Privacy Policy

Who we are

In this policy, "Cheeky's Plumbers", "we", "us" and "our" means the business trading as Cheeky's Plumbers, a plumbing, drainage, hot water and gasfitting business working in Wellington, New Zealand.

We are the agency responsible for your personal information under the Privacy Act 2020. Where we use other businesses to help us (for example, software providers), they act on our behalf and we remain responsible for how your information is handled.

You can contact us by phone on the number shown on this website, or through the form on our contact page.

Our privacy officer

Our privacy officer looks after privacy questions, access and correction requests, complaints and any privacy breach. You can reach them by phone on the number shown on this website, or through the form on our contact page, marked "Attention: Privacy Officer".

What personal information we collect

We only collect the information we need to respond to you, do the job well, keep everyone safe and meet our legal obligations (IPP 1). Depending on how you deal with us, this can include the following.

• Contact details: your name, phone number, email address, postal and billing address, and how you prefer to be contacted.
• Property and access details: the job address, whether you own, rent or manage the property, landlord or property manager details, tenant contact details, gate codes, key safe or alarm instructions, parking notes, pets on site and any hazards we should know about.
• Job information: the problem you describe, your answers to our online quote quiz, the service and arrival window you book, quotes, invoices, job notes, test results, materials used and the warranty and compliance paperwork for the work.
• Photos and video: images of the problem, the work area and the finished job, CCTV drain camera footage and photos you send us. These are taken to diagnose, quote, prove compliance and support warranty and insurance claims.
• Payment information: payment method, transaction records and account balances. Card payments are processed by a payment provider and we do not store full card numbers.
• Phone calls and messages: call logs, voicemails, SMS and email messages. If we record calls for training and quality, we will tell you at the start of the call.
• Call and form tracking: WhatConverts is our call and form tracking provider. Calls to the phone number on this website go through WhatConverts, which records the calling number, the time and length of the call, and the page or advert that led to it. When you send a form on this website, WhatConverts also records the details you enter and the page or advert that led to it.
• Chat transcripts: messages you type into the chat on our website, along with any contact details you give in the chat.
• Reviews and feedback: comments, ratings and survey answers you give us or post about us.
• Website and device data: the page you were on when you contacted us, the link or advert that brought you to the site (including campaign tags such as utm_source), IP address, browser and device type, pages viewed, the page that referred you, approximate location and the date and time of your visit, collected through cookies and similar tools (see the Cookies and analytics section).
• Job applicant information: your CV, cover letter, licences and registration with the Plumbers, Gasfitters and Drainlayers Board, qualifications, work history, referee details, driver licence, right to work in New Zealand and, with your written consent, the result of a Ministry of Justice criminal record check and drug and alcohol testing.

How we collect it

Wherever we can, we collect information directly from you (IPP 2). This happens when you fill in a quote, quiz, booking or contact form on our website, use the chat, call or text us, email us, talk to our team on site, pay an invoice or apply for a job.

Sometimes we receive information about you from other people, for example a landlord, property manager, real estate agent, tenant, builder, insurer or loss adjuster who books a job at your property, or a referee for a job applicant. When we collect information about you from someone else, we take reasonable steps to let you know that we hold it and why, unless an exception in the Privacy Act applies (IPP 3A).

We collect information in ways that are lawful, fair and not unreasonably intrusive (IPP 4). We take particular care when a young person or a vulnerable person is involved.

Why we collect it

When we collect your information, we try to make it clear why we need it and what happens if you do not provide it (IPP 3). In short, if you do not give us your contact and property details, we may not be able to quote, book or complete your job. We use your information for the following purposes.

• To respond to enquiries, prepare quotes and estimates and book jobs, including sending booking confirmations and arrival window reminders.
• To carry out the work safely and correctly, including planning access, managing site hazards and dispatching the right tradesperson.
• To issue invoices, take payments, process deposits, manage accounts and recover overdue amounts.
• To issue and keep compliance documents such as gas certificates of compliance, gas safety certificates, records of work and producer statements, and to support code compliance certificates.
• To handle manufacturer warranty claims on your behalf and respond to complaints.
• To provide reports and photos to insurers when you ask us to.
• To train our team and check the quality of our service.
• To send you service reminders and marketing where you have agreed or where the law otherwise allows (see the Marketing section).
• To improve our website, understand which pages and adverts work and keep the site secure.
• To assess job applications and, if you join us, to manage your employment.
• To meet our legal obligations, including tax, health and safety, building, gasfitting and plumbing law.

How we use and share your information

We only use your information for the purpose we collected it for, a directly related purpose, or another purpose the Privacy Act allows, such as with your consent or where it is necessary to prevent a serious threat to someone's health or safety (IPP 10).

We do not sell your personal information. We only disclose it where one of the exceptions in IPP 11 applies, for example where disclosure is one of the purposes we collected it for, you have authorised it, or the law requires it. The people and organisations we may share it with are listed below.

