Privacy policy

This Privacy Policy describes how Surf Syndicate (“Surf Syndicate”, the “Site”, “we”, “us”, or “our”) collects, uses, and discloses your Personal Information when you visit or make a purchase from www.surfsyndicate.co.nz (the “Site”).

Contact

After reviewing this policy, if you have additional questions, want more information about our privacy practices, or would like to make a complaint, please contact us by email at campbell@surfsyndicate.co.nz.

Collecting Personal Information

When you visit the Site, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases. We may also collect additional information if you contact us for customer support. In this Privacy Policy, we refer to any information about an identifiable individual (including the information below) as “Personal Information”. See the list below for more information about what Personal Information we collect and why.

Device information

  • Purpose of collection: to load the Site accurately for you, and to perform analytics on Site usage to optimise our Site.
  • Source of collection: collected automatically when you access our Site using cookies, log files, web beacons, tags, or pixels.
  • Disclosure for a business purpose: shared with our processor Shopify, and with our analytics and advertising partners (see “Behavioural Advertising” and “Sharing Personal Information” below).
  • Personal Information collected: version of web browser, IP address, time zone, cookie information, what sites or products you view, search terms, and how you interact with the Site.

Order information

  • Purpose of collection: to provide products or services to you to fulfil our contract, to process your payment information, arrange for shipping, and provide you with invoices and/or order confirmations, communicate with you, screen our orders for potential risk or fraud, and — when in line with the preferences you have shared with us — provide you with information or advertising relating to our products or services.
  • Source of collection: collected from you.
  • Disclosure for a business purpose: shared with our processor Shopify, our payment providers, our shipping carriers, our email and marketing provider (Klaviyo), and — where we use AI assistance to summarise or analyse orders — our AI service provider (see “AI-Assisted Tools” below).
  • Personal Information collected: name, billing address, shipping address, payment information (including credit and debit card details, processed by our payment provider), email address, and phone number.

Customer support information

  • Purpose of collection: to provide customer support and respond to your enquiries.
  • Source of collection: collected from you.
  • Disclosure for a business purpose: shared with our processor Shopify and our email provider.
  • Personal Information collected: your name, email address, order details, and the contents of your correspondence with us.

Minors

The Site is not intended for individuals under the age of 16. We do not intentionally collect Personal Information from children. If you are the parent or guardian and believe your child has provided us with Personal Information, please contact us at the address above to request deletion.

Sharing Personal Information

We share your Personal Information with service providers to help us provide our services and fulfil our contracts with you, as described above. For example:

  • We use Shopify to power our online store. You can read more about how Shopify uses your Personal Information here: https://www.shopify.com/legal/privacy.
  • We use Anthropic’s Claude AI assistant to help us draft content and analyse our store data, as described in the “AI-Assisted Tools” section below. You can read more about Anthropic’s privacy practices here: https://www.anthropic.com/legal/privacy.
  • We use Klaviyo to manage our email and marketing communications. You can read more here: https://www.klaviyo.com/legal/privacy/privacy-notice.
  • We use Google Analytics to help us understand how customers use the Site. You can read more here: https://policies.google.com/privacy. You can opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
  • We use Meta (Facebook and Instagram) tools to measure and deliver advertising. You can read more here: https://www.facebook.com/privacy/policy.
  • We share order and delivery information with our payment providers and shipping carriers so we can process payments and deliver your order.
  • We may share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

AI-Assisted Tools

We use third-party artificial intelligence (AI) tools to help us run parts of our business more efficiently. We use AI assistance to:

  • draft and refine our marketing and email content;
  • summarise and analyse orders and sales data for reporting, and to group customers into segments for marketing; and
  • write and improve product descriptions and related store content.

When we use these tools, some Personal Information may be processed by our AI service provider. This can include your name, email address, postal and shipping address, phone number, and order details (such as the products you purchased), and — where we work with customer reviews — the content of those reviews. We share only the information needed for the task, and a member of our team reviews the output before we use it. We do not send payment card details to these tools.

Our AI service provider is Anthropic, PBC (“Anthropic”), the provider of the Claude AI assistant, which is based in the United States. This means the relevant information is transferred to and processed in the United States. We have turned off the setting that would allow Anthropic to use our conversations to train its AI models, and the information is retained only for as long as needed and then deleted in line with Anthropic’s retention practices. You can read more about Anthropic’s privacy practices at https://www.anthropic.com/legal/privacy and view its list of sub-processors at https://trust.anthropic.com/subprocessors.

We do not use AI tools to make decisions that produce legal effects about you, or that similarly significantly affect you, without human involvement. See “Automated decision-making” below.

Behavioural Advertising

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For example:

  • We use Google Analytics to help us understand how our customers use the Site, and we use the data to help measure and improve our advertising.
  • We share information about your use of the Site, your purchases, and your interaction with our ads on other websites with our advertising partners, including Meta (Facebook and Instagram). We collect and share some of this information directly with our advertising partners, and in some cases through the use of cookies or other similar technologies (which you may consent to, depending on your location).
  • We use Shopify Audiences to help us show ads on other websites with our advertising partners to buyers who may be interested in what we have to offer. We also share information about your use of the Site, your purchases, and the email address associated with your purchases with Shopify Audiences, through which other Shopify merchants may make offers you may be interested in.

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at https://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising by using the following links:

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: https://optout.aboutads.info/. See also “Selling and Sharing Personal Information” below.

