Privacy policy

BIG BARREL's PRIVACY POLICY

1. Our commitment to privacy

Big Barrel respects the privacy of our customers and is committed to handling personal information responsibly and in accordance with the Privacy Act 2020.

This Privacy Policy explains how we collect, use, store and disclose personal information when you interact with Big Barrel, including through:

• Big Barrel stores;
• Big Barrel Online and our websites;
• the Big Barrel Mates Club;
• customer-service channels;
• competitions and promotions;
• deliveries and Click & Collect; and
• other Big Barrel services.

The Privacy Act governs how New Zealand organisations collect, secure, use, disclose and retain personal information and provides individuals with rights of access and correction. Privacy Commissioner

2. Who is responsible for your information?

Depending on how you interact with Big Barrel, your information may be collected or held by:

Big Barrel Group Limited, including in connection with the Mates Club and group services;

Padda Enterprises Limited trading as Big Barrel Online, where applicable to Big Barrel Online services; and/or

the relevant participating Big Barrel store operator providing or fulfilling a service.

For the purposes of this Policy, we refer to these collectively as Big Barrel, we, us or our, where appropriate.

Where a particular Big Barrel store or legal entity is responsible for a transaction, that entity may also be responsible for personal information associated with that transaction.

3. Personal information we may collect

Depending upon your interaction with us, we may collect information including:

• your name;
• date of birth;
• telephone number;
• email address;
• postal, billing or delivery address;
• Mates Club membership number and account information;
• transaction and purchase history;
• Mates Club points, rewards, vouchers and member benefits;
• information required to verify your identity, age or entitlement to use an account;
• order, delivery and Click & Collect information;
• customer enquiries, complaints and correspondence;
• competition or promotional entries;
• marketing preferences;
• information about use of our websites and digital services;
• IP address, device, browser and session information;
• cookie, analytics and similar digital information;
• fraud-prevention, security and account-access information;
• payment-related information and transaction status; and
• CCTV footage where CCTV operates at a Big Barrel store or facility.

We only seek to collect information that is reasonably necessary for legitimate Big Barrel activities. Principle 1 of the Privacy Act requires personal information collection to be connected with a lawful purpose and necessary for that purpose. Privacy Commissioner

4. How we collect information

We usually collect information directly from you, including when you:

• join Mates Club;
• shop in store or online;
• create an account;
• provide your Mates Club details at checkout;
• contact us;
• enter a competition;
• subscribe to marketing;
• arrange delivery or collection; or
• otherwise interact with Big Barrel.

We may also obtain information from another source where permitted by law, including:

• a person acting with your authority;
• a participating Big Barrel store;
• payment, delivery, fraud-prevention or technology providers;
• publicly available sources; or
• another source where collection is authorised by law.

Where the Privacy Act requires us to tell you that information has been collected indirectly, we will take reasonable steps to do so.

This is particularly important now because Privacy Principle 3A took effect on 1st May 2026 and introduced additional notification obligations when personal information is collected from someone other than the individual concerned. Privacy Commissioner

5. Why we collect and use personal information

We may use personal information to:

• provide goods and services;
• create and manage customer accounts;
• administer Mates Club;
• identify and verify Mates Club members;
• apply Mates Club pricing, rewards and points;
• process and fulfil purchases;
• administer Click & Collect;
• arrange delivery;
• verify age and identity;
• comply with alcohol licensing and other legal requirements;
• provide customer service;
• respond to complaints and enquiries;
• prevent fraud, account misuse or unauthorised redemption of benefits;
• maintain security and investigate incidents;
• administer promotions and competitions;
• maintain business and accounting records;
• improve our products, stores, website and services;
• analyse customer activity and business performance;
• personalise services or offers where appropriate;
• send marketing where permitted;
• enforce our terms and policies; and
• comply with legal, regulatory and law-enforcement obligations.

Personal information will not be used for an unrelated purpose unless permitted under the Privacy Act or authorised by you. Privacy Principle 10 generally limits use to the purpose for which information was collected or a permitted related purpose. Privacy Commissioner

6. Mates Club and customer verification

Mates Club is intended for use by the registered member.

When a customer wishes to use a Mates Club account, Big Barrel staff may need to locate the account using information such as:

• a Mates Club/customer number;
• telephone number; or
• email address.

Once an account is located, staff may need to view sufficient account information to reasonably verify that the customer is entitled to use that account and receive the associated Mates Club prices, points, rewards or benefits.

If sufficient information cannot be provided to identify or verify the account, Big Barrel may be unable to apply Mates Club benefits.

This access is provided to staff solely for authorised Big Barrel business purposes.

Big Barrel employees, contractors and store personnel are not authorised to use customer information for their own personal purposes, including using customer details obtained through Big Barrel systems to search for, follow, message or contact customers privately or through personal social-media accounts.

7. Who may access personal information within Big Barrel?

Personal information may be accessed by authorised Big Barrel employees, store operators, contractors and service providers where reasonably necessary for their duties.

Access may include activities such as:

• processing transactions;
• locating and verifying Mates Club accounts;
• fulfilling orders;
• providing customer support;
• administering rewards;
• investigating account discrepancies;
• resolving complaints;
• preventing fraud; or
• meeting legal and compliance obligations.

Authorised access does not permit personal or unrelated use.