• Our staff and subcontractors: licensed plumbers, gasfitters, drainlayers and specialist contractors (for example excavation, CCTV or relining specialists) who carry out or help with your job. They are only given what they need for the job.
• Suppliers and manufacturers: parts suppliers and manufacturers, where we need to order parts, register a product or make a warranty claim for you.
• Payment providers: banks and card processors.
• Insurers and loss adjusters: where you have asked us to report on a claim, or where we need to notify our own insurers of an incident.
• Your local council (Wellington City, Hutt City, Upper Hutt City, Porirua City or Kāpiti Coast District Council) and Tiaki Wai: where building consent, code compliance, backflow prevention test results, trade waste or water and wastewater connection information must be provided, or where a regulator requires it.
• The Plumbers, Gasfitters and Drainlayers Board: certification records, such as gas certificates of compliance and gas safety certificates lodged through the Board's systems, and information needed for licensing, audits or complaints.
• Other regulators and authorities: WorkSafe New Zealand, Energy Safety, the Police or a court, where the law requires or allows it.
• IT, CRM and business software providers: the companies that host our website, forms, chat, booking, job management, accounting, email, phone and SMS systems (see Overseas storage below).
• Professional advisers and debt collectors: our accountant, lawyers and, if an invoice is not paid, a debt collection agency or credit reporter (see the Terms and Conditions).
• Your landlord, property manager or tenant: where they are a party to the job, for example to arrange access or to send a report to the property owner who is paying.
• A buyer of our business: if all or part of our business is sold, customer records may be transferred to the buyer, who must handle them in line with this policy.

Website enquiries, Google Sheets and Slack

When you send us a quote, booking, contact or chat enquiry through this website, we receive the details you enter (such as your name, phone number, email, suburb, the service you need, your message and a preferred time), along with the page you were on, the site that referred you and any advertising campaign tags in the link.

Each enquiry is stored in our secure lead database and copied to a Google Sheet that our team uses to track and follow up enquiries. A notification with the enquiry details is also posted to a private Slack channel so the right person can call you back quickly. Only our team, and the people who help us run these systems, can see them.

We use these records to respond to you, book your job and understand which pages and adverts bring in enquiries. We keep them in line with the retention periods below.

Overseas storage and disclosure (IPP 12)

Some of the software we use stores information on servers outside New Zealand, commonly in Australia, the United States or the European Union. Using a cloud service to store or process information on our behalf is not usually treated as a disclosure, but we still choose providers carefully and require them to protect your information.

If we do disclose your personal information to an organisation overseas, we only do so where IPP 12 allows it. That means the recipient is subject to privacy laws that give comparable protection to New Zealand law, has agreed by contract to protect the information to a comparable standard, or you have authorised the disclosure after we told you it may not be protected in the same way.

The main providers we use are listed below. Some of them store data outside New Zealand.

• Website hosting: Render
• Website enquiries and lead records: Supabase (secure cloud database)
• Lead tracking: Google Sheets (Google)
• Team notifications about new enquiries: Slack
• Call and form tracking: WhatConverts
• Maps on our website: Google Maps

Keeping your information secure (IPP 5)

We take reasonable steps to protect your information against loss, unauthorised access, use, changes or disclosure, and other misuse.

• Our website uses HTTPS encryption, and forms, chat and bookings are sent over an encrypted connection.
• Access to our systems is limited to staff who need it, protected by individual logins and, where available, multi-factor authentication.
• Gate codes, key safe codes and alarm details are only shared with the tradesperson attending and are removed from job notes when no longer needed.
• Paper records are kept in locked storage and securely destroyed.
• Staff are trained on privacy and confidentiality, and our service providers are required to keep your information secure.
• Work phones and tablets used on site are passcode protected and can be wiped remotely if lost.

How long we keep it (IPP 9)

We keep personal information only for as long as we need it for a lawful purpose, then securely delete or anonymise it. Typical retention periods are listed below. Some periods are set by law, and others reflect how long a claim about plumbing or building work can be made.

• Invoices, payment and accounting records: 7 years, as required by tax law.
• Job records, photos, quotes and compliance documents (including gas certificates, records of work and test results): at least 10 years, because claims about building work can be made for up to 10 years under the Building Act 2004.
• Enquiries and quotes that did not go ahead: 2 years from the last contact.
• Chat transcripts, call recordings and voicemails: 12 months, unless needed for a complaint or dispute.
• Marketing preferences and unsubscribe records: for as long as needed to respect your choice.
• Unsuccessful job applications: 12 months, unless you agree to us keeping them longer for future roles.
• Website analytics data: in line with the settings of the analytics tool, usually 14 months.

Keeping your information accurate (IPP 8)

Before we use or share your information, we take reasonable steps to check it is accurate, up to date, complete, relevant and not misleading. Please tell us if your details change, especially your phone number, email or billing address.

Your right to access and correct your information (IPP 6 and IPP 7)

You have the right to ask whether we hold personal information about you and to see it. You also have the right to ask us to correct information you think is wrong. If we decide not to make a correction, you can ask us to attach a statement of the correction you asked for, so anyone reading the record sees it.

