Your Privacy at Forch New Zealand

Updated: may 2025

I. Welcome to Our Privacy Policy

At Forch New Zealand (“Forch.nz,” “we,” “us,” “our”), we believe in being clear and open about how we handle your personal information. This Privacy Policy explains everything you need to know about how we collect, use, store, protect, and share your data. We’re committed to doing this in a way that respects your privacy and follows New Zealand law, specifically the New Zealand Privacy Act 2020.

The New Zealand Privacy Act 2020 (NZPA 2020) became law on December 1, 2020. It’s New Zealand’s modern privacy rule-book, designed to keep up with today’s digital world.¹ This law gives you, as an individual, important rights about how your personal information is collected and used.³ It also requires businesses and organizations, which the law calls “agencies,” to clearly explain why they collect your data, how they use it, and if they share it with anyone else. By following this Act, Forch New Zealand shows its dedication to protecting your privacy, managing your data responsibly, and meeting international privacy standards.⁴ This policy is our promise to you that we’re doing things right, building trust by giving you clear and easy-to-understand information.

Who We Are: Forch New Zealand (forch.nz)

Forch New Zealand is a leading supplier of automotive tools and workshop products. You can find our main office and warehouse at 2D Lorien Place, East Tāmaki, Auckland 2013, where we’ve been operating since 2019. We work with many different industries, including automotive, mining, engineering, and mechanical, and we have supply hubs all over the country. You can also find us online at forch.nz, where we have an online shop for your convenience.

Knowing a bit about how we operate helps you understand why we collect certain information. Since we provide automotive tools and workshop products to various industries, we might collect information from both businesses (B2B) and individual customers (B2C). Even when we deal with businesses, the NZPA 2020 still applies to the personal information of individuals within those businesses. For example, if we have the contact details of a purchasing manager at one of our client companies, that’s still considered personal information because it identifies a specific person.

Because we have both a physical office and an online shop, we collect information in different ways. This means we might gather your personal information when you interact with us online (like through website forms, cookies, or when you create an account) or offline (like when you place an order over the phone or in person).⁵ Our privacy policy covers all these ways of collecting data, making sure that we do so fairly and securely, no matter how you interact with us.

Our Promise to You About Your Privacy

At Forch New Zealand, we’re serious about protecting your personal information. We handle it with the greatest care and respect. This policy shows our commitment to being open, responsible, and meeting the highest privacy standards required by the NZ Privacy Act 2020.

II. Important Words to Know

To help you understand this policy and our responsibilities under New Zealand law, here are some key terms explained simply.

What is “Personal Information”?

Under the NZ Privacy Act 2020, “personal information” is basically any information that can identify you as an individual. This includes things like your name, address, date of birth, and gender. It also covers your contact details, financial information, and anything else that could, directly or indirectly, point back to you. Even things like your biometric data (like fingerprints) and photos that identify you are included.⁸

What is an “Agency” in Privacy Law?

In the NZ Privacy Act 2020, an “agency” is pretty much any person or group, whether it’s a company or not. This broad definition covers most public and private organizations operating in New Zealand.¹ Since Forch New Zealand is a business operating here, we are considered an “agency” and must follow all the rules in the Act.

III. How We Look After Your Information: Following the Privacy Principles

At Forch New Zealand, we manage your personal information by following the 13 Information Privacy Principles (IPPs) from the NZ Privacy Act 2020. These principles set the rules for how we collect, use, share, store, and protect your data from the moment we get it until we no longer need it.⁴ The table below gives you a simple overview of each principle and how Forch New Zealand makes sure we stick to them. This helps you easily see our legal duties and how we fulfill them, making our practices clear and trustworthy.

