Privacy policy

 

TCG Mana Vault Limited, trading as TCG Mana Vault, is responsible for the personal information described in this policy. We are a small owner-operated New Zealand online store and use Shopify and a limited number of service providers to run the website, take payments, fulfil orders and operate Mana Vault Rewards.

This policy explains what personal information we collect, where it comes from, why we use it, and the choices available to you. We handle personal information in accordance with the New Zealand Privacy Act 2020.

1. Information we collect

Depending on how you use the store, we may collect:

- your name, email address, phone number, billing address and delivery address;
- account details and preferences;
- order, payment status, refund, cancellation and delivery information;
- products viewed, placed in your cart or wishlist, or purchased;
- Mana Vault Rewards progress, eligible spend, reward codes and reward status;
- messages, enquiries, reviews or other information you send us;
- marketing preferences;
- device, browser, IP address, cookie and website usage information; and
- information used to prevent fraud, protect accounts and keep the store secure.

We do not ordinarily receive or store your complete payment-card number. Payments are handled by Shopify and the payment providers offered at checkout.

2. Where information comes from

We collect information:

- directly from you when you browse, create an account, place an order, join marketing, contact us or otherwise provide it;
- automatically through Shopify, cookies and similar store technology; and
- indirectly from service providers involved in your transaction, such as Shopify, payment providers, Starshipit, delivery carriers, fraud-prevention services and our Mana Vault Rewards service.

Where information is collected indirectly, this policy gives notice of that collection and its purposes. We may not give a separate notice where an exception in the Privacy Act applies.

3. Why we use information

We use personal information where reasonably necessary to:

- operate the website and customer accounts;
- process payments, orders, pre-orders, returns, refunds and cancellations;
- pack, dispatch, track and deliver orders;
- provide customer support and respond to privacy requests;
- run wishlists and Mana Vault Rewards;
- send order, account, delivery and service messages;
- send marketing you have chosen to receive and measure its effectiveness;
- understand and improve the store and customer experience;
- detect fraud, misuse, security threats and technical problems;
- keep tax, accounting and business records; and
- comply with law, enforce our terms and resolve disputes.

4. Mana Vault Rewards

Mana Vault Rewards uses the customer identity attached to an eligible paid online order, eligible product spend, refunds, cancellations, reward progress and discount-code status.

Guest orders do not earn Vault Keys. The programme excludes shipping, tax, gift cards and test orders from eligible spend. Refunds and cancellations adjust reward progress, and an unused reward may be deactivated if it is no longer earned.

Rewards information is held in an app-owned Shopify customer record and in the private loyalty service used to calculate and recover balances. The service is hosted using third-party cloud infrastructure. We use this information only to operate, support, secure and reconcile the programme and related orders.

5. Who we share information with

We disclose only the information reasonably needed to organisations that help us operate the store, including:

- Shopify, which hosts the store and customer accounts and supports checkout, payments and ecommerce functions;
- payment and fraud-prevention providers;
- Starshipit, delivery carriers and other fulfilment providers;
- the cloud hosting and technical services supporting Mana Vault Rewards;
- email, analytics, advertising, review or customer-support providers that we actually enable;
- professional advisers, insurers, accountants or authorities where reasonably required; and
- another owner or operator if the business is reorganised or sold, subject to appropriate privacy safeguards.

We may also disclose information when you direct or authorise us to do so, or where disclosure is permitted or required by law. We do not sell customer lists.

Shopify also processes information under its own consumer privacy terms. You can read Shopify’s Consumer Privacy Policy at https://www.shopify.com/legal/privacy/app-users.

6. Overseas processing

Shopify, cloud hosting, payment, delivery, analytics and other providers may process or store information outside New Zealand. Where the Privacy Act requires it, we take reasonable steps to ensure an overseas recipient provides comparable safeguards, is otherwise covered by the Act, or we obtain informed authorisation.

Using an overseas provider to process information on our behalf is not always treated as an overseas disclosure under the Privacy Act, but we still require providers to handle the information for the services they supply to us.

7. Cookies and marketing

Shopify and enabled services use cookies and similar technology to keep the store working, remember choices, understand store use, prevent fraud and, where enabled, measure or personalise marketing.

You can manage cookies through your browser and any privacy controls made available on the store. Blocking essential cookies may stop parts of checkout or your account from working.

You can unsubscribe from promotional email using the link in the message or by contacting us. We may still send non-promotional messages about your orders, account, rewards, security or privacy requests.

8. Security, retention and privacy breaches

We use reasonable administrative and technical safeguards appropriate to a small online retailer and rely on reputable providers for core ecommerce, payment and delivery functions. No system is completely secure, so please do not send payment-card details or other sensitive information by ordinary email.

We keep personal information only for as long as reasonably required for the purpose for which it may lawfully be used, including providing accounts and rewards, handling disputes, and meeting tax, accounting and legal obligations. Different records may have different retention periods. We securely delete or de-identify information when it is no longer required, where reasonably practicable.

If a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless a lawful exception applies.

9. Access and correction

You may ask whether we hold personal information about you, request access to it, or ask us to correct it. We may need to verify your identity before responding. Privacy Act grounds may sometimes allow or require us to withhold information, and we will explain our decision where required.

To make a request, email support@tcgmanavault.com.

10. Children

The store is not directed specifically at children. If a person under 18 places an order, they should do so with the involvement and permission of a parent or guardian. If you believe a child has provided personal information inappropriately, contact us.

11. Questions and complaints

Please contact us first so we can try to resolve a privacy question or complaint directly:

Email: support@tcgmanavault.com
Privacy Officer: Owner, TCG Mana Vault Limited  
Location: Auckland, New Zealand

You may also complain to the New Zealand Office of the Privacy Commissioner at https://www.privacy.org.nz/.

12. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version and its “last updated” date will be posted on the store. Material changes will not be applied retrospectively where doing so would be unfair or unlawful.