Privacy Policy

Last updated: March 2026

Version: 2026.3.4.V1

This Privacy Policy explains how Storm IMC Limited ("Storm IMC", "we", "our", or "us") collects, uses, stores and discloses personal information. Storm IMC Limited is a digital marketing agency based in Auckland, New Zealand (Company No. 4954199, NZBN: 9429041093528). This policy is governed by the Privacy Act 2020 (New Zealand) and its Information Privacy Principles (IPPs).

1.Scope of This Policy

This policy applies to personal information collected through our website (www.stormimc.co.nz), our enquiry and lead generation forms, our email communications, and our telephone lines.

Storm IMC also acts as a data processor for our clients — we host, manage and process data on their behalf as part of delivering digital marketing services. This policy does not cover how we handle data on our clients' instructions. If you are a user of one of our clients' websites or services, please refer to that client's own privacy policy.

2.What Personal Information We Collect

We may collect the following types of personal information:

• Identity and contact information — name, email address, phone number, job title, company name and business address
• Enquiry and correspondence data — messages submitted via our contact or lead generation forms, email correspondence, and records of phone calls
• Website behavioural data — pages visited, time on site, clicks, scroll depth, form interactions, downloads, device type, browser, operating system and approximate location (city/region level)
• Advertising interaction data — whether you have seen or clicked on one of our advertisements on Google, Meta (Facebook/Instagram) or other platforms
• Call data — phone numbers, call duration, call recordings and the marketing channel that prompted you to call
• Cookie and tracking identifiers — unique identifiers stored in cookies or similar technologies by our analytics and marketing platforms (see Section 5)

Providing personal information to us is voluntary. However, if you choose not to provide certain information, we may not be able to respond to your enquiry or provide you with relevant information about our services.

3.How We Collect Your Information

We collect personal information in the following ways:

• Directly from you when you complete a contact form, lead generation form, or subscribe to our email communications
• When you call a phone number listed on our website or in our advertising
• When you email us at our domain addresses
• Automatically through cookies, pixels and tracking technologies when you visit our website or interact with our online advertising (see Section 5)
• Through third-party platforms such as Google and Meta when you interact with our advertisements

4.Why We Collect Your Information

We collect and use personal information to:

• Respond to your enquiries and provide information about our services
• Send you marketing emails, newsletters, offers and updates where you have opted in or where we have a legitimate interest in doing so
• Measure and improve the performance of our website and advertising campaigns
• Build and serve targeted advertising audiences on Google and Meta platforms
• Understand how visitors use our website so we can improve the user experience
• Record and track inbound phone calls to measure marketing effectiveness
• Maintain accurate contact and business records
• Comply with our legal obligations

5.Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. Cookies are small files placed on your device that allow our systems and third-party platforms to recognise your browser and record certain information about your visit and behaviour.

We use the following categories of cookies:

• Essential cookies — necessary for the website to function and cannot be switched off
• Analytics cookies — help us understand how visitors interact with our website
• Marketing and advertising cookies — used to build advertising audiences and measure campaign performance
• Functionality cookies — remember your preferences to improve your experience

The specific tools and platforms that place cookies or tracking technologies on our website are:

Cookie consent: We are in the process of implementing a cookie consent banner on our website. Until this is in place, by continuing to use our website you acknowledge that cookies and the tracking technologies described above may be active. You can manage or disable cookies at any time through your browser settings, however doing so may affect the functionality of some parts of our website.

Opting out of Google tracking: You can manage Google's advertising preferences via Google Ad Settings, or opt out of Google Analytics via the Google Analytics Opt-Out Browser Add-on.

Opting out of Meta tracking: You can manage Meta's ad preferences via your Facebook Ad Preferences or through the Network Advertising Initiative opt-out page.

6.Email Marketing and ActiveCampaign

We use ActiveCampaign to manage our email marketing communications and contact database. If you submit an enquiry form or otherwise provide us with your email address, we may add you to our email list and send you relevant content, updates and offers.

ActiveCampaign uses a site tracking script that, once you have clicked a link in one of our emails, allows us to associate your subsequent website visits with your contact record. This enables us to send more relevant and timely communications.

You can unsubscribe from our marketing emails at any time by clicking the unsubscribe link in any email we send, or by contacting us directly at hello@stormimc.co.nz. Unsubscribing will not affect transactional or service-related communications.

ActiveCampaign stores contact data on servers located in the United States. By providing your email address, you consent to your information being stored and processed in the USA in accordance with ActiveCampaign's privacy policy.