Table 1: Our Privacy Principles (IPPs) and How We Follow Them at Forch.nz

IPP Number	Principle Name	What the Principle Means for You	How Forch.nz Does It
1	Why we collect your information	We should only collect your personal information for a good, legal reason related to what we do as a business, and only if we really need it.	We only collect data for clear business reasons (like fulfilling orders or helping customers), making sure we only take what’s necessary.
2	Where we get your information from	We should collect information directly from you, unless there’s a good reason not to (like if it’s publicly available and won’t harm you).	We prefer to collect information directly from you (through our website or when you contact us). We only get it from other sources if it’s allowed and makes sense.
3	What we tell you when we collect information	We need to tell you that we’re collecting your information, why we’re collecting it, who might see it, where it’s kept, and your rights to see or correct it.	This Privacy Policy is how we tell you all these important details, either when we collect your data or through easy-to-find links.
4	How we collect your information	We must collect your personal information legally, fairly, and without being overly intrusive.	We use safe and clear ways to collect your data, making sure they’re suitable for the situation and respect your privacy.
5	Keeping your information safe	We must protect your personal information with good security measures to prevent it from being lost, accessed without permission, used incorrectly, changed, or shared. We also make sure any companies we work with do the same.	We use strong security (like encryption and access controls) and make sure our partners also protect your data through our agreements with them.
6	Your right to see your information	You have the right to know if we hold any personal information about you and to see that information if we do.	We have ways for you to ask for and receive confirmation and access to your personal information in a timely and easy-to-understand way.
7	Your right to correct your information	You can ask us to correct any information about you that you think is wrong. If we don’t agree, you can ask us to add a note to your file saying what you wanted to change, and we should tell others who saw the original information.	We make it easy for you to request corrections. If we don’t agree, we’ll add your note to your file and tell others who received the information.
8	Making sure information is accurate before we use it	Before we use or share your information, we must take reasonable steps to make sure it’s accurate, up-to-date, complete, relevant, and not misleading.	We have processes to check that your personal information is accurate and current before we use or share it, making sure it’s fit for its purpose.
9	How long we keep your information	We shouldn’t keep your personal information for longer than we need it for its legal purpose.	We have internal rules for how long we keep data and securely get rid of it once we no longer need it for its original purpose.
10	How we use your information	We should only use your personal information for the reason we collected it, or for a purpose directly related to it, unless there’s a special exception (like your consent or if it’s de-identified).	We use your information strictly for the reasons we told you. Any other use only happens with your clear permission or if the law allows it.
11	When we share your information	We shouldn’t share your personal information with other organizations or people unless a specific exception in the Privacy Act applies (like your consent or a legal requirement).	We limit sharing your information with others, only doing so when legally allowed, with your consent, or for reasons directly related to why we collected it.
12	Sharing your information outside New Zealand	We can only share your personal information with people or organizations outside New Zealand if they offer similar privacy protection to what we have here (e.g., with your consent, if they follow NZ law, or if they have similar strong privacy laws).	We make sure that when we send your data overseas, the recipient protects it in a way that’s similar to the NZ Privacy Act 2020.
13	Unique identifiers	We should be careful about using and assigning unique identifiers (like customer numbers).	We keep the use of unique identifiers to a minimum and ensure they are assigned and used according to the Act’s rules.

Collecting Your Information (Principles 1, 2, 3, 4)

Why We Collect Your Information (Principle 1)

At Forch New Zealand, we only collect your personal information when it’s for a good, legal reason directly connected to what we do as a business, like selling automotive tools and workshop products. We only collect information that’s truly necessary for that specific purpose.⁴ For example, we collect your contact details to process your orders, payment information for transactions, and delivery addresses to send you products. This is the foundation of how we handle your data – every piece of information we collect has a clear and justified reason.

A key part of this principle is “data minimisation.” This means we aim to collect and keep only the smallest amount of personal information needed for our purpose.¹¹ We don’t just say we have a good reason; we actively review our data collection to make sure we’re not gathering anything extra. For instance, if we collect phone numbers but mostly use email for order confirmations, we might decide to stop collecting phone numbers if they’re not truly essential. This approach reduces the risk of holding too much personal information and aligns with the Act’s goal of preventing unnecessary data hoarding.

Where We Get Your Information (Principle 2)

Whenever possible, Forch New Zealand collects your personal information directly from you. This happens when you use our website, create an account, place an order, sign up for our newsletters, or talk to us directly. In rare cases, if it’s not practical to get the information directly from you, or if the information is publicly available and collecting it from someone else wouldn’t harm your privacy, we might get it from other legitimate sources.⁹

Being Open: What We Tell You (Principle 3)

When we collect personal information from you, Forch New Zealand takes reasonable steps to make sure you’re fully aware of some important things. This includes telling you that your information is being collected, why we’re collecting it, and your rights to see and correct that information.¹⁰ This Privacy Policy is our main way of fulfilling these transparency duties.⁸

The fact that this Privacy Policy helps us meet Principle 3 shows how important this document is. It’s not just a formality; it’s a key legal tool for showing you how open we are. That’s why we make sure this policy is easy to find, clearly written, and covers all the necessary details. Forch New Zealand prominently links to this policy on our website, for example, in the footer or during sign-up and checkout, so you can easily find it when you’re giving us your data. This ensures that the policy’s design and accessibility are just as important as its content for full legal compliance.

How We Collect Your Information (Principle 4)

Forch New Zealand collects personal information only through legal means and in a way that is fair and doesn’t unreasonably intrude on your personal life.¹⁰ This means our collection methods are suitable for our business and always respect your privacy. We think about the specific situation when we collect data, especially when dealing with children or young people, to ensure fairness and minimise intrusion.

The table below gives you a detailed look at the types of personal information Forch New Zealand collects, examples of that data, why we collect it, and our legal reason for doing so. This level of detail directly addresses the data minimisation and transparency rules in Principles 1 and 3, making things clear for you and helping us stay compliant internally.

Table 2: What Personal Information We Collect and Why

Type of Information	Examples of What We Collect	Why We Collect It	Our Legal Reason
Contact Details	Your Name, Email Address, Phone Number, Shipping Address	To send you your orders, help you with questions, send you marketing updates, manage your account	Because we have a contract with you, with your permission, for our business operations
Account Information	Your Username, Password, Account settings	To create and manage your account, give you a personalised experience, keep your account secure	Because we have a contract with you, for our business operations
Payment Information	Tokenised Credit Card Number, Billing Address, Payment history	To process your payments, prevent fraud, keep financial records	Because we have a contract with you, to meet legal requirements
Order History	What you’ve bought, Order dates, How much you spent, Returns	To fulfill your orders, handle warranties, provide customer service, analyse our business	Because we have a contract with you, for our business operations
Website Use Data	Your IP Address, Browser type, Pages you visited, Where you came from, Device details	To improve our website, prevent fraud, analyse how our site is used, personalise your experience	For our business operations, with your permission (for non-essential cookies)
Communication Records	Emails, Chat messages, Phone call recordings (where allowed)	To help you with customer support, resolve issues, improve our services, for staff training	Because we have a contract with you, for our business operations, with your permission
Enquiry Details	Information you provide in contact forms or direct messages	To respond to your questions, give you quotes, help with sales	For our business operations, to prepare for a contract

Storing and Keeping Your Information Safe (Principle 5)

Forch New Zealand is very serious about keeping your personal information safe. We use strong security measures that are appropriate for the situation to protect your information from being lost, accessed without permission, used incorrectly, changed, or shared, and other types of misuse. Our security includes things like encrypting data, strict access controls, using secure networks, and regularly checking for any weak spots.

The idea of “reasonable security safeguards” means that keeping your data safe isn’t a one-time thing; it’s an ongoing process that needs constant review and updates. This is because online threats and technology are always changing. Forch New Zealand has internal security rules, trains our staff regularly, and might even get outside experts to check our security to make sure we’re always ahead of the game in protecting your data.

Also, when Forch New Zealand works with other companies to handle or store your personal information for us (like cloud hosting providers, payment companies, or shipping services), we do everything we reasonably can to stop them from using or sharing your information without permission. This is a really important part of our compliance, as our responsibility under Principle 5 extends to the companies we work with. We carefully check these service providers and sign strong agreements with them that require them to meet similar security and privacy standards. This ensures that your data is protected even when it’s handled by others. This also involves figuring out if the other company is acting as an independent data controller or just processing data for us, as this affects our agreements and how we manage compliance.

Your Rights to See and Correct Your Information (Principles 6, 7)

Your Right to See Your Information (Principle 6)

You have the right to ask Forch New Zealand if we hold any personal information about you. If we do, you’re entitled to see that information. We’re committed to giving you access to your personal information in a way that’s easy to understand, so you can clearly see what data we have about you.

Your Right to Ask for Corrections (Principle 7)

If you believe that any personal information Forch New Zealand holds about you is wrong, out of date, incomplete, irrelevant, or misleading, you have the right to ask us to correct it. If we don’t agree to make the change you requested, you can ask us to attach a note to your information stating the correction you wanted. We’ll take reasonable steps to make sure this note is clearly attached to your information.¹⁰ Plus, if we correct your information or add a note, we will, where it’s practical, tell anyone else we’ve previously shared that information with.

The detailed process for correction requests, including the option to add a “statement of correction” and the need to tell others who saw the original data, really highlights how important data accuracy and your control over your data are under the Act. This means that following Principle 7 isn’t just about changing a piece of data; it requires us to have strong internal procedures for handling these requests, tracking changes, and communicating with other parties to ensure your personal information is managed carefully throughout its life.

How to Ask to See or Correct Your Information

To ask for access or a correction, please get in touch with Forch New Zealand using the contact details in the “Contact Us” section of this policy. We’ll confirm we received your request and respond within 20 working days, as required by the NZ Privacy Act 2020. We might need to confirm your identity before processing your request to keep your personal information secure and private.

