Privacy policy

Last updated: 1 October 2026

At a glance

Who is responsible: NZ Supps Limited, trading as WAVY, 97B Keith Street, Roslyn, Palmerston North 4414, New Zealand. Contact: support@officialwavy.com.
What we collect: name, email, delivery and billing address, phone, order history, IP address, device and browser data, cookies and how you use our site.
Why: to take and deliver your orders, support you, keep the store secure, meet legal and tax duties and, only with your consent, marketing and personalised advertising.
Who we share it with: Shopify, payment processors, our logistics partner and local couriers, Track123, Judge.me, Google, Meta and our email and SMS provider. We do not sell your personal information.
Your control: manage cookies in our banner, opt out of personalised ads, unsubscribe from marketing, and ask us to access, correct or delete your data under the NZ Privacy Act 2020, GDPR or CCPA.

Who we are

NZ Supps Limited, trading as WAVY, runs officialwavy.com and sells jade jewellery (jade bracelets and chains). This policy explains what personal information we collect, how and why we collect it, who we share it with, how long we keep it and the choices you have. We handle your information under the New Zealand Privacy Act 2020 and any other privacy law that applies to you, including the GDPR and the CCPA.

What we collect

Contact and order details: your name, email address, delivery and billing address, phone number, the items you order and your order history.
Messages: anything you send us through email or our contact form, including return requests and photos.
Payment details: handled by Shopify and our payment processors. We never see or store your full card number.
Technical data: IP address, device type, browser type, operating system and approximate location from your IP address.
Cookie and usage data: cookies and similar technologies, pages viewed, products viewed, items added to cart, how you arrived at our site and how you use it.
Reviews: if you leave a review, your name, rating, review text and any photo you add.
Marketing preferences: whether you have subscribed to our emails or SMS.

How we collect it

Checkout forms: when you place an order.
Our contact form and email: when you ask a question or start a return.
Newsletter and SMS sign-up forms: only when you choose to subscribe.
Review requests: when you choose to leave a review through Judge.me.
Cookies, pixels and similar tags: set by Shopify, Google and Meta when you use our site, subject to your cookie choices.
Service providers: delivery updates from our logistics partner, our local couriers and Track123.

Why we collect it

Information	Why we use it	Legal basis (GDPR)
Name, email, address, phone, order history	To take payment, pack, ship and track your order, send order and shipping emails, handle returns and refunds, and answer your questions	Performing our contract with you
Order and payment records	To keep tax and accounting records	Legal obligation
IP address, device and browser data	To run the store, remember your cart and currency, prevent fraud and keep the site secure	Legitimate interests
Analytics cookies and usage data	To understand how the site is used and improve it	Consent
Marketing cookies and pixels	To measure our ads and show you personalised WAVY ads on other sites and apps	Consent
Email address and phone for marketing	To send newsletters, offers and SMS you have subscribed to	Consent
Review content	To display genuine customer reviews	Consent

Who we share it with

We share personal information only with the service providers that help us run the store, and only what each needs:

Shopify: hosts our store and checkout. See the Shopify Consumer Privacy Policy.
Payment processors (including Shopify Payments and the wallet providers you choose, such as Apple Pay, Google Pay and Shop Pay): to take your payment.
Our logistics partner and local delivery couriers: your name, delivery address, phone and email to pack and deliver your parcel.
Track123: your order and tracking number to show delivery progress on our tracking page.
Judge.me: your name, email and order details to send review requests and display reviews.
Google (Google Analytics and Google Ads): site usage and conversion data, only with your consent.
Meta (Facebook and Instagram, through the Meta pixel): site usage and conversion data, only with your consent.
Our email and SMS marketing provider: your email address and phone number, only if you subscribe.
Professional advisers and authorities: where the law requires it, or to protect our legal rights.

We do not sell your personal information for money. If our business is sold or merged, your information may transfer to the new owner under this policy.

Personalised advertising

We use the Google and Meta pixels to measure which of our ads lead to visits and sales, and to show WAVY ads to people who have visited our site or bought from us (remarketing and personalised advertising). These pixels load only after you accept marketing cookies in our cookie banner. We never send advertising platforms your card details.

