Privacy Policy

This policy describes how First Watch® Limited ("First Watch", "we", "us") handles information collected through firstwatchprotect.com. First Watch is a New Zealand company based in Hamilton; this policy is written to meet the requirements of the New Zealand Privacy Act 2020, and also describes the rights available to visitors from the European Union (under the GDPR) and California (under the CCPA/CPRA).

What we collect

We only collect personal information that you provide directly by submitting the contact form:

• Your name
• Your email address
• The message you write

In addition, when you visit any page on this site, our hosting provider records standard server-side information: your IP address, the pages you request, the time of the request, and your user agent (browser/device). We use aggregated analytics derived from this information (see Sub-processors below); we do not attempt to identify individual visitors from these records.

We do not use advertising cookies, retargeting pixels, third-party marketing trackers, or session replay.

How we use your information

• To reply to your contact-form enquiry and any follow-up correspondence you initiate.
• To measure aggregate site usage so we can decide which content and improvements to prioritise.
• To protect the site against automated abuse (bot detection on the contact form — see Sub-processors below).

We do not sell your information, and we do not share it for any purpose other than the ones listed above.

Sub-processors

We use three external service providers to operate this site. Each is listed here with the specific data it handles and the purpose.

Vercel Inc. — hosting and analytics

Our site runs on Vercel, which hosts the application, serves page responses, and provides two measurement products we use: Vercel Web Analytics (aggregate pageview counts and referrer trends, cookieless — no device fingerprinting) and Vercel Speed Insights (anonymous real-user performance measurements such as page load times). Vercel does not receive the contents of your contact-form submissions. See Vercel's privacy policy.

Cloudflare, Inc. — bot protection (Turnstile)

Our contact form is protected by Cloudflare Turnstile, which verifies that the submission is from a human rather than an automated script. Turnstile may set temporary session state to complete its challenge; it does not track visitors across sites. See Cloudflare's privacy policy.

Microsoft Corporation — email delivery (Microsoft 365 / Graph API)

When you submit the contact form, the contents (your name, email, and message) are sent as an email through our Microsoft 365 tenant using the Microsoft Graph API. Microsoft processes the message to deliver it to our inbox at info@first-watch.co.nz. See Microsoft's privacy statement.

Cookies

We do not set cookies for tracking, advertising, or analytics. Cloudflare Turnstile may briefly set a session cookie during a contact-form challenge; this is functional only and is deleted once the challenge completes.

How long we keep your information

• Contact-form correspondence: retained in our inbox as long as is reasonably needed to follow up on your enquiry, and at most for two years, after which the conversation is archived or deleted.
• Aggregate analytics (Vercel Web Analytics, Speed Insights): retained per Vercel's standard retention for their product tiers.

Your rights

Regardless of where you live, you can ask us to confirm what information we hold about you, correct it, or delete it. Email info@first-watch.co.nz with the subject line Privacy request and we will respond within 20 working days (the New Zealand Privacy Act timeframe; GDPR and CCPA timeframes are shorter and we will meet those where they apply).

If you are in the European Union, you additionally have the right to object to processing, restrict processing, and receive your data in a portable format. If you believe we have handled your information improperly, you may lodge a complaint with the Office of the New Zealand Privacy Commissioner or the supervisory authority in your country.

If you are a California resident, you additionally have the right to know what categories of information we collect and to opt out of any sale or sharing of personal information. We do not sell or share personal information.

Security

Traffic to and from this site is encrypted with HTTPS. Our contact-form endpoint is protected by a multi-layer security pipeline (origin check, honeypot, time-based check, Turnstile verification, and input sanitisation) before any message is sent for email delivery.

Changes to this policy

We will update this page when our data-handling practices change. The date at the top reflects the most recent revision.

Contact us

Privacy questions and requests: info@first-watch.co.nz.

Postal address:
First Watch® Limited
21 Home Straight, Te Rapa
Hamilton 3200, New Zealand