Privacy Policy

This policy is issued by Eastward Digital ("Eastward", "we", "us") — the trading name of Bradley Cryer, a sole trader (NZBN 9429053782199) operating from 2 Hadfield Terrace, Bluff Hill, New Zealand — and applies when people visit Eastward websites, make enquiries, become clients, use an Eastward-operated portal or system, interact with content or otherwise communicate with Eastward. Client-controlled personal information inside a system built for a client may be governed primarily by that client’s privacy obligations.

• Names, roles, business names and contact details.
• Enquiry, discovery, proposal, contract, project and support information.
• Billing and transaction references.
• Content, files, brand assets and project access information supplied by a client.
• Website/device information where analytics or security tools are used.
• Communications, feedback, approvals and support records.

For enquiries, project delivery, account administration, security, support, service improvement, legal compliance and other purposes that are connected with the reason the information was collected or are otherwise authorised by law.

Information may be supplied directly through forms, email, meetings, project tools or client systems, or collected automatically through approved website, analytics and security services.

Eastward may use appropriate employees, contractors, advisers, payment providers, hosting/cloud providers, domain/email providers, analytics/security services and other suppliers where reasonably necessary. Eastward does not sell personal information.

Eastward uses a small number of established overseas providers to deliver its services: Google Cloud/Firebase (hosting, data storage and authentication, hosted in Australia), Twilio SendGrid (transactional email delivery, United States) and Google Maps Platform (address lookup during onboarding, United States). Each provider processes information under its own security and data protection commitments, and Eastward shares only the information reasonably necessary for that provider to perform its function.

Eastward uses reasonable technical and organisational safeguards — including access controls, encrypted storage and restricted third-party access — and retains personal information only for as long as there is a lawful business, contractual, security or record-keeping need, including the retention periods required for financial and contractual records under New Zealand law (generally up to seven years).

Individuals may request access to or correction of personal information held about them, subject to the Privacy Act 2020 and any lawful grounds for withholding information.

Eastward's own systems do not use advertising or tracking cookies, and no third-party analytics are active on Eastward's internal systems. Where a project delivered to a client includes analytics or similar tools (for example Google Analytics or Search Console), those operate as part of that client's own website or system, not Eastward's, and are covered by that project's own privacy settings.

Where Eastward processes personal information on behalf of a client, responsibilities should also be documented in the relevant project agreement, privacy schedule or system terms.

Eastward will assess privacy breaches under the Privacy Act 2020. A breach that has caused or is likely to cause serious harm may require notification to the Office of the Privacy Commissioner and affected people as soon as practicable, subject to the Act’s exceptions. Privacy concerns should be raised with Eastward first at info@eastward.co.nz.

This policy's effective date is shown above. Eastward may update this policy from time to time; material changes will be communicated directly to active clients where appropriate, and continued use of Eastward's services after a material change constitutes acceptance of the updated policy.