Privacy Policy
How Hex Recon collects, uses, stores, and protects your personal information in accordance with the New Zealand Privacy Act 2020.
Last updated: April 2026
1. Overview & Our Commitment
Hex Recon Limited ('we', 'us', 'our') is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020 and the 13 Information Privacy Principles (IPPs) contained within it. This policy explains what personal data we collect, why we collect it, how we use it, and the rights you hold as a data subject. We collect only what is strictly necessary to deliver our products and services to you.
2. What Information We Collect
We collect the following categories of personal information:
Account & Order Data
Full name, email address, shipping address, billing address, phone number (optional), order history, and account preferences.
Payment Information
Payment details are processed securely by our third-party payment provider (Stripe). Hex Recon does not store, log, or retain your full card number, CVV, or bank account details on our own servers.
Usage & Technical Data
IP address, browser type, device information, and pages visited — collected automatically via standard web server logs and analytics. This data is aggregated and anonymised where possible.
Communications
Records of support enquiries, emails, or contact form submissions you send to us, including their content.
3. How We Use Your Information
We use your personal information for the following purposes only:
- Processing and fulfilling your orders, including shipping and delivery communications
- Managing your customer account and authentication
- Responding to support enquiries, warranty claims, or legal notices
- Sending transactional emails (order confirmations, shipping notifications)
- Sending optional marketing communications where you have expressly opted in
- Complying with legal obligations, including law enforcement requests under applicable NZ law
- Improving our products, services, and website through aggregated, anonymised analytics
We will never sell, rent, or trade your personal information to third parties for marketing purposes.
4. Who We Share Your Information With
We share your personal data only with:
- Shipping carriers (NZ Post, CourierPost, or similar) — your name and delivery address to fulfil your order
- Payment processors (Stripe) — to securely process your payment transaction
- Email service providers — to deliver transactional and, where opted in, marketing communications
- Law enforcement or government agencies — only where required by a valid legal obligation, court order, or preservation direction under the Search and Surveillance Act 2012 or Budapest Convention obligations
All third-party providers are selected for their compliance with applicable data protection laws and are bound by data processing agreements.
5. Data Storage & Security
Your personal data is stored on secured cloud infrastructure. We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. While we take all reasonable precautions, no method of transmission over the internet is 100% secure. In the event of a data breach that poses a risk of serious harm to you, we will notify the New Zealand Privacy Commissioner and affected individuals as required under the Privacy Act 2020 mandatory breach notification obligations.
6. How Long We Keep Your Data
We retain your personal information for as long as necessary to fulfil the purposes described in this policy, or as required by law. Order records are retained for 7 years for tax and accounting purposes. You may request earlier deletion of your account and personal data, subject to our legal retention obligations.
7. Device Data & Telemetry
Hex Recon hardware devices (GateKeeper M1, GateKeeper M2, GhostKey Nano) do not transmit personal data back to Hex Recon servers automatically. Any network monitoring data captured by the GateKeeper series is processed and stored locally on the device or your local network only. Hex Recon does not receive, access, or store any data captured by your hardware during operation.
8. Your Rights Under the Privacy Act 2020
As a New Zealand resident, you have the following rights under the Privacy Act 2020:
- Right of Access (IPP 6) — You may request a copy of all personal information we hold about you
- Right to Correction (IPP 7) — You may request correction of inaccurate or outdated information
- Right to Erasure — You may request deletion of your personal data, subject to legal retention obligations
- Right to Object — You may opt out of marketing communications at any time via the unsubscribe link in any email
- Right to Complain — If you believe your privacy rights have been breached, you may lodge a complaint with the New Zealand Privacy Commissioner at privacy.org.nz
To exercise any of these rights, contact us at [email protected]. We will respond within 20 working days.
10. Children's Privacy
Hex Recon products and services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete that information.
11. Upcoming Privacy Law Reforms
The New Zealand Government is currently considering introducing civil pecuniary penalties under the Cyber Security Action Plan 2026–2027, which may amend the Privacy Act 2020. Hex Recon actively monitors regulatory developments and will update this policy to reflect any changes in our legal obligations. We are committed to maintaining compliance as the regulatory landscape evolves.
12. Contact & Privacy Enquiries
For all privacy-related enquiries, access requests, or breach notifications, contact our Privacy Officer at [email protected]. Complaints may also be lodged with the New Zealand Privacy Commissioner at www.privacy.org.nz.
Questions About This Policy?
Our team is based in New Zealand and typically responds within 1–2 business days.