Where the data sits

The site is served from a content delivery network with points of presence in Auckland, Sydney and Frankfurt, so a page you open in New Zealand is usually delivered from an Auckland or Sydney edge. Aggregated traffic statistics are stored on servers in the European Union, and editorial mail is handled by a mailbox provider in the Netherlands.

That means reader data may be processed outside New Zealand. Where it is, the transfer runs on the provider's standard contractual clauses, and the categories involved are limited to the ones described below — we hold no financial or identity data about readers at all.

Who else is involved

Three parties touch data connected to this site. The CDN provider serves the pages and keeps short-lived request logs for abuse protection. The analytics counter we run records visits without cookies and without raw IP addresses. The mail provider carries correspondence with the editorial desk.

When you follow a commercial link to the operator, you leave this site. From that click onward the operator's own privacy policy applies, and we have no access to the account you open, the money you deposit or the documents you upload during verification.

How we use it

Traffic data is used for two things only: to see which articles are read, so we know what to keep updated, and to notice attacks or scraping. It is never used to build a profile of an individual reader, and we do not run advertising networks, retargeting pixels or social media trackers on these pages.

Correspondence is used to answer you and, where a message reports a factual error, to fix the guide and record what was changed.

Security

Pages are served over HTTPS only, and the editorial mailbox is protected with two-factor authentication. Analytics figures are stored in aggregate form, so there is no reader-level dataset to lose in the first place — the strongest protection available is not collecting the data.

If we ever became aware of a breach affecting reader correspondence, the people whose messages were involved would be told by email, as would the relevant supervisory authority where required.

What we collect

From a normal visit: the page requested, the approximate country, the referring site, and a coarse device type. No cookies are set for this, no advertising identifier is read, and nothing that identifies you personally is stored — details of the few cookies that do exist are on the Cookie Policy page.

From email: your address, the message itself and anything you attach. Correspondence is kept for the duration of the exchange and up to twelve months afterwards where it concerns a published correction, then deleted.

To ask what we hold about you, or to have correspondence deleted sooner, write to [email protected]. Requests are answered within twenty working days, in line with the New Zealand Privacy Act 2020.