Accuracy and How Long We Keep Data (Principles 8, 9)

Making Sure Information is Accurate Before We Use It (Principle 8)

Before we use or share any personal information, Forch New Zealand takes reasonable steps to make sure it’s accurate, up-to-date, complete, relevant, and not misleading, especially considering why we’re using it. This proactive step is crucial for keeping our data reliable and ensuring that any decisions we make based on this information are sound.

How Long We Keep Your Information (Principle 9)

Forch New Zealand will not keep your personal information for longer than we need it for the legal reasons we collected it for. Once we no longer need your personal information for its intended purpose, we will securely get rid of it. This means shredding physical documents so they can’t be read and securely wiping digital data from all our storage and backups.

The rule about not keeping data longer than necessary is closely tied to data minimisation. If Forch New Zealand kept customer data forever, it would increase our risk if there was a data breach and would break Principle 9. That’s why we have internal schedules for how long we keep data, making sure we follow this principle and any specific legal requirements for certain types of data, like tax records. While Forch New Zealand mainly deals with automotive and industrial products, we also consider if we might accidentally collect any health-related data (for example, for an employee’s safety gear or a customer’s accessibility needs). If we do collect such data, specific rules, like keeping health records for ten years from the last service, would apply. This shows that Forch New Zealand needs to carefully sort its data types and apply the right retention policies, making sure no “special” data is missed and that our internal data records are thorough.

How We Use and Share Information (Principles 10, 11)

How We Use Your Personal Information (Principle 10)

Forch New Zealand uses personal information strictly for the reason we collected it, or for a purpose that’s directly related to it.¹⁰ For example, information collected to process an order will be used for fulfilling that order and helping you with any questions about it. We might use personal information for other reasons only if one of these conditions is met:

• You, the individual, have given us permission to use it that way.
• The information is used in a way that doesn’t identify you (e.g., for statistics or research, and won’t be published in a way that identifies you).
• The information comes from a publicly available source, and using it wouldn’t be unfair or unreasonable.
• Using the information is necessary for specific legal or enforcement reasons.

When We Share Your Information with Others (Principle 11)

Forch New Zealand will not share personal information with any other organization or person unless we reasonably believe that one of the exceptions in the Privacy Act applies. These exceptions include:

• The sharing is for one of the reasons we collected the information, or is directly related to those reasons.
• You, the individual, have given us permission to share it.
• Sharing is necessary to uphold the law or for law enforcement.
• The information is publicly available, and sharing it wouldn’t be unfair or unreasonable.
• Sharing is necessary to prevent or reduce a serious threat to public health or safety, or to someone’s life or health.
• Sharing is required or allowed by law.
• Sharing is for statistics or research and won’t be published in a way that identifies you.

Working with Other Companies (Third-Party Service Providers)

Forch New Zealand works with trusted third-party service providers, like companies that process payments, handle shipping, or provide IT services for our website and data storage. When we give personal information to these companies to help us provide a service, it’s not considered “sharing” for the purpose of Principle 11, because these companies are acting on our behalf. However, in these arrangements, Forch New Zealand does everything reasonably possible to prevent these service providers from using or sharing the information without permission, as required by Principle 5. This means we have strong contracts with all these third parties that require them to protect your data and meet similar security and privacy standards. This difference between an independent company and one working on our behalf is crucial for modern businesses and greatly affects the contracts we need and our overall compliance strategy.

Sending Your Data Overseas (Principle 12)

Rules for Sharing Information Outside New Zealand

Forch New Zealand may share personal information with a person or company outside New Zealand only if one of the following conditions is met. This ensures that your information gets similar privacy protection to what’s provided by the NZ Privacy Act 2020 :

• You Give Permission: You specifically allow us to share your information after Forch New Zealand has clearly told you that the company receiving it might not have to protect it with safeguards as strong as those in the NZ Privacy Act 2020. This rule for clear, informed consent sets a high standard for sharing data with countries that might have weaker privacy laws.
• They Operate in NZ: Forch New Zealand reasonably believes the company receiving the data is doing business in New Zealand and is therefore subject to the NZ Privacy Act 2020 for that information.
• Similar Privacy Laws: Forch New Zealand reasonably believes the company receiving the data is subject to privacy laws that, overall, offer similar protection to the NZ Privacy Act 2020 (e.g., countries that New Zealand has an “adequacy decision” with). New Zealand’s agreement with the EU is a big help here, making it easier to send data to EU countries because no extra safeguards are needed beyond that agreement. However, sending data to non-EU countries or those without similar agreements would still require other safeguards.
• Part of a Special Scheme: Forch New Zealand reasonably believes the company receiving the data is part of a special binding scheme, as set out in NZ regulations.
• Approved Country: Forch New Zealand reasonably believes the company receiving the data is subject to the privacy laws of an approved country, as set out in NZ regulations.
• Contractual Protection: Forch New Zealand reasonably believes the company receiving the data is required to protect the information in a way that, overall, provides similar protection to the NZ Privacy Act 2020, usually through a strong contract with them.

