Privacy & Cookie Policy
What we collect, why, where it goes, and how to get it back or have it deleted.
Last updated: 8 September 2026
This policy explains how Corby Digital Group Limited, trading as VF - The Kapiti Digital Agency ("VF", "we", "us"), handles personal information. It applies to this website and to the services we provide to clients.
We are an "agency" under the Privacy Act 2020 and we follow the thirteen information privacy principles in that Act, including IPP 3A, which came into force on 1 May 2026 and covers information collected indirectly.
What we collect
Through the contact form. Your name, email address, phone number, the topic you select, and whatever you write in the message field. Nothing else, and nothing beyond what is needed to reply to you.
Automatically, through analytics. If you have not blocked it, Google Analytics 4 records pages viewed, approximate location at city level, device and browser type, and how you arrived at the site. This is aggregated. We do not use it to identify individuals and we have not enabled Google Signals or advertising features.
Through server logs. Our host records IP addresses and requests as part of normal operation and security. These are not linked to form submissions.
In the course of client work. If you become a client we hold what is needed to do the job and to invoice you: contact details, billing details, and access credentials where you have given them to us.
Information collected indirectly
Sometimes we receive information about a person from someone other than that person. The most common case is a client giving us a colleague's contact details so we can get a website or campaign live.
Since 1 May 2026, IPP 3A requires us to take reasonable steps to tell that person we hold their information, what we are using it for, and that they can ask to see it or correct it. We do this by contacting them directly at the first reasonable opportunity, unless an exception in the Act applies - for example, where the information is already publicly available, or where the person has already been told.
If someone else has given us your details and you would rather we did not hold them, email info@vfdigital.nz and we will remove them.
Why we hold it
To reply to your enquiry. To deliver work you have engaged us for. To invoice, and to keep the financial records the Tax Administration Act 1994 requires us to keep. To understand which parts of this site are useful, in aggregate.
We do not sell personal information. We do not trade or share contact lists. We do not send marketing email to people who have not asked for it, which is also what the Unsolicited Electronic Messages Act 2007 requires.
Where it is stored
This website and its data are hosted in Sydney, Australia. Enquiries submitted through the contact form are stored and processed there.
Google Analytics data is processed by Google and may be held in the United States and other countries where Google operates.
This means some of your information is held outside New Zealand. Under IPP 12 we only send personal information overseas where the receiving party is subject to comparable privacy safeguards. Australia has privacy law broadly comparable to New Zealand's, and Google is bound by its data processing terms.
If you would rather your enquiry was not handled this way, phone us on 0800 150 803 instead.
How long we keep it
Enquiries that do not become work are deleted within twelve months. Client records are kept for seven years after the engagement ends, because that is what Inland Revenue requires for financial records. Analytics data is retained for fourteen months.
Cookies
A cookie is a small file a website stores in your browser. This site uses very few.
Necessary cookies. vf-digital-session and XSRF-TOKEN are set by our own software. They keep the contact form secure against cross-site request forgery and let the site function. They hold no personal information, and the site cannot work without them.
Analytics cookies. Google Analytics sets _ga and related cookies to tell one visitor from another across visits. These are not essential.
We do not run advertising pixels on this website. There is no Meta Pixel, no LinkedIn Insight Tag and no retargeting here. If that changes, this policy changes with it.
Turning them off. Every major browser lets you block or delete cookies in its settings. You can opt out of Google Analytics entirely with Google's browser add-on. Blocking analytics cookies will not affect how this site works for you.
Your rights
Under the Privacy Act 2020 you can ask us for a copy of any personal information we hold about you, and ask us to correct anything that is wrong. Email info@vfdigital.nz. We will respond within twenty working days, which is the limit the Act sets. There is no charge.
If you are not satisfied with how we have handled your information or your request, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909. You do not have to come to us first, though we would rather you did so we can put it right.
Security
The site runs over HTTPS. Access to client systems is limited to the people doing the work. We hold client credentials only where we need them, and we return or destroy them when an engagement ends.
No system is perfectly secure. If we ever have a privacy breach likely to cause serious harm, the Privacy Act requires us to notify both you and the Privacy Commissioner, and we will.
Changes
If this policy changes we will update the date at the top. Material changes will be signalled on the site rather than made quietly.
Contact
Corby Digital Group Limited, trading as VF - The Kapiti Digital Agency
Raumati Beach, Kapiti Coast, New Zealand
info@vfdigital.nz | 0800 150 803