Who we are
SmallPie is a boutique web studio based in New Zealand. We build and support fast sites for real businesses. When we say we, we mean SmallPie and our contractors who work under our instructions.
Privacy Policy
Your privacy. Simple and protected.
This page explains what we collect, why we collect it, how we use it, and the rights you have. It covers clients and visitors in New Zealand, Australia, the United Kingdom, the European Union, the United States, South Africa, and other locations where we operate or may work with you.
Overview
How to reach us
Email info@smallpie.co.nz. If your request is about your privacy rights, please include the region you live in so we can apply the right rules.
What we collect
We collect only what we need to deliver services and run our site. Categories include:
Contact and account
- Name and contact details
- Company and role
- Project notes and preferences
- Support messages
Usage and device
- Pages viewed, actions on our site
- Approximate location from IP
- Device, browser, and referrer
- Cookies or similar identifiers
Payment and billing
- Billing name, address, tax info
- Payment status and history
- We do not store full card numbers
Content we work with
- Logos, images, text, and assets you provide
- Access needed to set up or support your site
- Limited credentials shared for work, stored securely
How and why we use your data
Service delivery
- To scope, build, host, and support websites
- To provide quotes, invoices, and receipts
- To communicate about work and timelines
Site performance
- To keep our site fast and secure
- To understand what content helps visitors
- To fix errors and improve navigation
Legal and compliance
- To keep records we must keep
- To manage tax and accounting
- To handle disputes and prevent fraud
Consent based
- Optional updates you opt in to
- Case studies only with your permission
- Cookies that are not essential
Legal bases we rely on
We follow the law where you live. Common legal bases include:
Contract
We need some data to deliver services you ask for. Example: contact details for project work and billing.
Legitimate interests
We use basic analytics to understand site performance and stop abuse. We balance this against your privacy.
Consent
We ask before using non essential cookies, sending marketing, or publishing a case study that identifies you.
Legal obligation
We keep records we must keep for tax, accounting, and compliance, and we share data when the law requires it.
Cookies and similar tech
Types
- Strictly necessary for core functions
- Analytics to measure pages and errors
- Optional features that remember choices
Your choices
- Browser settings to block or delete cookies
- Regional banners where required
- You can still contact us by email if you block cookies
When we share your data
We share only when needed to run our business and deliver your project.
Vendors and partners
- Hosting, CDNs, analytics, and monitoring
- Payment processors and invoicing tools
- Contractors who work under our instructions
We require confidentiality and security from each vendor we use.
Legal reasons
- To comply with law or valid process
- To protect our rights and users
- To stop fraud and abuse
Business changes
If we go through a merger, sale, or reorganisation, we will transfer data only as allowed by law and will notify you if required.
No selling of personal data
We do not sell personal information. If a law treats some analytics as a sale or share, you can opt out using the rights in your region.
International transfers
We are based in New Zealand and may use vendors in other countries. When data leaves your region, we use safeguards that the law recognises, such as standard contract terms and security controls.
If your project needs a vendor in a specific country, we will tell you and can sign a data processing addendum on request.
Security and retention
Security
- Encryption at rest and in transit where supported
- Access control and least privilege for tools and repos
- Vendor reviews for privacy and security posture
How long we keep data
- Project data for the life of the project and support period
- Billing records for the period required by law
- Analytics in aggregated or pseudonymous form when possible
Your rights by region
We respond to rights requests within the time limits set by your law. Use the links below or email info@smallpie.co.nz.
New Zealand
Privacy Act 2020. You may request access and correction. We will explain what we hold, why we hold it, and who we share it with. If we refuse a request, we will tell you why unless the law prevents this.
Australia
Australian Privacy Principles. You can access and correct your information and complain if you think we mishandled it. We will respond in a reasonable time and explain the outcome.
United Kingdom
UK GDPR and UK Privacy laws. Rights include access, correction, deletion, restriction, objection, and portability. You can complain to the ICO if you are not happy with our response.
European Union
EU GDPR. Rights include access, correction, deletion, restriction, objection, and portability. Where we rely on consent, you can withdraw it at any time. You can complain to your local authority.
United States
State laws such as California, Virginia, Colorado, Connecticut, and Utah provide rights to know, access, delete, correct, and opt out of certain data uses. We do not sell personal data, and we do not use sensitive personal data for cross context advertising.
South Africa
POPIA. You may request access, correction, deletion where allowed, and raise a complaint. We will secure personal information and notify you of notifiable breaches as required.
Canada
Federal PIPEDA and similar provincial laws apply. You can access and correct your information and complain to the Office of the Privacy Commissioner of Canada if needed.
Singapore
PDPA. You can request access and correction. We use reasonable security measures and notify where law requires it.
Other regions
If your country grants privacy rights that differ from the above, we will follow those rights to the extent required. Tell us where you live when you write to us so we apply the correct rules.
Children
Our services are for businesses and adults. We do not knowingly collect information from children. If you believe a child gave us data, email us and we will remove it.
Requests and contacts
Access my data
Email info@smallpie.co.nz with the subject Access Request. We will verify identity and provide a copy or summary as required by your law.
Correct my data
Email info@smallpie.co.nz with the subject Correction Request. Tell us what is wrong and the correct info. We may ask for proof if needed.
Delete my data
We will delete what we can and keep what the law requires. Some records like invoices must be retained. We will confirm what was removed and what we kept and why.
Opt out of sale or share
We do not sell personal information. If your law treats certain analytics as a sale or share, email us and we will apply an opt out and limit such processing for your browser or account.
Changes to this policy
We update this page when our practices change. If the change is material, we will post a clear notice on this page or contact you if we have your email. The date at the top shows when this policy took effect.
Questions
We want this to be clear. If anything here is confusing, email info@smallpie.co.nz and we will explain in normal language.