Privacy Policy

Last updated: 5 October 2026

Kia ora, and thanks for shopping with Coastal Sports. We are a locally owned surf, bike and outdoor shop in Kaikōura, and we take looking after your personal information seriously. This policy explains, in plain English, what personal information we collect, why we collect it, who we share it with, and the choices you have.

We follow the New Zealand Privacy Act 2020 and its Information Privacy Principles (the rules about how businesses collect, store, use and share personal information). This policy applies when you visit coastalsports.co.nz, buy from us online or in store, contact us, or sign up to hear from us. It should be read together with our Terms and Conditions.

Who we are

This website and our shop are run by Coastal Sports Limited, a New Zealand company.

We sell to customers in New Zealand only, and we deliver to New Zealand addresses only.

The Information Privacy Principles in plain English

The Privacy Act 2020 sets out a series of Information Privacy Principles (often called the IPPs). In everyday terms, they mean we will:

  • only collect personal information we actually need for our business;
  • collect it from you directly wherever we can, and tell you why we are collecting it;
  • collect it in a way that is fair, lawful and not unreasonably intrusive;
  • keep it safe and protect it from loss, misuse and unauthorised access;
  • let you see the information we hold about you, and correct it if it is wrong;
  • check it is accurate and up to date before we use it;
  • not keep it for longer than we need it;
  • use and share it only for the reasons we collected it, unless you agree or the law allows otherwise;
  • only send it overseas where it will be protected in a way that is broadly similar to New Zealand law; and
  • not use government-issued identifiers (such as your IRD or driver licence number) as our own customer reference.

What personal information we collect

Depending on how you deal with us, we may collect:

  • Contact details – your name, email address, phone number, and billing and delivery addresses.
  • Order and purchase details – what you have bought online or in store, order numbers, returns, exchanges, warranty claims and lay-bys.
  • Account details – if you create an account on our website, your login details and order history. Creating an account is optional; you can check out as a guest.
  • Payment details – we see limited payment information such as the payment method used, the last four digits of a card, and whether a payment was approved. We do not store your full card number. Card payments (online and in store) are processed by Windcave. PayPal and Afterpay payments are handled by those providers on their secure systems.
  • Things you tell us – messages, enquiries, feedback, product reviews, and details you share for fitting or sizing (for example, your height and weight so we can recommend a wetsuit, board or bike size).
  • Marketing preferences – whether you have signed up to our email newsletter, and how you interact with our emails (for example, whether an email was opened or a link was clicked).
  • Website and device information – your IP address, browser and device type, pages you visit, products you view, how you arrived at our site, and similar information collected through cookies and similar tools (see “Cookies and tracking” below).
  • In-store CCTV – we use CCTV cameras in our shop for security and to help prevent theft. Signs in store let you know when cameras are in use.

You do not have to give us your personal information. However, if you choose not to, we may not be able to process your order, deliver your goods, answer your enquiry or provide some services.

Where we get it from

Most of the information we hold comes straight from you, for example when you place an order, buy something in store, create an account, sign up to our newsletter, fill in our contact form, or email or phone us.

We may also receive some information from other people or businesses, for example:

  • payment providers, who confirm whether a payment was successful;
  • courier companies, who tell us about the delivery status of your parcel;
  • analytics and advertising providers such as Google and Meta (Facebook and Instagram), who give us reports about how people use our website and respond to our ads (mostly in combined, statistical form); and
  • someone else who orders a gift for you and gives us your name and delivery address.

Why we collect and use it

We use your personal information to:

  • process, pack and deliver your orders, and keep you updated about them;
  • take payments, issue receipts and process refunds;
  • handle returns, exchanges, warranty claims and Consumer Guarantees Act issues, including dealing with the brands and suppliers we buy from;
  • manage your website account and keep our online and in-store systems in sync, so stock levels and your purchase history are accurate;
  • answer your questions and give you product advice;
  • send you our newsletter and offers, if you have signed up (you can unsubscribe at any time);
  • understand how our website is used so we can improve it, and measure how well our advertising is working;
  • show you relevant Coastal Sports ads on other websites and social media;
  • prevent and investigate fraud, theft and misuse of our website or shop (including reviewing CCTV where needed); and
  • meet our legal obligations, such as keeping tax and accounting records, and protect our legal rights.

