Privacy policy

Last updated: 21 August 2026

Marula Distributions Limited, trading as MannaBrew NZ ("we", "us", "our"), operates this store and website, including all related content, features, tools, products and services (the "Services"). Our store is powered by Shopify.

This Privacy Policy explains how we collect, use, disclose and protect your personal information. We are an "agency" under the New Zealand Privacy Act 2020 and we handle personal information in accordance with the Information Privacy Principles (IPPs) in that Act. Where you are located in the European Economic Area or the United Kingdom, additional rights under the GDPR or UK GDPR may also apply.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to personal information.

1. Personal information we collect

"Personal information" means information about an identifiable individual. Depending on how you use the Services, we may collect:

  • Contact details — name, billing address, shipping address, phone number, email address.
  • Payment information — payment card and financial account details, transaction details, form of payment, payment confirmations. Card details are processed by our payment providers; we do not store full card numbers.
  • Account information — username, password, preferences and settings.
  • Transaction information — items viewed, added to cart or wishlist, purchased, returned, exchanged or cancelled, and your order history.
  • Communications — the content of your emails, calls, support enquiries, and product reviews.
  • Device and usage information — device, browser and network details, IP address, unique identifiers, and how you navigate the Services, collected through cookies and similar technologies.

2. Why we collect it and how we use it

We collect personal information for the following purposes, and will not use it for an unrelated purpose without your authorisation or where the Privacy Act permits:

  • Providing the Services — processing and fulfilling orders, arranging shipping, handling returns, exchanges and refunds, managing your account, enabling reviews, and responding to you.
  • Improving the Services — understanding how the Services are used and tailoring product recommendations.
  • Marketing — sending you promotional emails or messages where you have consented. Every commercial message we send identifies us as the sender and includes a working unsubscribe link, as required by the Unsolicited Electronic Messages Act 2007. You can opt out at any time; we will still send transactional messages about your orders.
  • Security and fraud prevention — authenticating accounts, securing payments, and detecting or investigating fraudulent, unsafe or unlawful activity.
  • Legal compliance — meeting our obligations under the Privacy Act 2020, Consumer Guarantees Act 1993, Fair Trading Act 1986, tax and food safety law, and responding to valid legal process.

Providing your personal information is voluntary, but we may be unable to process your order or provide the Services without it.

3. Where we collect it from

Directly from you; automatically through the Services and cookies; from our service providers acting on our behalf; and from partners or other third parties (for example, payment or fraud-screening providers). Where we collect personal information about you from someone other than you, we will tell you as required by IPP 3A.

4. Who we disclose it to

We may disclose personal information to:

  • Shopify and other service providers who act on our behalf — hosting, payment processing, analytics, customer support, cloud storage, fulfilment, shipping, and review collection.
  • Marketing partners, where you have consented, to deliver relevant advertising.
  • Third parties you direct us to, such as couriers or social login providers.
  • Others where required or permitted by law, including in connection with a business transaction, to enforce our terms, or to protect our rights or the rights of others.

We do not sell your personal information.

5. Sending information overseas (IPP 12)

The Services are hosted by Shopify, and some of our service providers store or process personal information outside New Zealand, including in the United States, Canada, Ireland and Australia. Before disclosing personal information to an overseas recipient we take reasonable steps to satisfy ourselves that the recipient is subject to safeguards comparable to those in the Privacy Act 2020, whether through contractual protections, binding corporate rules, or the recipient being subject to comparable privacy law.

Where we transfer personal information out of the EEA or the UK, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses, or transfer to a country determined to provide an adequate level of protection.

6. Relationship with Shopify

The Services are hosted by Shopify, which collects and processes information about your use of the Services in order to provide and improve them. Information you submit is transmitted to Shopify and may be shared with third parties located outside New Zealand. We also use Shopify enhanced features that draw on data about your interactions with our store, other merchants, and Shopify itself. In those circumstances Shopify is responsible for processing your personal information and for responding to requests about that processing. See the Shopify Consumer Privacy Policy and the Shopify Privacy Portal at https://privacy.shopify.com/en.

7. Storage, security and retention

We take reasonable safeguards to protect personal information against loss, misuse and unauthorised access, disclosure or alteration. No system is perfectly secure, and information sent to us over the internet may not be secure in transit — please don't send sensitive information through unsecured channels.

We keep personal information only for as long as it is needed for the purposes set out in this policy, or for as long as we are required to keep it by law (for example, tax records must be retained for seven years). We then securely delete or de-identify it.

8. Privacy breaches

If we experience a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, as required by the Privacy Act 2020.

9. Your rights

Under the Privacy Act 2020 you have the right to:

  • Access the personal information we hold about you (IPP 6).
  • Request correction of information that is inaccurate, incomplete, misleading or out of date (IPP 7). If we decline to correct it, you may ask us to attach a statement of the correction sought.

We will respond to an access or correction request as soon as reasonably practicable and no later than 20 working days after we receive it. We may need to verify your identity first. There is normally no charge.

You may also manage your marketing preferences at any time using the unsubscribe link in our emails or by contacting us.

If you are in the EEA or UK, you may additionally have rights to erasure, portability, restriction and objection. Those rights come from the GDPR or UK GDPR rather than New Zealand law and apply only where that legislation covers your information.

We will not treat you differently for exercising any of these rights.

10. Children

The Services are not intended for children, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has given us personal information, contact us and we will delete it.

11. Third-party links

The Services may link to websites operated by others. We are not responsible for their privacy practices or content, and a link is not an endorsement. Review their policies before providing information to them.

12. Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer using the details below — we will investigate and respond.

If you are not satisfied with our response, you may complain to:

Office of the Privacy Commissioner
Phone: 0800 803 909
Website: www.privacy.org.nz
Post: PO Box 10094, Wellington 6143

13. Changes to this policy

We may update this Privacy Policy to reflect changes to our practices or for legal or operational reasons. We will post the revised policy here, update the "Last updated" date, and give notice where required by law.

14. Contact us

Privacy Officer
MannaBrew NZ
Marula Distributions Limited
686 Paradise Valley Road, RD 2, Rotorua, 3072, New Zealand

Email: contact@mannabrew.co.nz
Phone: +64 20 4020 4311