7.Overseas Disclosure of Personal Information

Several of the tools and platforms we use involve the transfer of personal information to servers located outside New Zealand, primarily in the United States and the European Union. These include Google LLC, Meta Platforms Inc., Hotjar Ltd and ActiveCampaign LLC.

Under the Privacy Act 2020, we are required to take reasonable steps to ensure that any overseas recipient of personal information does not breach the Information Privacy Principles. We rely on the following safeguards:

• Use of platforms that maintain recognised data protection frameworks (including EU Standard Contractual Clauses and US Data Privacy Framework participation where applicable)
• Review of the privacy policies and data processing terms of our third-party providers before use
• Limiting the categories of personal data shared with third parties to what is necessary for the stated purpose

By using our website and submitting information to us, you acknowledge that your personal information may be transferred to and processed in countries outside New Zealand.

8.Who We Share Your Information With

We do not sell or rent your personal information. We may share it in the following circumstances:

• Third-party service providers — including the analytics, advertising and marketing platforms listed in Section 5, website hosting providers, and IT support partners, who process data on our behalf under confidentiality obligations
• Where required by law — including in response to a lawful request from a regulatory body, law enforcement agency or court order
• Business transfer — in the event that Storm IMC or substantially all of its assets are acquired by a third party, customer information will be among the transferred assets and we will notify affected individuals
• With your consent — where you have expressly agreed to a specific disclosure

We do not share personally identifiable information with third parties for their own marketing purposes without your consent.

9.Data Retention

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by law. Our general retention approach is:

• Enquiry and contact form data — retained for up to 2 years from the date of last contact, after which it is reviewed and deleted or archived
• Email marketing contacts — retained while you remain subscribed, or for up to 2 years following your last engagement, whichever comes first
• Website analytics data — retained in accordance with the default settings of each platform (GA4 default is 14 months; this can be adjusted in account settings)
• Call recordings — retained for up to 12 months unless required for a specific business or legal purpose

You may request deletion of your personal information at any time (see Section 11).

10.Data Security

We take reasonable steps to protect personal information from loss, unauthorised access, use, modification or disclosure. Security measures we use include:

• SSL/TLS encryption on our website
• Password-protected access to our website database and CRM systems
• Access to personal data limited to authorised employees and contracted service providers who need it to perform their role
• Use of reputable third-party platforms with their own security certifications and compliance programmes

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but will notify you and the Privacy Commissioner if we become aware of a privacy breach that poses a risk of serious harm, in accordance with our obligations under the Privacy Act 2020.

11.Your Rights

Under the Privacy Act 2020, you have the following rights in relation to your personal information:

• Right to access — you can request a copy of the personal information we hold about you
• Right to correct — you can ask us to correct any personal information that is inaccurate or out of date
• Right to deletion — you can request that we delete your personal information, subject to any legal obligations we have to retain it
• Right to opt out of marketing emails — you can unsubscribe at any time via the link in any marketing email or by contacting us directly
• Right to opt out of tracking and cookies — you can manage cookie preferences through your browser settings or the opt-out tools listed in Section 5

To exercise any of these rights, please contact us at hello@stormimc.co.nz or by post to 3 Argus Place, Hillcrest, Auckland 0627. We will respond to all requests within 20 working days in accordance with the Privacy Act 2020.

If you are not satisfied with our response, you have the right to make a complaint to the New Zealand Privacy Commissioner at www.privacy.org.nz.

12.Privacy Breach Notification

Under the Privacy Act 2020, Storm IMC is required to notify the Privacy Commissioner and affected individuals as soon as practicable if we become aware of a privacy breach that is likely to cause serious harm. We maintain internal procedures to identify, assess and respond to privacy breaches promptly.

If you believe your personal information held by us has been compromised, please contact us immediately at hello@stormimc.co.nz.

13.Third-Party Links

Our website may contain links to third-party websites. These sites have their own independent privacy policies and we have no responsibility or liability for their content or practices. We encourage you to review the privacy policy of any third-party site you visit.

14.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes, we will update the "Last updated" date at the top of this page.

Continued use of our website following the posting of changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

15.Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:

• Email: hello@stormimc.co.nz
• Phone: 09 281 5504
• Post: Storm IMC Limited, 3 Argus Place, Hillcrest, Auckland 0627, New Zealand

Storm IMC Limited is a registered New Zealand company (No. 4954199). This policy is governed by the Privacy Act 2020 (New Zealand). Our Privacy Policy can be found at www.stormimc.co.nz/privacy-policy.