We will not use your information for an unrelated purpose without telling you first or getting your agreement, unless the Privacy Act allows it.

Who we share it with

We do not sell your personal information. We only share it with people and businesses who help us run our shop and website, and only as much as they need to do their job. These include:

  • Our website host – Kinsta hosts our WordPress and WooCommerce site. Cloudflare helps protect and deliver the site.
  • Our point-of-sale and stock system – Lightspeed Retail (X-Series), which we use in store and which syncs with our website for stock, sales and customer records.
  • Couriers and delivery partners – NZ Couriers, NZ Post and Flyways receive your name, delivery address, phone number and sometimes your email, so they can deliver your parcel and send you tracking updates.
  • Payment providers – Windcave processes card payments online and in store. PayPal and Afterpay also process payments when you choose those options. When you pay with PayPal or Afterpay, you are also dealing with that provider directly, and their own privacy policies apply.
  • Email marketing – Mailchimp (Intuit) sends our newsletters and some order-related emails, and stores our subscriber list.
  • Analytics and advertising – Google (Google Analytics, Google Tag Manager and Google Ads) and Meta (Facebook and Instagram, through the Meta Pixel) help us understand how our website is used and show our ads to people who may be interested.
  • Professional advisers – our accountant, bank, insurer and lawyers, where needed.
  • Brands and suppliers – when we need to sort out a warranty claim or faulty product with the manufacturer, we may share the details needed to resolve it.
  • Government and law enforcement – such as Inland Revenue or the New Zealand Police, but only where the law requires or allows it (for example, to prevent or investigate a crime).

If our business is ever sold or restructured, customer information may be passed to the new owner so they can keep serving you, on the same terms as this policy.

Sending information overseas

We are a New Zealand business, but some of the services we use store or process information outside New Zealand. In particular:

  • Google, Meta, Mailchimp and PayPal are based in the United States, and process information there and in other countries;
  • Kinsta, Cloudflare, Lightspeed, Windcave and Afterpay may store or process information in Australia, the United States and other countries where they operate.

Where these businesses store or process information for us, we remain responsible for it under the Privacy Act. Where information is shared with them for their own purposes too (for example, when Google or Meta use advertising data), we choose established providers with published privacy and security commitments, and we take reasonable steps to make sure your information is protected in a way that is broadly comparable to New Zealand privacy law. Countries such as the United States and Australia do not have privacy laws identical to ours, so some protections may differ.

Cookies and tracking

Like most online shops, our website uses cookies and similar technologies (small files or pieces of code stored in your browser). We want to be upfront about what they are and what they do:

  • Essential cookies – these make the site work, such as keeping items in your cart, keeping you logged in to your account, and securing checkout. WooCommerce and WordPress set these. The site will not work properly without them.
  • Security and delivery cookies – Cloudflare, which protects and speeds up our website, and our payment providers (Windcave, PayPal and Afterpay) set cookies to detect bots and fraud and to load their payment tools safely.
  • Analytics cookies – Google Analytics (loaded through Google Tag Manager) tells us how many people visit, which pages and products are popular, and how people find us. This helps us improve the site.
  • Advertising cookies and pixels – Google Ads (including Google’s DoubleClick cookies) and the Meta Pixel let us measure whether our ads lead to sales and show Coastal Sports ads to people who have visited our site (often called “remarketing”). Google and Meta may combine this with other information they hold about you under their own privacy policies.
  • Email cookies – Mailchimp may use a small piece of code on our site and tracking in our emails to tell us whether an email was opened or a link clicked, and which products subscribers are interested in.

