Transforming landscapes with over 29 years of expertise.
Your rights: You may ask ONZKO for access to personal information we hold about you and ask us to correct it. Details are in section 15.
1. About this policy
ONZKO Limited (NZBN 9429053723680) is the New Zealand agency responsible for the personal information described in this policy. In this policy, ONZKO, we, us and our refer to ONZKO Limited.
This policy applies when you visit onzko.com or an ONZKO-operated shop or subdomain, contact us, request a quote, create an account, buy products or services, apply for a trade account, interact with us at a work site, or otherwise deal with ONZKO.
We handle personal information under the Privacy Act 2020 and its information privacy principles, including Information Privacy Principle 3A for information collected indirectly. Other laws may also require or permit particular records or communications.
This is a privacy notice, not a waiver of your rights and not a request for blanket consent. Where the law or a particular activity requires separate consent, we will ask for it separately.
2. What personal information means
Personal information is information about an identifiable individual. It can include information that identifies you directly and information that identifies you when combined with other information.
Business contact information can still be personal information when it identifies a person, such as a sole trader, director, employee, site contact or trade-account guarantor.
3. Information we collect
The information we collect depends on how you deal with us and is limited to what we reasonably need for a lawful business purpose. It may include:
3.1 Contact and identity information
- your name, business or organisation, position and contact details;
- delivery, billing, site and postal addresses;
- account username and authentication information;
- information needed to confirm your identity or authority to act; and
- communications, preferences, consent records and unsubscribe requests.
3.2 Enquiries, quotes and project information
- the products or services you are interested in;
- site address, access details, dimensions, quantities, budget range and intended timing;
- plans, specifications, photographs, video, drawings, measurements and files you upload or provide;
- property constraints, hazards, underground or overhead services and other site information;
- notes, decisions, variations, approvals, defects, complaints and service history; and
- correspondence with owners, tenants, builders, designers, property managers, consultants, councils, suppliers and trade partners where relevant to the work.
3.3 Orders, accounts and payments
- products and services ordered, cart and checkout details, prices, discounts and transaction history;
- delivery, collection, return, refund, warranty and customer-support information;
- invoice, payment status and limited payment-reference information; and
- trade-account applications, business details, authorised buyers, trade references, credit limits, guarantees and payment history where applicable.
Online payments may be handled by a specialist payment gateway. When a hosted gateway is used, ONZKO generally receives a transaction reference, status and limited payment details rather than your complete card number. Do not send complete card or banking credentials to us by email or an ordinary website form.
3.4 Website and device information
- IP address, browser, device, operating system, language and approximate location derived from technical data;
- pages viewed, links selected, referral source, session times, errors and interactions;
- cookies, account sessions, security events and fraud-prevention signals; and
- information produced by enabled analytics or advertising tools, as described in section 9.
3.5 Suppliers, subcontractors and applicants
If you supply ONZKO, apply to become a trade partner or apply for a role, we may collect relevant contact details, qualifications, licences, insurance, health and safety information, references, work history, eligibility, banking details and due-diligence records. Employment records and ongoing worker information may be governed by additional internal notices and policies.
3.6 Safety, accessibility and sensitive circumstances
We may receive limited information about accessibility, health, mobility, safety or other circumstances where you choose to provide it or it is reasonably necessary to deliver services safely. We will restrict collection and use to the relevant purpose.
4. How we collect personal information
We usually collect personal information directly from you when you:
- use our website, online shop, forms, account or customer portal;
- email, call, message, meet with or otherwise communicate with us;
- request or accept a quote, place an order, make a payment or ask for support;
- provide plans, photographs, site information, product reviews or feedback;
- subscribe to marketing or respond to a survey or promotion;
- visit a work site, collection point, office, event or other ONZKO location; or
- apply for a trade account, supplier relationship, subcontracting opportunity or role.
We may also generate information during our relationship with you, such as site notes, measurements, order records, account history, communications, decisions and service records.
5. Information collected from another source
Where permitted by the Privacy Act 2020, we may collect personal information about you from another person or organisation. Sources may include:
- a property owner, tenant, customer, builder, designer, consultant or property manager;
- a supplier, subcontractor, trade partner, referee, guarantor or credit-related service;
- a delivery, payment, fraud-prevention, account, support or technology provider;
- a council, utility, regulator, public register or publicly available source; or
- another person you have authorised to deal with us.
From 1 May 2026, Information Privacy Principle 3A requires us to take reasonable steps to make you aware when we collect your personal information indirectly, unless an exception applies. Where notification is required, we will tell you as soon as reasonably practicable that we collected the information, why we collected it, its intended recipients, who collected and holds it, any law authorising or requiring collection, and your access and correction rights.
