This Privacy Statement explains how Onyx Labs Limited (“we”, “us”, or “our”) collects, uses, stores, and shares personal information.
We are committed to complying with the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles (IPPs). Our Privacy Officer is Lane Robins. Contact details are at the end of this statement.
1. What Personal Information We Collect
Under the Privacy Act 2020, “personal information” means any information about an identifiable individual. When you visit our website, we and our third-party service providers may collect the following:
Information you give us directly:
- Your name, email address, phone number, and company name when you submit a contact or enquiry form
- The content of your message or enquiry
Information collected automatically:
- Your IP address and approximate location derived from it
- Device type, operating system, and browser type and version
- Pages visited on our site, time spent on each page, and your navigation path
- The URL of the website or link that referred you to our site
- Date and time of your visit
- Cookies and similar tracking identifiers (see Section 5)
- Advertising interaction data, including whether you clicked on one of our ads
We do not knowingly collect personal information from children under the age of 16.
2. How We Collect Your Information
2a. Directly From You
We collect information directly when you:
- Complete and submit a form on our website
- Contact us via email linked from the site
2b. Automatically
When you browse our site, information is collected automatically through our hosting and content delivery provider, website analytics tools, advertising and campaign tracking pixels, our enquiry management platform, a bot-detection service used to protect our forms, and cookies placed by these services (see Section 5).
3. Why We Collect Your Information
We only collect personal information for a lawful purpose connected to our website’s functions, and only to the extent necessary for that purpose (IPPs 1 and 2).
| Data | Purpose |
|---|---|
| Form submission data (name, email, phone, message) | To respond to your enquiry or request |
| IP address and server logs | To ensure website security, performance, and uptime |
| Analytics data (pages visited, session data) | To understand how visitors use our site and improve the user experience |
| Advertising interaction data | To measure the effectiveness of our marketing campaigns |
| Bot-detection interaction data | To prevent automated bot submissions on our forms |
| Cookies | To enable site functionality and support analytics and advertising tools |
4. Third-Party Service Providers
We use third-party services on our website for hosting and content delivery, website analytics, enquiry management, advertising and campaign measurement, and form security. Each service may receive personal information as part of its operation. All of these providers are headquartered in the United States of America.
Under IPP 12 of the Privacy Act 2020, we may only send personal information overseas if the recipient provides comparable privacy protections. Each provider operates under their own privacy policy and data handling standards, and we have reviewed these to satisfy ourselves that they offer appropriate protections.
Hosting and content delivery: Our website is hosted on infrastructure that records server logs including IP addresses, HTTP request headers, and related metadata. This provider also supplies DDoS protection and security services.
Website analytics: We use analytics software to track page views, session data, and user behaviour. IP addresses are anonymised by default. You can opt out of this tracking through your browser or by using the opt-out tool provided by the analytics service.
Enquiry management: Contact form submissions — including your name, email address, phone number, and message — are received and stored by our CRM platform, which also tracks website visits and engagement. You can opt out of this tracking via the platform’s cookie policy page.
Advertising and campaign measurement: We use tracking pixels from social media advertising platforms to measure the performance of our campaigns and build retargeting audiences. These pixels receive IP address, browser data, a unique identifier, and advertising interaction data. You can manage your advertising preferences through each platform’s ad settings.
Form security: We use a bot-detection service to protect our contact forms from automated submissions. This service analyses interaction patterns — including mouse movements and timing — and is strictly necessary for form security. It cannot be disabled without disabling the form itself.
5. Cookies & Tracking Technologies
Our website uses cookies and similar technologies. A cookie is a small text file placed on your device when you visit a website.
Cookies We Use
| Category | Type | Purpose | Can You Opt Out? |
|---|---|---|---|
| Hosting and security | Strictly necessary | Security and bot detection | No — required for site security |
| Website analytics | Analytics | Tracks visits and page behaviour | Yes |
| Form security | Strictly necessary | Prevents automated form submissions | No — required for form security |
| Enquiry management | Analytics / functional | Tracks visits and identifies form submitters | Yes |
| Advertising platforms | Advertising | Tracks ad interactions and conversions | Yes |
Managing Your Cookie Preferences
- Cookie consent tool: When you first visit our site, you will be presented with a cookie consent notice. You can accept or decline non-essential cookies at that point.
- Browser settings: You can block or delete cookies through your browser settings. Note that disabling certain cookies may affect site functionality.
- Analytics opt-out: Use the opt-out tool provided by your analytics service, or disable analytics cookies via the consent notice.
- Advertising opt-out: Visit the ad preference settings for any social media platforms where you have an account.
- Enquiry management opt-out: Use the cookie policy opt-out provided by our CRM platform.
6. How We Store and Protect Your Information
We take reasonable steps to protect personal information collected through our website from loss, unauthorised access, modification, or disclosure (IPP 5).
- All data transmitted between your browser and our website is encrypted using TLS/HTTPS.
- Our website is hosted on infrastructure that provides enterprise-grade DDoS protection and security.
- Form submissions are stored in our enquiry management platform, which is access-controlled and secured.
- Each third-party provider referenced in Section 4 operates their own security controls. We have reviewed these controls and consider them appropriate.
7. How Long We Keep Your Information
We retain website-collected personal information only for as long as necessary for the purpose it was collected (IPP 9).
| Data | Retention Period |
|---|---|
| Contact form submissions (name, email, message) | Retained in our CRM while the contact relationship is active; deleted on request or during periodic data reviews |
| Website analytics data | Up to 14 months, as configured in our analytics settings |
| Server logs | Up to 30 days, subject to our hosting provider’s data retention settings |
| Advertising pixel data | Governed by the respective platform’s own retention policies |
8. Overseas Disclosure
All third-party services we use for this website are based in the United States of America. By using our website, you acknowledge that your personal information may be transferred to, stored in, and processed in the USA or other countries where those providers operate.
We take reasonable steps to ensure each provider offers comparable privacy protections to those required by the New Zealand Privacy Act 2020 (IPP 12). Each provider’s privacy policy sets out how they handle and protect personal data.
9. Your Rights
Under the Privacy Act 2020, you have the following rights in relation to personal information we hold about you from your use of this website.
Right to access (IPP 6): You can ask us whether we hold personal information about you and request access to it. We will respond within 20 working days.
Right to correct (IPP 7): If you believe information we hold about you is inaccurate or incomplete, you can ask us to correct it.
Right to object to direct marketing: If you submitted your details via our contact form and later receive marketing emails from us, you can unsubscribe at any time using the unsubscribe link in any email, or by contacting us directly.
Right to complain: If you are not satisfied with how we have handled your personal information, you may complain to the Office of the Privacy Commissioner at privacy.org.nz or by calling 0800 803 909.
10. Changes to This Statement
We may update this statement from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this statement periodically. The current version will always be available at https://onyxlabs.co.nz.
11. Contact Us
If you have any questions about this statement, want to access or correct information we hold about you, or wish to raise a privacy concern, please contact our Privacy Officer:
Lane Robins — Privacy Officer, Onyx Labs Limited Email: lane@onyxlabs.co.nz Website: onyxlabs.co.nz
If your concern is not satisfied, you may contact the Office of the Privacy Commissioner:
- Website: privacy.org.nz
- Phone: 0800 803 909
- Email: enquiries@privacy.org.nz
- Post: PO Box 10094, The Terrace, Wellington 6143
Last updated on 1st April 2026.