Your choices: you can block or delete cookies in your browser settings, though some parts of the site (like the cart and checkout) may stop working. You can also:

Marketing emails and how to opt out

We will only send you our newsletter and promotional emails if you have signed up or agreed to receive them, or if you are an existing customer and the law allows us to (in line with the Unsolicited Electronic Messages Act 2007). Every marketing email includes an unsubscribe link, and you can also ask us to stop by emailing info@coastalsports.co.nz. Unsubscribing from marketing will not stop important messages about your orders, such as receipts and delivery updates.

How we keep your information safe

We take reasonable steps to protect your personal information from loss, misuse and unauthorised access, use, change or disclosure. These include:

  • encrypting our website with HTTPS (SSL/TLS), including at checkout;
  • letting specialist payment providers (Windcave, PayPal and Afterpay) handle card and alternate payments, so we never see or store full card numbers;
  • using reputable, security-focused providers for hosting (Kinsta), point-of-sale (Lightspeed) and email;
  • limiting access to customer information to staff who need it, and using strong passwords and two-factor authentication where available; and
  • keeping our website software and plugins up to date.

No system is completely secure, so we cannot promise that information sent over the internet will always be safe. If you think your account or information has been put at risk, please contact us straight away.

If there is a privacy breach

If a privacy breach happens (for example, someone gains unauthorised access to customer information, or it is lost or wrongly disclosed), we will act quickly to contain it and reduce any harm. If the breach has caused, or is likely to cause, serious harm to anyone, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act 2020 requires.

How long we keep it

We only keep personal information for as long as we need it for the purposes described in this policy, or as long as the law requires. As a guide:

  • sales, invoice and accounting records are kept for at least seven years, because New Zealand tax law requires it;
  • order and customer records are kept while you remain a customer and for a reasonable period afterwards, so we can help with returns, warranties and questions;
  • newsletter subscriber details are kept until you unsubscribe (after which we keep only a note that you have opted out, so we do not email you again);
  • website analytics data is retained by Google according to our Google Analytics settings; and
  • CCTV footage is overwritten on a rolling basis, unless it is needed to investigate an incident.

When we no longer need information, we delete it or make it anonymous.

Seeing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if you think it is wrong. You can update many of your details yourself by logging in to your account on our website. For anything else, contact our Privacy Officer (details below).

We will respond as soon as we reasonably can, and no later than 20 working days after we receive your request. We may need to confirm your identity first, to make sure we do not give your information to someone else. We will not charge you for making a request. If we decide not to give you access to, or correct, some information, we will tell you why, and if we do not correct it you can ask us to attach a statement of the correction you asked for.

Our Privacy Officer and how to contact us

Our Privacy Officer looks after privacy questions, requests and complaints. Please get in touch if you have a question about this policy, want to see or correct your information, or have a concern about how we have handled your information.

  • Privacy Officer: Dwayne Fussell
  • Email: info@coastalsports.co.nz (please put “Privacy” in the subject line)
  • Phone: (03) 319 5028
  • Post or in person: Privacy Officer, Coastal Sports Limited, 24 Westend, Kaikōura 7300

Making a complaint

If you are unhappy with how we have handled your personal information, please contact our Privacy Officer first so we can try to put things right. If you are still not satisfied, you can make a complaint to the Office of the Privacy Commissioner:

Links to other websites

Our website links to other websites, such as brand sites, social media, payment providers and courier tracking pages. We are not responsible for how those websites handle your information, so we suggest you read their privacy policies.

Changes to this policy

We may update this policy from time to time, for example when we start using a new service or the law changes. The latest version will always be on this page, with the date it was last updated shown at the top. If we make a significant change, we may also let you know by email or with a notice on our website.

Thank you for trusting Coastal Sports with your information. If you have any questions, just ask – we are happy to help.