You can opt out of personalised advertising at any time:

Our cookie banner: decline marketing cookies, or reopen your cookie settings and withdraw consent.
Google: turn off personalised ads in My Ad Center (Google Ads Settings).
Meta: change your choices in Meta Ad Preferences.
Global Privacy Control: if your browser sends a Global Privacy Control signal, we honour it and keep marketing cookies and data sharing off.
Email support@officialwavy.com and we will exclude you from any customer list we upload to an advertising platform.

Cookies

Strictly necessary cookies keep your cart, checkout, currency and security working. They cannot be switched off.
Preference cookies remember choices such as your country and your cookie choice.
Analytics cookies (Shopify and Google Analytics) show us how the site is used. Used only with your consent.
Marketing cookies (Google Ads and Meta) measure ads and personalise advertising. Used only with your consent.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop the cart and checkout working.

How we keep it secure

Our site and checkout use TLS encryption (the padlock in your browser). Payments are processed by Shopify, which is certified to the PCI DSS Level 1 card security standard. Access to customer data is limited to the people who need it to serve you. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

How long we keep it

Order, payment and tax records: 7 years from the order date, as New Zealand tax law requires.
Support messages and return requests: 2 years after the matter is closed.
Marketing data: until you unsubscribe. After that we keep only your email address or phone number on a suppression list so we never contact you again by mistake.
Cookie and analytics data: up to 12 months.

When a retention period ends we delete or anonymise the information we control.

Your choices and how to opt out

Marketing emails and SMS: use the unsubscribe link in any email, reply STOP to any SMS, or email support@officialwavy.com.
Cookies and personalised ads: use our cookie banner, your browser settings, Google Ads Settings or Meta Ad Preferences, as described above.
Access, correction or deletion: email support@officialwavy.com with the request and the email address you used with us. We may ask you to confirm your identity, and we respond within the time the law allows (within 20 working days under the NZ Privacy Act 2020, and within one month under the GDPR). We will delete your data unless we must keep it by law, such as tax records.

Your rights under the New Zealand Privacy Act 2020

You can ask whether we hold personal information about you, ask for access to it and ask us to correct it. If we do not correct it, you can ask us to attach a statement of correction. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

Your rights under GDPR (UK and EU)

If you are in the United Kingdom, Denmark, Sweden or elsewhere in the European Economic Area, the UK GDPR and the EU GDPR give you the right to:

access your personal data and receive a copy of it,
correct inaccurate data,
have your data deleted,
restrict or object to our processing, including processing based on legitimate interests,
data portability, and
withdraw consent at any time, without affecting processing that happened before.

You can also complain to your local data protection authority, such as the UK Information Commissioner's Office, the Danish Datatilsynet or the Swedish IMY.

Your rights under CCPA (California)

If you live in California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to:

know what personal information we collect, use and share,
delete your personal information,
correct inaccurate personal information, and
opt out of the sale or sharing of your personal information, including sharing for cross-context behavioural advertising.

We do not sell personal information. Advertising pixels can count as "sharing" under California law. You can opt out through our cookie banner, and we honour Global Privacy Control signals. We will not discriminate against you, for example by charging a different price, for using any of these rights.

International transfers

Some of our service providers, including Shopify, Google and Meta, process information outside New Zealand. Where required, we rely on safeguards such as standard contractual clauses so your information has comparable protection to the NZ Privacy Act 2020 and the GDPR.

Children

Our store is not directed at children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy when our practices or the law change. We post the new version on this page with the date it was last updated.

How to contact us about privacy

Email support@officialwavy.com or use our contact form for any privacy question or request.

Business and contact details

Website name: WAVY (officialwavy.com)
Company name: NZ Supps Limited, trading as WAVY
Address: 97B Keith Street, Roslyn, Palmerston North 4414, New Zealand
Email: support@officialwavy.com
Contact form: officialwavy.com/pages/contact
Phone: +64 27 561 6261
Customer service: Monday to Friday, 9:00 am to 5:00 pm New Zealand time (NZT). We reply within 24 to 48 hours on working days.

Your cart is empty

Your cart

Subtotal

Menu