How we handle your information.

Effective: 11 June 2026

1. Who we are

Custodi Limited (NZBN 9429052624858) is a New Zealand company supplying digital forensics software, RF shielding hardware, and law enforcement equipment. This privacy policy explains how we collect, use, store, share, and protect personal information about you when you visit our website, place an order, sign up for our newsletter, or otherwise interact with us. It applies to information we collect through custodi.co.nz and in the course of supplying products and services to you.

We handle your personal information in accordance with the Privacy Act 2020 and the Information Privacy Principles (“IPPs”) it contains.

2. What personal information we collect

The personal information we collect depends on how you engage with us. It may include:

• Contact details: your name, billing and delivery address, phone number, and email address.
• Order information: records of products and services you have purchased or quoted from us, including quote and invoice references.
• Payment information: payment card and billing information you provide when paying. We do not store card numbers ourselves; payment is processed by our payment providers (see section 5).
• Account information: if you create a customer account on our website, your username, encrypted password, and any preferences you set.
• Communications: records of emails, contact-form submissions, and phone calls with you, including support and warranty correspondence.
• Marketing preferences: whether you have subscribed to our newsletter and whether you have unsubscribed.
• Technical information: when you visit our website, our hosting provider and our website itself receive standard technical information including your IP address, browser type, the pages you viewed, and the dates and times of your visit.

3. How we collect personal information

We collect personal information directly from you in most cases:

• When you place an order through our website.
• When you create a customer account.
• When you subscribe to our newsletter.
• When you contact us by email, phone, or through a contact form.
• When you request a quote or formal supply documentation.

In some cases we receive information indirectly:

• From our payment providers (Stripe and Afterpay) when they confirm transactions.
• From our courier (NZ Post) when they provide tracking and delivery confirmation.
• Where someone you have authorised deals with us on your behalf (for example, a procurement officer placing a purchase order on behalf of a government agency).

We do not buy personal information from data brokers. We do not run advertising-tracking pixels on our website, and we do not use Google Analytics, Meta Pixel, or LinkedIn Insight.

4. Why we collect personal information

We collect your personal information to:

• Process orders and deliver products to you.
• Provide formal quotes and respond to procurement enquiries.
• Issue tax invoices and meet our GST and Inland Revenue record-keeping obligations.
• Handle warranty claims, returns, and after-sale support.
• Communicate with you about your order or your enquiry.
• Send you our newsletter if you have subscribed.
• Maintain customer accounts and order history for your future reference.
• Comply with our legal obligations under New Zealand law.
• Prevent fraud and protect the security of our business and yours.

We will not use your personal information for any purpose other than these without your consent, except where we are permitted or required by law to do so.

5. Who we share your personal information with

To run our business, we share limited information with the following third parties. Each receives only what they need to perform their function:

• Stripe (payment processing). Stripe handles payment card data securely on our behalf and stores it in their systems. Stripe is based in the United States. Their privacy policy is available at Stripe Privacy Policy.
• Afterpay (buy-now-pay-later). If you choose to pay with Afterpay at checkout, your information is shared with Afterpay to assess and process the transaction. Afterpay is based in Australia. Their privacy policy is available at Afterpay Privacy Policy.
• NZ Post, iShipping and others (couriers). We share your name, delivery address, and phone number with various courier companies and booking platforms that we use to dispatch your order. Their privacy policies  are available at NZ Post Privacy Policy, iShipping Privacy Policy, Trademe Privacy Policy
• MailPoet (newsletter distribution). We use MailPoet to send our newsletter to subscribers. MailPoet is operated by Automattic Inc., based in the United States. Their privacy policy is available at Mailpoet Privacy Policy.
• Hostinger (website hosting). Our website and customer database are hosted by Hostinger, with data stored on servers in Singapore. Their privacy policy is available at Hostinger Privacy Policy.

Beyond these service providers, we will only disclose your personal information where we are required or authorised to do so under New Zealand law (for example, to respond to a court order, to assist a law enforcement agency, or to comply with a request from Inland Revenue).

We do not sell your personal information to anyone.

