Privacy statement

Who we are

Humphrey's Counter operates this catering ordering site. In this statement, "we" and "us" mean Humphrey's Counter.

You can find us at 10 Brandon Street, Wellington CBD, Wellington 6011.

This statement explains how we handle personal information, and it is written to meet the information privacy principles in the Privacy Act 2020.

What we collect, and why

Privacy Act 2020, IPPs 1–4

We only collect what we need to make your order and get it to you. You give us all of it directly, on the order form.

• Your name — so we know whose order it is and can call it out at the counter.
• Your email address — to send your confirmation and receipt.
• Your phone number — so we can reach you if something about the order needs sorting on the day.
• Your company or organisation, if you give it — to label the order for a workplace pickup.
• Your order notes, if you write any — allergies, access instructions, anything you want the kitchen to know.
• What you ordered, when you are collecting it, and what it cost.
• The result of your card payment, if you pay online — never your card number.
• The IP address of requests to this site, briefly, to stop the order form being abused, and a record of staff logins to our own dashboard.

Giving us information about other people

If your order notes mention someone else — a colleague's allergy, for example — please only include what is genuinely needed for us to make the food safely. We treat anything in that field as part of the order and it is erased with the rest of it.

Who else sees it

Privacy Act 2020, IPPs 11 and 12

Our kitchen and counter staff see your order so they can make it. Beyond that, your information is handled by the companies that run parts of this service for us. They act on our instructions and may not use your information for their own purposes.

This ordering system was built for us by Blurstate, who maintain it under contract and manage the database it runs on. That means Blurstate can access order information, including your contact details, when it is needed to run, maintain or fix the system. They do this on our behalf and on our instructions, may not use your information for anything else, and Humphrey's Counter remains responsible for it.

Most of them are based overseas, which means your information is held outside New Zealand. We rely on those providers being subject to privacy safeguards comparable to the Privacy Act, as IPP 12 requires.

• Supabase — Stores the order database, including your contact details. (Japan (Tokyo).)
• Vercel — Runs and serves this website. (United States and its global network.)
• Stripe — Takes card payments. Card numbers are entered on Stripe's own payment page and never reach us — we receive only the result of the payment. (United States, Ireland and Australia.)
• Resend — Delivers your confirmation email. (United States.)
• Apple, Google and Mozilla push services — Deliver the new-order alert to our own counter devices. These carry no customer details — only that an order arrived. (United States.)

What we don't do

We do not sell your information, and we do not share it with anyone for their own marketing. We do not send you marketing email unless you have asked us to — a confirmation about an order you placed is not marketing.

We do not use advertising or analytics trackers on this site.

Cookies and what your browser stores

This site sets no advertising or tracking cookies. Two things are stored in your own browser, and neither is sent anywhere:

• A saved draft of the order you are building, so you don't lose it if you close the tab or come back from the payment page. It is held on your device for 24 hours and then discarded, and you can clear it by clearing your browser's site data.
• A login cookie for staff, on staff devices only. It is required for the dashboard to work at all.

How long we keep it

Privacy Act 2020, IPP 9

We erase your name, email address, phone number, company and any order notes 2 years after your pickup date. What remains is the order itself — the date, what was made and what it cost — which we are required to keep for seven years as a business record under the Tax Administration Act 1994.

How we look after it

Privacy Act 2020, IPP 5

Orders are held in a database that is not reachable from the public internet — only our own server code can read it. The site is served over HTTPS. Our staff dashboard is password protected, sessions expire, and destructive actions are logged.

Card payments are handled entirely by Stripe on their own payment pages. We never see, hold or store your card number.

No system is perfect. If a breach happens that could cause you serious harm, we will notify you and the Office of the Privacy Commissioner, as Part 6 of the Privacy Act requires.

Seeing your information, and correcting it

Privacy Act 2020, IPPs 6 and 7

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong. Email The Privacy Officer at info@humphreyscounter.com and we will respond within 20 working days, which is the limit the Act sets.

There is no charge for a request. We may need to check who you are before we hand anything over — usually by replying to the email address the order was placed with.

If we can't correct something because we disagree about it, you can ask us to attach a statement of your view to the record, and we will.

Asking us to delete your details

You can ask us to erase your contact details from a past order at any time and we will, unless the order is still coming up or we are required to keep the record. Email info@humphreyscounter.com.

If you're not happy with how we've handled this

Please tell The Privacy Officer first at info@humphreyscounter.com — most things are quickest to fix directly. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner: privacy.org.nz, 0800 803 909, or PO Box 10094, Wellington 6143.