Using Personal Information

We use your Personal Information to provide our services to you, which includes: offering products for sale, processing payments, shipping and fulfilment of your order, and keeping you up to date on new products, services, and offers.

Lawful basis (GDPR)

Pursuant to the General Data Protection Regulation (“GDPR”), if you are a resident of the European Economic Area (“EEA”) or the United Kingdom, we process your Personal Information under the following lawful bases:

  • the performance of the contract between you and the Site;
  • compliance with our legal obligations;
  • your consent (for example, for marketing communications and certain cookies); and
  • our legitimate interests, which do not override your fundamental rights and freedoms (for example, to operate and improve our store and to prevent fraud).

Retention

When you place an order through the Site, we will retain your Personal Information for our records unless and until you ask us to erase this information. For more information on your right of erasure, please see the “Your rights” section below. Personal Information processed by our AI service provider is kept only for as long as needed to complete the task and is then deleted in line with that provider’s retention practices.

Automated decision-making

If you are a resident of the EEA or the United Kingdom, you have the right to object to processing based solely on automated decision-making (which includes profiling), when that decision-making has a legal effect on you or otherwise significantly affects you.

We do not engage in fully automated decision-making that has a legal or otherwise significant effect using customer data. We use AI tools to assist our team with tasks such as drafting content and analysing data, but a person reviews the results and is responsible for any decision that affects you.

Our processor Shopify uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on you. Services that include elements of automated decision-making include:

  • a temporary blacklist of IP addresses associated with repeated failed transactions, which persists for a small number of hours; and
  • a temporary blacklist of credit cards associated with blacklisted IP addresses, which persists for a small number of days.

Selling and Sharing Personal Information (California residents)

Our Site sells and/or shares Personal Information, as those terms are defined by the California Consumer Privacy Act of 2018 (as amended, the “CCPA”), in connection with targeted advertising and Shopify Audiences.

The categories of Personal Information we sell or share are:

  • identifiers (such as name and email address);
  • commercial information (such as products purchased); and
  • internet or other electronic network activity information (such as your interactions with our Site and ads).

We sell or share this information with our advertising partners and through Shopify Audiences, as described in the “Behavioural Advertising” section above.

How to opt out: You can opt out of the sale or sharing of your Personal Information at any time by emailing us at campbell@surfsyndicate.co.nz and by adjusting your cookie and tracking preferences on the Site. We refer to this as your “Do Not Sell or Share My Personal Information” right.

We do not knowingly sell or share the Personal Information of consumers under 16 years of age without affirmative authorisation. We do not offer any financial incentive in exchange for the sale of Personal Information.

Your rights

GDPR / UK GDPR

If you are a resident of the EEA or the United Kingdom, you have the right to access the Personal Information we hold about you, to port it to a new service, and to ask that your Personal Information be corrected, updated, or erased. You also have the right to object to or restrict certain processing and to withdraw consent. If you would like to exercise these rights, please contact us at campbell@surfsyndicate.co.nz.

Your Personal Information will be initially processed in Ireland and then transferred outside of Europe for storage and further processing, including to Canada and the United States, by our processor Shopify. For more information on how those data transfers comply with the GDPR, see Shopify’s GDPR Whitepaper: https://help.shopify.com/en/manual/your-account/privacy/GDPR. In addition, when we use AI tools as described in the “AI-Assisted Tools” section, the relevant Personal Information is processed in the United States by Anthropic.

CCPA / CPRA (California)

If you are a resident of California, you have the right to access the Personal Information we hold about you (the “Right to Know”), to delete it, to correct it, to port it to a new service, and to opt out of the sale or sharing of your Personal Information. You also have the right not to be discriminated against for exercising these rights. If you would like to exercise these rights, or to designate an authorised agent to submit a request on your behalf, please contact us at campbell@surfsyndicate.co.nz.

New Zealand and Australia

If you are a resident of New Zealand or Australia, you have the right to access and request correction of the Personal Information we hold about you under the Privacy Act 2020 (NZ) or the Australian Privacy Principles. As described above, some of your Personal Information may be sent to, and stored or processed by, service providers located overseas, including in the United States, Canada and Ireland. To exercise your rights, please contact us at campbell@surfsyndicate.co.nz.

Cookies

A cookie is a small amount of information that’s downloaded to your computer or device when you visit our Site. We use a number of different cookies, including functional, performance, advertising, and social media or content cookies. Cookies make your browsing experience better by allowing the website to remember your actions and preferences.

We use cookies to operate and optimise your experience on our Site, to perform analytics, and to deliver and measure advertising. For the current, detailed list of cookies Shopify and our Site use, please see Shopify’s cookie list: https://www.shopify.com/legal/cookies.

The length of time a cookie remains on your device depends on whether it is a “persistent” or “session” cookie. You can control and manage cookies through your browser settings; please note that removing or blocking cookies can negatively impact your experience and parts of our website may no longer be fully accessible. For more information, visit www.allaboutcookies.org. To opt out of advertising-related cookies, please also see the “Behavioural Advertising” and “Selling and Sharing Personal Information” sections above.

Do Not Track

Please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

Changes

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Complaints

As noted above, if you would like to make a complaint, please contact us by email at campbell@surfsyndicate.co.nz.

If you are not satisfied with our response to your complaint, you have the right to lodge a complaint with the relevant data protection authority. You can contact:

Last updated: 21 May 2026