Providing this general policy may form part of those steps, but we will use a more specific notice where the circumstances require it. We will also first consider whether indirect collection is permitted, because personal information should generally be collected from the individual concerned unless an exception applies.
6. Why we collect and use personal information
We may collect, hold, use and disclose personal information where reasonably necessary to:
- respond to enquiries and assess, prepare, price and manage quotes;
- create and administer accounts, orders, deliveries, collections, payments, refunds and warranties;
- plan, coordinate, perform and document landscaping, construction, maintenance and related services;
- communicate with customers, property contacts, suppliers, subcontractors and professional advisers;
- verify instructions, identity, authority, eligibility, licences, insurance and trade-account information;
- manage customer service, complaints, defects, disputes, debt recovery and legal claims;
- operate, secure, test, troubleshoot and improve our website, shop, systems, products and services;
- detect and prevent fraud, misuse, cyber incidents, unsafe activity and unlawful conduct;
- keep accounting, tax, health and safety, product, project and other business records;
- send service communications and, with the required consent or other lawful basis, marketing;
- conduct due diligence and manage suppliers, subcontractors, trade partners and applicants;
- enforce agreements and protect ONZKO, our customers and other people; and
- comply with law, court orders, lawful requests and regulatory obligations.
We will not use personal information for a new purpose unless that use is permitted by the Privacy Act—for example, because it is directly related to the original purpose, you authorise it, or another statutory exception applies.
7. When providing information is optional or required
Providing personal information to ONZKO is generally voluntary. However, some information is necessary to respond to an enquiry, establish an account, assess site conditions, prepare a reliable quote, process an order, deliver products, manage payment or perform services safely and lawfully.
If you do not provide required information, we may be unable to respond, supply an account or quote, process or deliver an order, grant trade credit, enter a site, or provide some services. Required fields should be identified on the relevant form.
If collection is authorised or required by a particular law, we will identify that law where the Privacy Act requires us to do so. We will not describe information as legally required unless that is correct.
8. WordPress, WooCommerce and online shop information
Our website may use WordPress, WooCommerce and approved extensions to operate pages, forms, customer accounts, carts, checkout, orders, reviews and support functions.
- Accounts: If you create an account, we store the account and profile information you provide and records needed to administer access and orders.
- Carts and checkout: We process cart contents, contact, billing, delivery and order information needed to complete or recover a transaction. A marketing follow-up for an abandoned cart will only be sent where legally permitted.
- Orders: We retain order, invoice, delivery, refund and customer-service records for fulfilment, accounting, tax, warranty, fraud prevention and dispute purposes.
- Reviews and comments: If enabled, we collect the information entered, technical anti-spam information and any display name chosen. Published reviews may be visible to the public.
- Forms and uploads: We receive the fields and files you submit. Do not upload personal information about another person unless you are authorised and the disclosure is appropriate.
- Privacy tools: WordPress and participating plugins provide tools that can assist with personal-data export and erasure requests. These tools do not override lawful retention duties or exceptions.
The exact information handled depends on the settings and extensions enabled. ONZKO will review this policy when a plugin or integration materially changes how personal information is collected, used, stored or shared.
11. Overseas storage, processing and disclosure
Some providers used for website hosting, cloud storage, payments, customer management, email, analytics or support may process or store information outside New Zealand. Their locations may change as their infrastructure and subcontractors change.
Where an overseas provider stores or processes information only as ONZKO's agent and does not use it for its own purposes, section 11 of the Privacy Act generally treats the information as held by ONZKO. We remain responsible for taking reasonable security and contractual steps.
Where providing information to a foreign person or organisation is a disclosure under Information Privacy Principle 12, we will use a permitted basis. Depending on the circumstances, this may include checking for comparable privacy safeguards, using contractual protections, relying on another basis allowed by law, or obtaining the individual's express and informed authorisation after explaining that the overseas recipient may not be required to protect the information in a way comparable to New Zealand law.
12. Service and marketing communications
We may send non-marketing service messages needed to respond to an enquiry or administer a quote, account, project, delivery, safety issue, order, payment, warranty or legal obligation.
We will send commercial electronic messages only where we have the recipient's consent or another lawful basis. Marketing messages will accurately identify ONZKO and provide a clear, functional and free unsubscribe method as required by the Unsolicited Electronic Messages Act 2007.
You can unsubscribe through the message or contact us. We will action a valid electronic unsubscribe request within five working days. Unsubscribing from marketing does not prevent necessary service messages.
We may keep a minimal suppression record so that we do not accidentally add an unsubscribed address back to a marketing list.
13. Security and privacy breaches
We use safeguards that are reasonable in the circumstances to reduce the risk of loss, misuse, unauthorised access, disclosure, alteration or destruction. These may include access controls, least-privilege permissions, multi-factor authentication, encryption in transit, secure providers, updates, backups, logging, staff instructions and secure disposal.
No internet transmission or storage system is completely secure. You are responsible for keeping account credentials confidential and should tell us promptly if you suspect unauthorised access or receive a suspicious message claiming to be from ONZKO.
If a privacy breach has caused or is likely to cause serious harm, the Privacy Act requires ONZKO to notify the Office of the Privacy Commissioner and affected individuals as soon as we are practically able, unless a statutory exception applies. We will assess and respond to suspected breaches under our breach-response process.
14. How long we keep personal information
We keep personal information only for as long as it may lawfully be used, is reasonably needed for the purpose collected, or must be retained by law. The proposed ONZKO retention schedule is:
| Record type | Normal retention approach |
|---|---|
| Completed orders, invoices, refunds and accounting records | At least 7 tax years, and longer only where lawfully required or reasonably needed for a dispute, warranty or investigation. |
| Quotes, service and project records | Normally 7 years after the relationship or work ends. Records relevant to residential building work, a continuing warranty or potential claim may be kept for up to 10 years or another lawful period. |
| Enquiries that do not proceed | Normally deleted or anonymised within 24 months after the last meaningful contact, unless consent supports continued marketing or a lawful reason requires retention. |
| Pending, failed or cancelled online orders | Normally deleted or anonymised within 12 months, subject to fraud, payment, complaint and legal requirements. |
| Inactive customer accounts | Normally reviewed after 24 months of inactivity. Order and legal records may be retained separately after account information is removed or anonymised. |
| Website security and technical logs | Normally up to 90 days, unless an incident, investigation or security requirement justifies longer retention. |
| Marketing subscriptions | Until consent is withdrawn, the address is invalid, or the list is no longer used. A minimal suppression record may be kept after unsubscribe. |
| Trade, supplier, subcontractor and applicant information | For the relationship or assessment period and then for the applicable accounting, safety, contract, claims or employment-law period. |
These periods may be shortened or extended where reasonably necessary and permitted by law—for example, because of a legal hold, complaint, fraud investigation, statutory requirement or active claim. When information is no longer required, we will take reasonable steps to delete, anonymise or securely destroy it.
15. Accessing and correcting your information
You may ask us to confirm whether we hold personal information about you, provide access to it, or correct information you believe is inaccurate. You may also ask us to attach a statement of correction if we do not make the requested change.
Send your request to the Privacy Officer using section 20. Please describe the information and include enough detail for us to locate it. We may ask for reasonable evidence of identity or authority before releasing or changing information.
We will respond as soon as reasonably practicable and normally within 20 working days. The Privacy Act permits extensions and limited grounds for withholding information. If we extend the timeframe or refuse all or part of a request, we will give the notice and reasons required by law.
Access and correction requests are usually free. We will charge only where and to the extent permitted by law, after telling you in advance where practicable.
You may also ask us to close an account, withdraw marketing consent or delete information. Deletion is not absolute: we may need to retain records for tax, accounting, order fulfilment, safety, fraud prevention, disputes or another lawful purpose.
16. Privacy questions and complaints
If you believe ONZKO has not handled personal information properly, contact our Privacy Officer first. Please explain what happened, the information involved, the outcome you want and any relevant dates or documents. We will acknowledge and investigate the matter fairly.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner or use its online complaint process.
17. Third-party websites, embedded content and social media
Our website may link to third-party websites or display maps, videos, social-media content, reviews or other embedded services. Those providers may collect information directly from your browser under their own privacy terms, particularly if you are logged into their service.
ONZKO does not control independent third-party privacy practices. Review the provider's privacy information before using its service. We will avoid loading non-essential third-party tracking before the required privacy choice is obtained.
18. Children's personal information
Our website and services are not directed primarily to children. If a child provides personal information, we will take particular care that collection is fair and reasonable in the circumstances. A parent or legal guardian may contact our Privacy Officer about information concerning a child where they have the authority to do so.
19. Changes to this policy
We may update this policy to reflect changes in law, our business, website, services, providers or information practices. We will publish the revised version and effective date on this page. If a change is material, we will take reasonable steps to bring it to the attention of affected people and obtain any consent required by law.
An updated policy does not by itself authorise a new use or disclosure that would otherwise be inconsistent with the Privacy Act.
20. Contact our Privacy Officer
Privacy Officer — ONZKO Limited
NZBN: 9429053723680
7 Elizabeth Street, Pakuranga, Auckland 2010, New Zealand
Phone: +64 21 199 1984
Email: [email protected]
Please use the subject line Privacy Request and do not send identity documents unless we ask for them through an appropriate channel.