6. How we store and protect your personal information

Customer records are held in the database on our website server (Hostinger, Singapore), in our own working systems, and in our accounting records. Payment card information is not stored by us; it is held and processed by Stripe under their security framework.

We take reasonable steps to protect your personal information from unauthorised access, modification, disclosure, loss, or destruction. These include:

• TLS/SSL encryption for all data transmitted between your browser and our website.
• Access controls and limited staff access to our customer records.
• Regular software updates and security patches.
• Password protection on customer accounts, with passwords stored in encrypted form in our database.
• Physical security at our office and warehouse in Roxburgh.

Despite these measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a privacy breach involving your information, we will act in accordance with our obligations under the Privacy Act 2020. Where the breach is notifiable under the Act, we will notify you and the Office of the Privacy Commissioner.

7. Information held overseas

Some of the service providers listed in section 5 hold or process your information outside of New Zealand:

• Customer records and order history are stored on Hostinger servers in Singapore.
• Payment card data is held and processed by Stripe in the United States.
• Afterpay transactions are processed by Afterpay in Australia.
• Newsletter distribution and subscriber lists are handled by MailPoet (Automattic) in the United States.

Each of these providers is subject to privacy legislation in their home jurisdiction and committed to processing personal information in line with appropriate safeguards. By providing us with your personal information, you agree to its overseas storage and processing as described in this section, in accordance with Information Privacy Principle 12 of the Privacy Act 2020.

8. How long we keep your personal information

We keep your personal information for as long as we need it for the purposes set out in this policy, and for any longer period required by law. New Zealand tax legislation generally requires us to keep financial records for at least seven years from the end of the relevant income year. Other records may be kept longer where required for warranty, legal, or regulatory purposes.

If you no longer wish to be a customer and ask us to delete your information, we will delete what we hold about you unless we are required by law to retain it.

9. Your rights to access and correct your information

You have the right, under the Privacy Act 2020, to:

• Ask us what personal information we hold about you. We will respond within 20 working days. A reasonable fee may apply if the request is substantial.
• Ask us to correct any personal information that is wrong, incomplete, or out of date.

To make a request, email us at privacy@custodi.co.nz. We may need to verify your identity before releasing or amending your information.

10. Cookies and online tracking

Our website uses cookies (small text files placed on your device) for essential website functions, including remembering your login status, your shopping cart, and your preferences. We do not use advertising or tracking cookies. We do not run third-party analytics services such as Google Analytics, and we do not use marketing pixels such as Meta Pixel.

You can disable cookies in your browser settings if you prefer. Some features of our website, such as checkout and your customer account, may not work correctly without them.

11. Direct marketing and unsubscribing

We will only send you marketing emails if you have opted in to receive them, typically by subscribing to our newsletter.

You can unsubscribe at any time by:

• Clicking the “unsubscribe” link at the bottom of any newsletter we send, or
• Emailing sales@custodi.co.nz.

We action unsubscribe requests promptly. We do not send marketing texts, and we do not phone customers for marketing purposes.

12. Children’s information

Our products and services are aimed at adult and business customers. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, please contact us and we will delete it.

13. Social media

We maintain a Facebook and Telegram page for promotional purposes. If you interact with us on either platforms, your information is also subject to their privacy policies. Information posted to public areas of our Facebook and Telegram pages are visible to other users of that platform.

14. Changes to this policy

We may update this policy from time to time. When we do, we will publish the revised version on this page with an updated effective date. We encourage you to check back periodically.

15. Privacy Officer and how to contact us

Our Privacy Officer is the Managing Director of Custodi Limited.

You can contact our Privacy Officer about any matter relating to this policy or your personal information:

• Email: privacy@custodi.co.nz
• Phone: +64 22 164 7956
• Post: Privacy Officer, Custodi Limited, 3 Ancrum Street, Roxburgh 9500

16. Complaints and the Office of the Privacy Commissioner

If you believe we have not handled your personal information in accordance with the Privacy Act 2020, please contact our Privacy Officer first. We will investigate and respond.

If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz