Your data,
handled with care.

This Privacy Policy explains how Loafino collects, uses, stores, and protects personal information when you visit our bakery website, place orders, create an account, join our mailing list, participate in promotions, or contact customer support. Loafino operates at 86 Hillside Road, South Dunedin, Dunedin 9012, New Zealand, baking bread and pastries for local customers and visitors. We process personal data to fulfil orders, communicate about your purchases, improve our products, meet legal obligations, and keep our business secure. The privacy contact for requests and questions is [email protected], and you may also reach us at +6434555129. Payment processors, delivery partners, and email providers maintain their own privacy notices for data they handle on their systems.

Information we collect includes details you provide directly, such as your name, email address, phone number, delivery or billing address, order notes, allergy or dietary messages, account login credentials, feedback, and competition entries. When you pay online, card details are typically processed by our payment partner; we receive confirmation tokens, amounts, and fraud signals rather than full card numbers. We may collect business details for wholesale accounts. Automatically collected data can include IP address, browser type, device identifiers, pages viewed, referral source, approximate location derived from IP, and cookies as described in our Cookie Policy. In-store purchases linked to loyalty programmes may combine till receipts with your profile when you identify yourself.

We use personal information to accept and prepare orders, arrange pickup or delivery, send transactional messages, respond to enquiries, manage accounts, prevent fraud, conduct internal reporting, and comply with tax and food safety record-keeping where required. With your consent or where law allows, we may send news about seasonal bakes, events, and offers; you can unsubscribe at any time using the link in emails or by contacting support. We do not sell personal information lists to unrelated marketers. Staff and contractors access data only when needed for their role and under confidentiality expectations. Data may be stored on secure servers in New Zealand or with reputable providers that contractually protect information.

Retention periods depend on the purpose. Order and invoice records may be kept for years as required by tax and accounting rules. Marketing consent logs are kept to demonstrate compliance. Support tickets are archived for quality review for a limited time unless deletion is requested and no legal hold applies. When data is no longer needed, we delete or anonymise it where feasible. We implement reasonable technical and organisational measures including access controls, encrypted connections for online forms, and training for staff who handle customer details. No method of transmission is completely secure; please use strong passwords and protect your devices.

Under the Privacy Act 2020 and related New Zealand law, you may request access to personal information we hold about you, ask for correction, or raise concerns about our handling. We may need to verify identity before releasing data. Some information cannot be deleted immediately if we must retain it for legal or dispute reasons. If you believe we have breached privacy rules, you may complain to us first and then to the Office of the Privacy Commissioner. We do not knowingly collect personal information from children under sixteen for marketing without parental consent; parents may contact us to remove a child’s details if supplied in error.

When sharing is necessary, we disclose data to delivery drivers or couriers for fulfilment, to payment gateways for charging cards, to IT hosts for website operation, and to professional advisers under duty of confidentiality. We may disclose information if required by court order or to protect rights, safety, and property. If Loafino undergoes a business restructure, customer data may transfer to a successor under equivalent protections. International transfers, if any, use appropriate safeguards. Analytics help us understand which pages help customers find opening hours or order forms; we prefer aggregated reporting where possible.

You should avoid sending unnecessary sensitive medical documents by email; describe allergy needs clearly in order notes instead. CCTV may operate in our shop for theft prevention; signage is displayed in store. This policy may be updated when we launch new services or when law changes. The effective date appears at the end of the published version. Continued use after an update acknowledges the revised policy. For privacy requests, email [email protected] with the subject line Privacy Request and include your name and contact method. We aim to respond within a reasonable timeframe. This Privacy Policy should be read together with our Terms of Service and Cookie Policy. Last updated October 2026.

If you link a social account or use a third-party login where offered in future, we receive only the profile fields that provider shares with your permission. You can disconnect linked accounts by contacting support. We do not use personal information for automated decisions that produce legal effects without human review, except where fraud scoring is applied by payment partners under their policies. Marketing preferences are stored separately from order history so that opting out of newsletters does not affect receipt confirmations. Contractors who deliver on our behalf see name, address, and phone only for the active delivery. They must delete or return route data after completion according to our agreements.