Privacy Principle 5 requires organisations to take reasonable safeguards against unauthorised access, use, disclosure or other misuse of personal information. Privacy Commissioner

8. CCTV

Some Big Barrel stores and facilities use CCTV.

CCTV may be used for purposes including:

• customer and staff safety;
• security;
• theft and crime prevention;
• incident investigation;
• protection of property; and
• legal or licensing compliance.

Where appropriate, signage may be displayed advising that CCTV operates.

CCTV will be accessed only where reasonably necessary and retained only for as long as reasonably required for the purposes for which it was collected, subject to any legal requirement or active investigation.

9. Disclosure of personal information

We do not sell personal information.

Where reasonably necessary for legitimate business purposes, information may be provided to:

• participating Big Barrel stores or store operators;
• delivery and courier providers;
• payment providers;
• website, hosting, cloud, POS, CRM and loyalty-system providers;
• marketing and communications service providers;
• IT and cybersecurity providers;
• professional advisers such as lawyers, accountants and insurers;
• regulators and licensing authorities;
• law-enforcement agencies;
• courts or tribunals; or
• other persons where required or permitted by law or authorised by you.

We will only disclose information where we have a lawful basis for doing so.

Privacy Principle 11 generally limits disclosure to the purpose for which the information was obtained, a directly related purpose, authorised disclosure or another statutory exception. Privacy Commissioner

10. Overseas service providers

Some technology, cloud, communications or other service providers may process or store information outside New Zealand.

Where personal information is disclosed outside New Zealand, Big Barrel will take reasonable steps to comply with Privacy Principle 12, including ensuring that appropriate privacy safeguards apply where required.

Privacy Principle 12 requires organisations to consider whether an overseas recipient is subject to comparable safeguards or otherwise adequately protects the information. Privacy Commissioner

11. Security

Big Barrel takes reasonable steps to protect personal information from loss, unauthorised access, misuse, alteration or disclosure.

Measures may include, as appropriate:

• staff confidentiality requirements;
• privacy policies and training;
• role-based system access;
• passwords and authentication;
• system and transaction logging where available;
• physical security;
• secure technology systems;
• service-provider controls; and
• investigation of suspected unauthorised access.

No system can eliminate all risk, but Big Barrel will maintain safeguards appropriate to the nature of the information and the systems used.

12. How long we keep information

Big Barrel will not retain personal information for longer than reasonably necessary for the lawful purposes for which it may be used.

Retention periods may differ depending on the type of information, legal requirements, accounting obligations, dispute resolution, fraud prevention and operational requirements.

Information that is no longer reasonably required will be deleted, destroyed, anonymised or otherwise securely disposed of where practicable.

Privacy Principle 9 expressly provides that personal information should not be retained for longer than necessary for its lawful purpose. Privacy Commissioner

13. Marketing communications

Where you have subscribed, consented or we otherwise have lawful authority to do so, Big Barrel may send you promotional emails, text messages, newsletters, Mates Club offers and other marketing communications.

You may unsubscribe from electronic marketing using the unsubscribe facility provided or by contacting us.

Unsubscribing from marketing does not prevent Big Barrel from sending necessary transactional or service communications relating to your purchases, account, Mates Club administration, security or legal matters.

New Zealand's anti-spam requirements generally require commercial electronic messages to have an appropriate form of consent, accurate sender identification and a functional unsubscribe facility. Department of Internal Affairs

14. Cookies, analytics and digital technologies

Big Barrel websites may use cookies, pixels, session identifiers and similar technologies for purposes including:

• keeping you logged in;
• maintaining shopping carts;
• remembering preferences;
• website security;
• analytics;
• understanding website performance;
• improving customer experience;
• personalising content; and
• advertising or remarketing where used.

Your browser may allow you to block or delete cookies. Some Website functionality may be affected if cookies are disabled.

15. Accessing your personal information

You may request access to personal information Big Barrel holds about you, subject to the Privacy Act 2020.

We may need to verify your identity before providing information.

16. Correcting your personal information

You may ask Big Barrel to correct personal information you believe is inaccurate or incomplete.

If we do not agree to make a requested correction, you may have the right to ask us to attach a statement of correction to the relevant information.

Privacy Principle 7 provides these correction rights. Privacy Commissioner

17. Privacy breaches

If Big Barrel becomes aware of unauthorised access to, disclosure, loss, alteration or other misuse of personal information, we will investigate and take appropriate steps to contain and address the incident.

Where a privacy breach has caused or is likely to cause serious harm, Big Barrel will comply with its notification obligations under the Privacy Act 2020, including notifying the Office of the Privacy Commissioner and affected individuals where required.

The Privacy Commissioner expects notifiable breaches to be reported as soon as practicable and generally within approximately 72 hours of determining that the notification threshold has been met. Privacy Commissioner

18. Privacy complaints

If you believe Big Barrel has not handled your personal information appropriately, please contact our Privacy Officer.

Privacy Officer
Big Barrel
50 Austin Street
Onekawa
Napier 4110
New Zealand

Email: [email protected]
Phone: 0800 227 735

We will acknowledge and investigate privacy complaints reasonably and in accordance with the Privacy Act.

You may also have the right to complain to the Office of the Privacy Commissioner.

19. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices or legal obligations.

The latest version and effective date will be published on our Website.

Where a material change substantially alters how we use existing personal information, we will take any additional steps required by law.