1. Who we are
Mangaroa Farms Limited is a non-profit limited company wholly owned by the Biome Trust, based at 108 Whitemans Valley Road, Upper Hutt 5371, New Zealand (Farm Shop / Kete Kai at 98 Whitemans Valley Road). For anything in this policy, contact us at welcome@mangaroa.org.
2. What this policy covers
This policy covers our public websites and services: mangaroa.org and its subdomains, including events.mangaroa.org, stories.mangaroa.org, visit.mangaroa.org, our online shop, and ordering at meat.mangaroa.org — plus our newsletter, event ticketing, volunteer and programme applications, and farm shop orders.
Our internal team tools (which use Google Sign-In) are covered by a separate, more specific policy: the Internal Tools Privacy Policy.
3. Information we collect
Information you give us
- Contact details — name, email address, and phone number when you email us, sign up to our newsletter, or fill in a form.
- Orders and tickets — name, contact details, delivery address, and order details when you buy from the farm shop, order meat online, or purchase event tickets.
- Applications — information you submit when applying for volunteering, internships, residencies, or community programmes, including anything you attach (such as a CV or portfolio).
- Submissions and feedback — event listings you submit, feedback forms, and messages on social media.
Information collected automatically
- Analytics — we use privacy-friendly, cookie-less analytics (Umami) and Vercel Analytics to understand page traffic in aggregate.
- Session insights — on some pages we use Microsoft Clarity, which records anonymised interactions (clicks, scrolling, heatmaps) to help us improve usability.
- Security signals — our forms use Cloudflare Turnstile to block bots; it evaluates technical browser signals instead of asking you to solve puzzles.
- Cookies — our main site (Squarespace) and shop (Shopify) set functional cookies, e.g. to remember your cart.
- Server logs — standard technical logs (IP address, browser type, pages requested) kept by our hosting providers.
Payment information
Payments are processed by Stripe and Shopify. We never see or store your full card details — they go directly to the payment provider.
4. How we use your information
- To process and fulfil your orders and ticket purchases, and to tell you about changes to events you're attending.
- To respond to your messages and provide customer support.
- To assess and respond to applications for volunteering, internships, residencies, and programmes.
- To send our newsletter and updates — only if you've signed up, and you can unsubscribe at any time using the link in every email.
- To run paid advertising through platforms such as Facebook and Instagram (Meta).
- To understand how our websites are used and make them better.
- To keep our websites secure and prevent fraud and abuse.
5. Who we share it with
We never sell your personal information. We share it only with the service providers that run our websites and operations, who process it on our behalf:
- Airtable — stores form submissions, applications, and event data.
- Klaviyo — sends our newsletter and marketing email.
- Resend — delivers transactional email (e.g. confirmations).
- Shopify & Stripe — run the shop, ticketing, and payments.
- Vercel & Squarespace — host our websites.
- Cloudflare — provides security and bot protection.
- Meta — for advertising to audiences on Facebook and Instagram.
- Clerk, Supabase & Google — sign-in for our staff and internal tools (see the Internal Tools Privacy Policy).
We may also disclose information where the law requires it.
6. How long we keep it
- Order records — kept as required for accounting and tax purposes (up to 7 years in New Zealand).
- Newsletter subscriptions — until you unsubscribe.
- Applications — for the application round and a reasonable period afterwards.
- Everything else — only as long as we need it for the purpose we collected it.
7. Security
All our websites are served over HTTPS, and we limit access to personal information to the team members who need it. No internet service can promise perfect security, but we take reasonable technical and organisational measures to protect your information.
8. Your rights
Under the New Zealand Privacy Act 2020 you have the right to ask for a copy of the personal information we hold about you, and to ask us to correct or delete it. Email welcome@mangaroa.org and we'll respond promptly. Note that once information has been shared with a third-party platform (e.g. for advertising), we can't guarantee its deletion from that platform's systems — though we'll pass on your request.
If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
9. Children
Our websites are intended for general audiences and we don't knowingly collect personal information from children online. Photography and media involving tamariki at the farm is handled under our on-farm consent practices.
10. Third-party links
Our websites link to third-party sites. We're not responsible for their privacy practices — please review their policies.
11. Changes to this policy
When we make material changes we'll update the date at the top of this page and, where appropriate, let you know by email or a notice on the website.
12. Contact
Questions or concerns about your personal information: welcome@mangaroa.org · Mangaroa Farms Limited, 108 Whitemans Valley Road, Upper Hutt 5371, New Zealand.