The need for your explicit permission after being told about potentially weaker safeguards is a high bar for consent. This means Forch New Zealand can’t just rely on a general privacy policy for transfers to countries without similar privacy laws. Instead, we would need a specific, informed consent process when we collect or transfer data in such situations. This highlights that if Forch New Zealand plans to send data to countries without comparable safeguards, we must have a strong, detailed consent process or rely on robust contract clauses to avoid breaking the law. Therefore, Forch New Zealand needs to know where its data is processed and stored, and where its third-party service providers are located, to figure out which Principle 12 conditions apply and make sure the right legal protections are in place.

IV. What Happens if There’s a Privacy Breach

Our Responsibilities for Serious Privacy Breaches

Under the NZ Privacy Act 2020, Forch New Zealand has a mandatory duty to tell the Privacy Commissioner and affected individuals if a privacy breach happens that causes, or is likely to cause, “serious harm.” A privacy breach is basically any unauthorized access, sharing, change, loss, or destruction of personal information. This mandatory reporting rule shows how seriously privacy breaches are taken under New Zealand law.

How We Handle and Respond to Breaches

Forch New Zealand has a clear and thorough plan for responding to any potential privacy breaches. This plan is designed to ensure we act quickly and effectively, minimizing any harm to affected individuals and keeping your data safe. Our plan includes:

• Checking: Quickly figuring out what happened and how serious the breach is to see if it meets the “serious harm” level for mandatory notification.
• Stopping: Taking immediate steps to contain the breach and prevent any further unauthorized access, use, or sharing of personal information.
• Telling People: Notifying the Privacy Commissioner and affected individuals without unnecessary delay if serious harm is likely to occur because of the breach.
• Fixing Things: Taking steps to lessen any harm caused by the breach and making changes to prevent similar incidents in the future.
• Reviewing: Doing a thorough review after the breach to learn from what happened, find the root causes, and improve our security and response plans.

Forch New Zealand regularly reviews and updates its data security measures and provides ongoing training to our staff on data protection and how to respond to breaches. The focus on training staff about data protection and breach response shows that people are just as important as technology in preventing and managing breaches. Even with a strong privacy policy and good technical security, it’s not enough if staff don’t know their roles and responsibilities in protecting data and handling incidents. This proactive approach to staff education is crucial for reducing the risk of human error leading to privacy breaches or mishandling incidents, which improves overall compliance and reduces potential harm.

V. Your Privacy Rights and How to Make a Complaint

Your Rights Under the Privacy Act 2020

The NZ Privacy Act 2020 gives you several basic rights about your personal information, putting you more in control of your data:

• Right to Know: You have the right to know what information Forch New Zealand collects about you, why we collect it, and how it will be used and shared.
• Right to Access: You can ask Forch New Zealand if we hold any personal information about you, and if so, to see that information.
• Right to Correct: You have the right to ask us to correct your personal information if you believe it’s wrong, incomplete, or misleading.
• Right to Opt-in to Marketing: You have the right to decide whether you receive direct marketing messages from Forch New Zealand.
• Right to Be Notified of Breaches: You have the right to be told if your data is involved in a serious privacy breach that is likely to cause you harm.
• Right to Complain: You have the right to complain to Forch New Zealand or the Office of the Privacy Commissioner if you believe your privacy rights have been violated.³

How to Make a Complaint to Forch New Zealand

If you have any worries or complaints about how Forch New Zealand handles your personal information, we encourage you to contact us directly first.¹⁶ We’re committed to solving your concerns quickly and fairly. When you make a complaint, please give us as much detail as possible, including any relevant emails or proof.

You can reach our Privacy Officer using the contact details in the “Contact Us” section of this policy.⁶ The Privacy Commissioner always advises people to contact the organization directly first before going to their office. This shows how important it is for Forch New Zealand to have a clear and responsive way to handle complaints internally. An efficient internal process means fewer formal complaints to the Privacy Commissioner, which can save time and protect our reputation. This also shows that Forch New Zealand values your feedback and actively works to address privacy concerns, building trust with you.

Get in Touch With Us

Forch New Zealand Contact Details

If you have any privacy questions, concerns, or requests about your personal information, please contact our Privacy Officer:

• Email: info@forch.nz
• Phone: +64 27 0240 5583 (or +64 21 0240 5583)

Address: 2D Lorien Place, East Tāmaki, Auckland 2013, New Zealand