This policy explains how Moustache Republic Limited (New Zealand) and Moustache Republic Pty Ltd (Australia) — together, "Moustache Republic", "we", "us" or "our" — collect, use, store and share personal information when you visit moustacherepublic.com or interact with us through the website.
We're an eCommerce technology consultancy based in Auckland and Sydney. We comply with the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988 (including the Australian Privacy Principles).
1. The information we collect
We collect personal information when you:Contact us through the website. When you submit a contact form, we collect your name, email address, company (if you give one), and the message you send us.
Subscribe to our newsletter or marketing communications. We collect your email address and any other details you choose to share when you sign up.
Visit the website. We use cookies and similar technologies to understand how visitors use the site. We explain this in section 5 below.We don't ask for sensitive information through the website, and we collect only what we need.
2. How we use your information
We use the personal information you give us to:Respond to your enquiry or request.
Send you the marketing communications you've subscribed to (you can opt out at any time).
Understand how visitors use our website so we can keep improving it.
Meet our legal and regulatory obligations.We do not sell your personal information.
3. Our lawful basis for collecting and using your information
Under the NZ Privacy Act 2020 and the Australian Privacy Principles, we collect and use personal information only where we have a lawful basis to do so. That basis is one of the following:Your consent — for example, when you subscribe to our newsletter or opt in to marketing cookies.
Performance of a contract or steps to enter one — for example, when you contact us about working together.
Our legitimate interests — for example, running and improving the website, and direct marketing to existing contacts where they would reasonably expect it.
A legal obligation — for example, retaining records we're required to keep by law.
4. Who we share your information with
We share your personal information with:Our team. Only the people inside Moustache Republic who need it to respond to you or to do their work.
Service providers. Trusted third parties who help us run our business — including our email, hosting, analytics and productivity platforms (see section 5 for the ones used on the website). These providers can only use your information for the purposes we instruct.
Legal and regulatory authorities. Where we are required to share information by law, or to protect our rights, property or safety, or that of others.We do not sell or rent your personal information to anyone.
5. Cookies and tracking technologies
Our website uses cookies and similar tracking technologies to understand how visitors interact with the site and to support our marketing activity.
Strictly necessary cookies
These are required for the website to function (for example, to remember your cookie preferences). They cannot be turned off.
Analytics cookies
We use Google Analytics 4 (GA4) to measure how the site is used — pages visited, time on site, general location (city-level), and the source you came from. The information GA4 collects is aggregated and helps us improve the site. You can read more about Google's data handling in Google's Privacy Policy.
Marketing cookies
We use Google Tag Manager to deploy marketing tags. Where you've consented, these tags may share information with our marketing partners (for example, to measure campaign performance or retarget visitors). Marketing cookies only fire if you've given consent through our cookie banner.
Managing cookies
You can manage or disable cookies at any time through your browser settings, or through our cookie banner. Blocking cookies may reduce the functionality of some parts of the site.
6. Direct marketing
If you've signed up to our newsletter, requested information from us, or otherwise consented to receive marketing from us, we'll only send communications you'd reasonably expect.
Every marketing email includes an unsubscribe link, and you can opt out at any time by clicking it or by contacting us using the details in section 12.
7. How we store and protect your information
We store personal information on cloud-hosted infrastructure operated by reputable providers, including Google Workspace and Notion.
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Those steps include access controls, encryption in transit, regular review of our security practices, and confidentiality requirements on our team and suppliers.
No system can be guaranteed completely secure. If you become aware of a security issue with our website, please contact us straight away using the details in section 12.
8. Sending your information overseas
Our service providers are global. As a result, your personal information may be stored or processed in countries outside New Zealand and Australia — including the United States, the European Union, the United Kingdom, and other countries where Google, Notion and similar providers operate.
Where personal information leaves New Zealand or Australia, we take reasonable steps to ensure it remains protected to a standard comparable to the NZ Privacy Act 2020 (Information Privacy Principle 12) and the Australian Privacy Principles (APP 8). This includes choosing providers who are bound by recognised data-protection frameworks and contractual safeguards.
9. How long we keep your information
We keep personal information only for as long as we need it for the purposes set out in this policy, or as long as we're required to by law.Contact-form enquiries: typically kept for two years from your last interaction with us, then deleted or de-identified.
Newsletter subscribers: kept until you unsubscribe, plus a short period to action the unsubscribe.
Analytics data: retained in line with the default retention settings of our analytics tools (currently 14 months in GA4).
10. Your rights
Under the NZ Privacy Act 2020 and the Australian Privacy Act 1988, you have the right to:Access the personal information we hold about you.
Correct any information that is inaccurate, out of date, incomplete or misleading.
Withdraw consent for any processing that was based on your consent.
Opt out of marketing communications at any time.
Complain about how we have handled your personal information (see section 13).To exercise any of these rights, contact us using the details in section 12. We will respond within 20 working days in New Zealand, or a reasonable period in Australia. There is no charge for making a request, although a reasonable fee may apply if a request is unusually large or repeated.
11. Children
Our website and services are not directed at children under 16, and we do not knowingly collect personal information from children. If you believe we've inadvertently done so, please contact us and we'll delete it.
12. Contact us
If you have any questions about this policy or how we handle your personal information, please contact our Privacy Officer:
Moustache Republic — Privacy Officer
Email: hello@moustacherepublic.com
New Zealand office
B:Hive, 72 Taharoto Road, Takapuna
Auckland 0622, New Zealand
0800 885 111
Australian office
320 Pitt Street
Sydney NSW 2000, Australia
+61 2 8317 3384
13. Complaints
If you have a complaint about how we've handled your personal information, please contact us first using the details in section 12 — we'll work with you to resolve it.
If you're not satisfied with our response, you can refer your complaint to:In New Zealand: Office of the Privacy Commissioner — privacy.org.nz · 0800 803 909
In Australia: Office of the Australian Information Commissioner — oaic.gov.au · 1300 363 99214. Changes to this policy
We may update this policy from time to time. When we do, we'll change the "Last updated" date at the top of this page. Material changes will be highlighted on this page, and where appropriate we'll notify subscribers directly.
.svg){kind=logo}