Mangawhai Directory

Privacy Policy

Last updated: 19 August 2026.

Sanderson Howe Limited (NZ company number 8196168), trading as Mangawhai Directory (“we”, “us”, “our”), operates mangawhaidirectory.co.nz. This policy explains what personal information we collect when you use the site, why, and the rights you have under the Privacy Act 2020.

We comply with the Information Privacy Principles (IPPs) in the Privacy Act 2020, including IPP 3A, which since 1 May 2026 has applied where an agency collects personal information about someone from a source other than that person. Most of what we hold about listed businesses is collected indirectly — see When a business is listed for how we handle that. If something here is unclear, contact us — details at the bottom of the page.

Who we are

Mangawhai Directory is a small, locally-operated business directory based in Mangawhai, Northland, New Zealand, owned and operated by Sanderson Howe Limited. The site lists local businesses for community discovery; we do not run user accounts, forums, or behavioural advertising.

What we collect, and why

When you browse

The site is hosted on GitHub Pages (GitHub, Inc., United States). Like any web host, GitHub records standard request information — IP address, user agent, page requested, timestamp — for security and abuse prevention. Those logs are GitHub’s, not ours: we do not receive them, cannot search them, and do not use them to build a profile of you. Their retention is governed by GitHub’s privacy statement.

Website analytics (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand which pages and categories are useful, how people navigate the site, and where to improve.

  • GA4 sets cookies (named _ga, _ga_*) that hold a randomly generated identifier for your browser, plus aggregate browsing events. The identifier does not contain your name or email, but it is persistent — it lets us recognise the same browser across visits — so we treat it as personal information.
  • GA4 does not store individual IP addresses. IPs are used only transiently for coarse-grained geolocation (e.g. region of New Zealand) and discarded.
  • GA4 data is processed by Google LLC (United States) on Google’s global infrastructure — see Overseas storage and processing below.
  • We have set the GA4 user-data retention period to its minimum (2 months).

You can opt out of Google Analytics on every site you visit by installing the Google Analytics Opt-out Browser Add-on. You can also disable cookies in your browser settings — analytics cookies do not affect site function.

Display advertising on this site

Some pages carry paid display advertisements. We sell ad slots directly; we do not use behavioural ad networks, retargeting, or third-party ad pixels. Each ad is a static image hosted on our own infrastructure with a click-through link.

We do measure whether ads are seen and clicked, so we can report performance to advertisers. When an ad comes into view or is clicked, we send an event to Google Analytics 4 recording which ad it was, which slot it sat in, the advertiser’s name, and the link’s destination — together with the same GA4 browser identifier described above. We do not build a profile of you, and advertisers receive totals only, never information about individual visitors.

Clicking an ad takes you to that advertiser’s website, where their privacy policy applies (not ours).

If we ever change this — for example, by introducing a third-party ad server — we will update this policy first.

When you contact us

Our contact form is operated for us by Static Contact (staticcontact.com), a third-party form-to-email service. When you submit the form, your name, email address and message are sent to Static Contact’s servers, which forward them to us by email and keep a copy in their own archive for up to 90 days. Those servers may be located outside New Zealand. The contact page also loads a small anti-spam script from Static Contact.

We use what you send us only to respond to you and to keep a record of the enquiry. We keep the email in our own records for up to 12 months and then delete it. We do not pass enquiry messages on to listed businesses unless you ask us to.

If you would rather not use a third-party form, email us directly at mangawhaidirectory@gmail.com.

When a business is listed

Listings are compiled by us, not submitted by the businesses. We gather them from information that is already publicly published — the business’s own website or social page, and public directories, listings, articles and community websites covering the Mangawhai area. Where a listing includes a person’s name, phone number or email address, that information was already published somewhere publicly accessible.

Because we collect this information from sources other than you, IPP 3A applies. We rely on the exception in IPP 3A for publicly available information. We do not verify listings with the business before publishing, so details may be out of date — ask us to re-check a listing at any time.

If you are named on a listing and would like it corrected or removed, contact us. We will remove or correct personal information (your name, phone number, email address or home address) within 5 working days, and you do not need to give a reason. See Your rights.

Cookies and similar technologies

The site uses two categories of cookies:

  • Strictly necessary — none. The directory is a static site that does not require cookies to function.
  • Analytics — set by Google Analytics 4 (_ga, _ga_*).

We do not use advertising or tracking cookies beyond GA4. Most browsers let you block, delete or restrict cookies; doing so will not affect your ability to use the directory.

How we share your information

We share information only with:

  • Google LLC — as our analytics provider (data processor). Google’s privacy policy and data-handling for GA4 apply.
  • GitHub, Inc. (United States) — our host. The directory is built from files stored in a GitHub repository and served by GitHub Pages, so listing information, including any names and contact details in a listing, is held there.
  • Static Contact — our contact-form provider, as described above.
  • Our email provider — to respond to your enquiries. Providers process information on our behalf, under contractual confidentiality obligations.

We do not sell, trade, or rent personal information to third parties for marketing purposes. We do not pass enquiry messages on to listed businesses unless you ask us to.

Overseas storage and processing

Some of the providers above — Google, GitHub and our contact-form provider — store and process information on servers outside New Zealand, including in the United States. Privacy protections in those countries may differ from New Zealand’s.

Where a provider only stores or processes information on our instructions and not for its own purposes, the Privacy Act treats that information as still held by us. Where a transfer is a disclosure under Information Privacy Principle 12, we rely on the contractual safeguards those providers are bound by — Google’s standard data processing terms and equivalent measures with our other suppliers — which require protection comparable to the Privacy Act.

How long we keep information

  • Server logs: held by GitHub under its own retention policy — we do not hold them.
  • Google Analytics 4 user data: 2 months (Google’s minimum retention).
  • Contact-form messages: up to 12 months from the date of receipt in our own records, then deleted; up to 90 days in Static Contact’s archive.
  • Listing data: for as long as the listing is published. When a listing is marked closed or removed, we delete the contact details (phone, email, address, social links) within 3 months and keep only the business name and the fact that it is no longer listed. On request, we’ll remove a listing within a reasonable time.

How we keep information secure

We take reasonable steps to protect personal information against loss, unauthorised access, modification, disclosure or other misuse, in line with IPP 5. The site is served over HTTPS; access to administrative tools is restricted; supplier contracts include security obligations.

In the event of a serious privacy breach (a “notifiable breach” under Part 6 of the Privacy Act 2020), we will notify the Office of the Privacy Commissioner and any affected individuals as soon as practicable.

Your rights

Under the Privacy Act 2020 you have the right to:

  • Access the personal information we hold about you (IPP 6).
  • Correct information you believe is inaccurate or incomplete (IPP 7).
  • Request deletion of information we hold about you. We’ll do that unless we’re legally required to retain it.

To exercise any of these rights, email us at the contact details below. We’ll respond within 20 working days, as required by the Act. We may ask for proof of identity before releasing or changing personal information.

Children

This site is intended for a general adult audience (business listings). We do not knowingly collect personal information from children under 16. If you believe a child has supplied personal information through our contact form, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be flagged at the top of the page; the “Last updated” date above always reflects the current version.

Contact us — and complaints

For any privacy question, access request, correction request, or complaint, contact us first:

  • Privacy Officer: the Director of Sanderson Howe Limited is our Privacy Officer for the purposes of section 201 of the Privacy Act 2020.
  • Email: mangawhaidirectory@gmail.com
  • Post: Sanderson Howe Limited, 59a Jack Boyd Drive, Mangawhai Heads, Kaiwaka, New Zealand
  • Or via the contact page

If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner — the independent regulator under the Privacy Act 2020: