Privacy Policy
Last updated: 13 July 2026 — This document is a draft pending review by a commercial lawyer. It does not constitute legal advice.
Matihiko Digital Limited (trading as Manuka Pay) is committed to protecting the privacy of the personal information we collect and hold. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what your rights are in relation to it.
This Policy applies to all individuals who interact with the Manuka Pay Platform — including registered Merchants, Customers who make payments through Manuka Pay payment pages, and visitors to our website.
1. Who We Are — The Data Controller
The data controller responsible for your personal information is:
We operate the Manuka Pay Platform as a technology service that enables Merchants to accept QR-code-initiated card payments through Stripe. We act as a technology platform and service fee collector only — we do not process or hold customer funds.
2. Scope and Legal Framework
This Policy is written in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Where we reference IPPs in this Policy, we do so to help you understand specifically how each principle applies to our data practices.
If you are a Merchant who is an individual, you may also have rights under the Privacy Act 2020 in relation to personal information we hold about you. If you are a business entity, this Policy applies to personal information held about individuals within your organisation.
3. Information We Collect
Merchant Information
When you register as a Merchant and during the course of using the Platform, we collect:
- Full name and email address
- Business name, trading name, and business description
- Phone number and public contact details (where provided)
- Stripe Connect Account ID and Stripe-assigned verification status
- Identity verification documents (collected and held by Stripe on our behalf; we receive only status indicators)
- Payment settings, preferences, and configuration data
- Transaction metadata: amounts, timestamps, payment references, status
- Payout records: settlement amounts, payout dates, and Stripe payout IDs
- Login activity and audit logs
Customer Information
Customers who make payments through Manuka Pay payment pages are paying through Stripe's hosted checkout. Matihiko Digital Limited does not collect or store card numbers or banking credentials. We receive and store limited transaction data from Stripe:
- Payment amount and currency
- Date and time of payment
- Payment reference or description
- Stripe Payment Intent ID and Charge ID (for reconciliation and dispute management)
- Transaction status (succeeded, refunded, disputed, etc.)
- Limited technical data where Stripe provides it (e.g., card type, last four digits for reference display)
Technical and Usage Information
From all visitors to our website and platform, we may collect:
- IP address and approximate geographic location
- Browser type, version, and operating system
- Pages visited and time spent on each page
- Application error logs and performance data
4. How We Use Personal Information
We use personal information for the following purposes (consistent with IPP 10 — limits on use of personal information):
- Account creation and management: Creating, verifying, and maintaining Merchant accounts.
- Payment processing facilitation: Passing required data to Stripe to initiate and confirm Transactions.
- Transaction records: Maintaining accurate records of all Transactions for Merchant reporting, payout reconciliation, and dispute management.
- Communications: Sending service notifications, important account updates, and (with consent) platform updates or feature announcements.
- Security and fraud prevention: Monitoring for suspicious activity, fraud, or prohibited use of the Platform.
- Risk assessment: Operating internal risk-scoring processes to protect the Platform. These are informational only and do not automatically restrict Merchant accounts without human review.
- Legal and regulatory compliance: Retaining records as required by NZ law, responding to lawful requests from authorities, and enforcing our Terms of Service.
- Platform improvement: Aggregated, de-identified usage analysis to understand how the Platform is used and improve it.
We do not use personal information for direct marketing without consent. We do not sell personal information to third parties.
5. Stripe as a Separate Processor
Stripe, Inc. is an independent payment processor used by the Manuka Pay Platform. Stripe is not a sub-processor of Matihiko Digital Limited for the purposes of payment processing — Stripe independently collects and processes personal information from Merchants and Customers under its own privacy policy and terms.
Specifically, Stripe:
- Collects and processes Merchant identity and bank account information during Stripe Connect onboarding.
- Collects and processes Customer card details and authentication data during Checkout. Manuka Pay never receives or stores card numbers.
- Makes its own determinations about Merchant eligibility, holds, and payouts based on its own risk and compliance policies.
Stripe's Privacy Policy is available at stripe.com/privacy. We encourage all Merchants to read Stripe's privacy policy as it applies directly to your Stripe account.
7. International Data Transfers
As a New Zealand company, we take your privacy rights under the Privacy Act 2020 seriously, including in relation to cross-border data transfers.
Stripe is headquartered in the United States. When you connect a Stripe account or when a Customer makes a payment, personal information (including identity verification data and transaction data) is transferred to Stripe's servers, which may be located in the United States and other jurisdictions. Stripe maintains appropriate data protection safeguards under its own compliance programme.
Our hosting infrastructure may also be located outside New Zealand. We take reasonable steps to ensure any overseas recipients of personal information handle it in accordance with standards comparable to the New Zealand Privacy Act 2020 (consistent with IPP 12).
By using the Manuka Pay Platform, you acknowledge and consent to the transfer of your personal information to Stripe and our infrastructure providers in overseas jurisdictions as described above.
8. Data Retention
We retain personal information for as long as necessary to:
- Provide and maintain the Platform for active Merchants.
- Meet our legal obligations — in particular, the Inland Revenue Act 1994 and the Financial Reporting Act 2013 require financial records to be retained for a minimum of 7 years. Transaction records, fee records, payout data, and refund records are retained for at least 7 years from the date of the transaction.
- Resolve disputes or enforce our Terms, including after account closure.
- Defend against legal claims (retention during any applicable limitation period).
After the applicable retention period, personal information is securely deleted or de-identified. Merchant account data unrelated to financial records may be deleted sooner following account closure.
9. Security
We take reasonable steps to protect personal information from loss, unauthorised access, disclosure, or misuse (consistent with IPP 5).
- Passwords are hashed using industry-standard algorithms and never stored in plain text.
- All data transmission is encrypted using HTTPS/TLS.
- Access to personal data is restricted to authorised personnel on a need-to-know basis.
- Card payment data is handled exclusively by Stripe, which maintains PCI DSS compliance. We do not store card numbers.
- We review and improve our security practices on an ongoing basis.
No system is completely secure. If you believe there has been a breach affecting your personal information, please contact our Privacy Officer immediately.
10. Your Rights — Access and Correction (IPP 6 & 7)
Under the New Zealand Privacy Act 2020 and its Information Privacy Principles, you have the following rights in relation to personal information we hold about you:
IPP 6 — Right of Access
You have the right to request access to personal information that Matihiko Digital Limited holds about you. We will respond to access requests within 20 working days of receiving the request. We may decline access in limited circumstances set out in the Privacy Act 2020 (e.g., where disclosure would prejudice another person's privacy or where a legal privilege applies).
IPP 7 — Right of Correction
If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct information or, where we disagree, attach a statement of your requested correction to the record.
Additional rights
- You may request that we delete personal information where retention is no longer legally required (subject to our 7-year financial records obligation).
- You may withdraw consent to marketing communications at any time by unsubscribing or contacting us.
- You may request information about what personal information we hold about you and what it is used for.
To exercise any of these rights, contact our Privacy Officer at [email protected].
12. Children
The Manuka Pay Platform is intended for use by individuals aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected personal information from a person under 18, we will take steps to delete that information promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify registered Merchants by email.
Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.
14. Complaints
If you believe we have interfered with your privacy rights under the Privacy Act 2020, please contact our Privacy Officer in the first instance. We will investigate and respond within 20 working days.
If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner:
15. Contact — Privacy Officer
For all privacy enquiries, access requests, or correction requests, contact:
We aim to acknowledge all privacy enquiries within 5 working days and to fully respond within 20 working days.