To make a request, contact our privacy officer. We may need to confirm your identity before we release or change anything, so we do not give your information to the wrong person.

We will respond as soon as reasonably practicable and no later than 20 working days after we receive your request. If we need more time, we will tell you why and how long it will take, as the Privacy Act allows. There is no charge to ask for or correct your information.

In some limited cases the Privacy Act allows us to withhold information, for example where releasing it would disclose someone else's private information or legally privileged material. If we refuse a request, we will explain why and tell you about your right to complain to the Privacy Commissioner.

Unique identifiers (IPP 13)

We give each customer and job a reference number in our systems so we can find records quickly. We do not use government identifiers such as your IRD number, driver licence number or passport number as our own customer identifier. If we see a driver licence to confirm a job applicant's identity, we only record what we need.

Notifiable privacy breaches

A privacy breach is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information. If a breach happens, we act quickly to contain it and reduce any harm.

If we believe a breach has caused, or is likely to cause, serious harm to anyone, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as required by Part 6 of the Privacy Act 2020. Where it is not reasonably practicable to tell each person directly, we will give public notice. We keep a record of all breaches, whether or not they are notifiable.

If you think your information has been involved in a breach, please contact our privacy officer straight away.

Marketing and how to opt out

We may send you service reminders and seasonal tips by email or text. We only send commercial electronic messages where you have agreed, or where consent can be inferred from our existing relationship as the Unsolicited Electronic Messages Act 2007 allows, for example after we have done a job for you.

Every marketing email or text identifies Cheeky's Plumbers, tells you how to contact us and includes a working way to unsubscribe. We will stop sending marketing messages within 5 working days of your request.

Opting out of marketing does not stop messages about a job you have booked, your invoices or safety notices, as these are not marketing.

• Reply STOP to any marketing text.
• Click unsubscribe in any marketing email.
• Contact us by phone on the number shown on this website, or through the form on our contact page, and ask to be removed.

Cookies and analytics

Cookies are small files saved by your browser. Similar tools include pixels, tags and your browser's local or session storage. We use them to make the website work, remember your choices and understand how people use the site. This website loads a WhatConverts tracking script on every page. WhatConverts is our call and form tracking provider: it uses cookies to remember the link or advert that brought you here, may show a tracking phone number in place of our usual number, and records the calls and form enquiries that follow so we know which advertising led to them.

Our website currently uses your browser's session storage to remember things like whether you have closed a pop-up during your visit, and the campaign tags (such as utm_source) from the link you arrived on, so an enquiry can show which advert or search brought you. This is deleted when you close your browser. If you send an enquiry while our system cannot be reached, your browser keeps a copy in local storage and sends it the next time you open a page on this site, then deletes it. The Add to my calendar button on the booking page creates a calendar file (.ics) on your own device; that file is not sent to anyone else.

Our contact and service area pages include embedded Google Maps. When a map loads, Google may set its own cookies and collect your IP address and usage data under the Google Privacy Policy. Embedded reviews and links to Google, Facebook and other sites are covered by those companies' own privacy policies.

If we add analytics or advertising tools such as Google Analytics, Google Ads or the Meta Pixel, they will collect information about your visit to measure traffic and the performance of our adverts, and may show you our adverts on other sites. We will update this policy when we do.

You can block or delete cookies in your browser settings, use private browsing, or install Google's analytics opt-out add-on. Some features, such as maps and the booking tool, may not work properly if you block everything.

Chat, reviews and public content

Messages in our website chat are stored so we can reply and follow up on your enquiry. Please do not share payment card details in the chat. The chat gives automated, scripted replies. When you give your details in the chat, they are sent to our team, who follow up personally.

If you leave us a review on Google or another site, it is published under that site's terms. We may reply publicly. We will only quote your review or feature photos of your property in our own marketing with your permission, and we will not publish your address.

Job applicants

If you apply for a role, we use your information to assess your application, check your licences and registration, contact your referees and, with your written consent, carry out a criminal record check or other pre-employment checks. We only share it with people involved in recruitment, such as a recruitment agency or the referees you name.

If you are unsuccessful, we keep your application for 12 months in case a suitable role comes up, unless you ask us to delete it sooner. If you are successful, your information becomes part of your employee record.

Children

Our website and services are aimed at adults who own, rent or manage property. We do not knowingly collect personal information from children under 16 except as part of an apprenticeship or school work experience application with a parent or guardian involved. If a child gives us information without consent, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time, for example when we add a new service, change software providers or the law changes. The current version will always be on this page with the date it was last updated. If a change significantly affects how we use your information, we will tell you directly where we can.

Questions and complaints

If you have a question or concern about how we have handled your personal information, please contact our privacy officer first. We will acknowledge your complaint within 5 working days, investigate it and aim to give you a written response within 20 working days.

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner.

• Website: www.privacy.org.nz
• Phone: 0800 803 909
• Post: Office of the Privacy Commissioner, PO Box 10094, Wellington 6143