BareFuel Kitchen ("we", "us", "our") is a food and nutrition business headquartered in Auckland, New Zealand. We operate this website and any related digital services (collectively, the "Services").
Under the New Zealand Privacy Act 2020, BareFuel Kitchen acts as the Agency responsible for personal information collected through our Services.
02
Data We Collect
We collect only the minimum data necessary to provide and improve our Services.
Category
Examples
Source
Identity
Full name, username
Provided by you
Contact
Email address, phone number
Provided by you
Technical
IP address, browser type, device ID, OS
Auto-collected
Usage
Pages visited, clicks, time on site, referral URL
Auto-collected
Preferences
Dietary preferences, newsletter subscriptions
Provided by you
Communications
Messages you send us, support requests
Provided by you
Cookies & Tracking
Session cookies, analytics identifiers
Auto-collected
We do not intentionally collect sensitive personal information such as health data, racial or ethnic origin, religious beliefs, or biometric data, unless explicitly required and with your explicit consent.
03
How We Use Your Data
We use your personal information only for the purposes described below:
To provide, operate, and maintain our website and Services
To respond to your enquiries and customer support requests
To send newsletters, promotions, and updates (with your consent)
To understand how visitors use our site and improve user experience
To comply with legal obligations in New Zealand and other applicable jurisdictions
To detect, prevent, and address technical issues and security threats
To enforce our Terms of Service and other agreements
To carry out anonymised analytics and internal research
We never sell your personal data. BareFuel Kitchen does not sell, rent, or trade your personal information to third parties for their own marketing purposes.
04
Legal Bases for Processing
Depending on your location, we rely on the following legal bases to process your personal information:
For California residents (CCPA/CPRA), the categories of personal information collected and business purposes are described in Sections 2 and 3. We do not engage in the sale or sharing of personal information as defined under California law.
05
Sharing & International Transfers
We may share your personal information with trusted third parties strictly as required to operate our Services:
Service providers: Email platforms, cloud hosting, analytics tools — bound by confidentiality and data processing agreements
Payment processors: PCI-DSS compliant services that process data under their own privacy policies
Legal authorities: When required by law, court order, or governmental authority in New Zealand or internationally
Business transfers: In the event of a merger or acquisition — your data may be transferred with advance notice
International Transfers: Where we transfer personal data outside New Zealand (e.g. to cloud providers in the US or EU), we ensure adequate safeguards are in place — including Standard Contractual Clauses (SCCs) for EU transfers, and compliance with Information Privacy Principle 12 of the NZ Privacy Act 2020.
06
Data Retention
We retain personal data only as long as necessary for the purposes outlined in this policy, or as required by applicable law.
Data Type
Retention Period
Reason
Account & contact data
Relationship duration + 3 years
Service provision, legal disputes
Marketing preferences
Until consent withdrawn
Consent-based processing
Analytics & usage data
Up to 26 months
Service improvement
Support communications
3 years from last contact
Service quality, legal defence
Financial records
7 years
NZ IRD tax & accounting obligations
Session cookies
End of browser session
Core functionality
When data is no longer needed, we delete it securely or anonymise it so it can no longer be linked to you.
07
Your Privacy Rights
Depending on your jurisdiction, you may have some or all of the following rights:
👁
Right to Access
Request a copy of the personal data we hold about you.
✏
Right to Rectification
Correct inaccurate or incomplete personal data.
🗑
Right to Erasure
Request deletion of your data (GDPR, LGPD, CCPA).
🚫
Right to Object
Object to processing for legitimate interests or direct marketing.
📦
Data Portability
Receive your data in a structured, machine-readable format.
⏸
Restriction
Request we limit how we process your data in certain circumstances.
↩
Withdraw Consent
Withdraw consent at any time without affecting prior processing.
📋
Opt-Out (CCPA)
California residents may opt out of sale/sharing of personal information.
To exercise any of these rights, contact us at info@barefuelkitchen.com. We will respond within 30 days (or within the timeframe required by applicable law).
EU/UK residents have the right to lodge a complaint with their local Data Protection Authority (DPA).
Brazilian residents (LGPD) may contact the Autoridade Nacional de Protecao de Dados (ANPD).
California residents (CCPA) may contact the California Privacy Protection Agency (CPPA).
08
Cookies & Tracking
We use cookies and similar tracking technologies to enhance your experience on our website.
Essential Cookies
Required for the website to function (login sessions, security). Cannot be disabled.
Analytics Cookies
Help us understand how visitors interact with our site (e.g. Google Analytics). Require your consent.
Marketing Cookies
Used to deliver relevant advertising and track campaigns. Require your explicit consent.
You can manage or withdraw cookie consent at any time through your browser settings or our cookie preferences centre. Disabling certain cookies may affect website functionality.
For EU/UK users, we implement a Cookie Consent Management tool in compliance with GDPR and the ePrivacy Directive. For California residents, cookie-based tracking constituting "sharing" under CPRA may be limited through our privacy preference centre.
09
Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. These measures include:
Encryption of data in transit using TLS/HTTPS
Access controls and role-based permissions for staff
Regular security reviews and vulnerability assessments
Data minimisation — we only collect what is strictly necessary
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant authorities and affected individuals as required by law — within 72 hours under GDPR, and as soon as practicable under the NZ Privacy Act 2020.
10
Children's Privacy
Our Services are not directed at children under the age of 16 (or 13 in the United States under COPPA). We do not knowingly collect personal information from children.
If you believe we have inadvertently collected data from a child, please contact us immediately at info@barefuelkitchen.com and we will delete the information promptly.
Applicable standards: COPPA (USA, under 13) — GDPR Art. 8 (EU, under 16) — NZ Privacy Act 2020 (children and young people provisions).
11
Contact & Complaints
For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please contact our Privacy Team:
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the new policy on this page with an updated effective date. Continued use of our Services after changes are posted constitutes your acceptance of the revised policy.
We recommend reviewing this policy periodically. The date at the top of this page indicates when it was last updated.