, and corporate records required by New Zealand and relevant international authorities.

Legitimate Interests: To optimise Site performance, monitor website stability, and maintain the operational security of our online platform.

4. Third-Party Data Processors and Payment Processing
   To complete commercial transactions, we transfer necessary data to external service providers.

All financial transactions are handled securely by our primary third-party payment processing partner, Stripe. When you complete a purchase, your payment credentials are transmitted directly to Stripe. Stripe collects, processes, and stores financial information in accordance with their independent privacy standards and compliance metrics. KASTARA ENTERPRISES LIMITED does not store or have direct access to your full credit card numbers or payment authentication codes.

5. International Data Transfers
   As a company registered in New Zealand operating a global website, data collected from individuals residing within the European Economic Area (EEA) will be transferred to and stored in New Zealand. New Zealand is officially recognised by the European Commission as providing an adequate level of data protection under an Adequacy Decision, ensuring your information receives a level of protection comparable to that within the EU.
6. Data Retention Period
   We retain personal data only for as long as is strictly necessary to fulfil the purposes for which it was collected, or to satisfy applicable legal, statutory, regulatory, and financial reporting demands.

Order and Transactional Data: Retained for a minimum period of 7 years to satisfy corporate tax, financial accounting, and auditing obligations under New Zealand inland revenue regulations and international trade laws.

Customer Inquiries and Correspondence: Retained for up to 2 years following the resolution of the inquiry to assist with follow-up administrative requirements and support quality management.

Technical Logs: Retained for up to 12 months to ensure website functionality and detect unauthorised access.

Upon expiry of the specified periods, data is permanently deleted or anonymised so that it can no longer be associated with an identifiable individual.

7. Data Security
   We implement industry-standard administrative, physical, and technical measures designed to protect personal data against accidental loss, unauthorised access, disclosure, or alteration. While we employ rigorous, standard commercial practices to maintain data integrity, please be advised that no method of electronic transmission over the internet or digital storage can be categorised as completely impenetrable.
8. Your Legal Rights
   Depending on your geographic location, you possess specific statutory rights regarding your personal information under the New Zealand Privacy Act 2020 or the GDPR. These rights include:

Access and Portability: The right to request copies of the personal data we hold about you.

Correction/Rectification: The right to request the modification or correction of inaccurate or incomplete data.

Erasure (Right to be Forgotten): The right to request the deletion of your personal data, subject to prevailing legal retention mandates.

Restriction or Objection: The right to object to or restrict specific types of data processing under relevant conditions.

Withdrawal of Consent: The right to withdraw consent at any time where processing relies entirely upon your prior consent.

To exercise any of these rights, please submit a formal request to our designated contact email: serving@timbertraycraft.com. We will evaluate and respond to your request within the legally prescribed timelines.

9. Contact and Supervisory Authorities
   For inquiries regarding this Privacy Policy or our data management operations, please contact us using the corporate details listed in Section 1.

If you are a resident of the European Union and believe our processing of your personal data infringes upon applicable data protection laws, you retain the legal right to lodge a formal complaint with a European Supervisory Authority (Data Protection Authority) in your country of residence. Residents of New Zealand retain the right to contact the Office of the Privacy Commissioner.