Privacy policy

MegaDeal is operated by Babo Investments Limited (NZBN 9429035341451), a company registered in New Zealand ("MegaDeal", "we", "us"). This policy explains what personal information we collect, why we collect it, and the choices you have about it, in line with the Privacy Act 2020. By using MegaDeal, you agree to the practices described here. MegaDeal doesn't process customer payments, so we never see or store card or payment details — there simply aren't any to collect.

Information we collect

• Usage data — pages viewed, deals browsed, and general device/browser information, used to keep the site working well and to improve which deals we feature.
• Account and business details — if you sign up to list or manage a deal, we collect your email address and a password (stored securely by our identity provider, never in plain text), plus your business's trading name, its legal or registered name and NZBN, a contact person's name and phone number, address, and photos, so we can verify who we're dealing with and review and display your listing.
• Communications — anything you send us through the contact form or by email.
• Deal-alert email signups — if you sign up for deal emails, we collect your email address. We send a confirmation email to verify it's really yours before adding you to the list, and every email includes an unsubscribe link that removes you immediately.

How we use it

• Show relevant deals and keep the site working well
• Review and publish business listings
• Provide customer support and respond to enquiries
• Detect and prevent fraud, and keep the site secure
• Understand which deals and categories perform well, in aggregate

We don't sell your personal data to third parties.

What's shown publicly

A business's trading name, logo, address, phone number, opening hours and website are shown publicly on their deal listings so customers can contact them — that information is meant to be public. Their account email, legal/registered business name, NZBN, and private contact person's name and phone number are collected for our own verification and record-keeping and are never shown publicly.

Service providers and overseas disclosure

We use a small number of specialist providers to run the site, and some personal information is processed by them on our behalf. This includes our headless commerce, member-login and transactional email provider (Wix.com), Google's Places API for business-address autocomplete, Google Analytics for site traffic reporting, and Meta (Facebook/Instagram) for ad measurement — see "Cookies, analytics and advertising" below. Some of these providers store or process data on servers outside New Zealand. Where that happens, we only share the information needed for them to provide their service to us, and we choose providers who apply security and privacy standards comparable to those required under the Privacy Act 2020.

How we protect your information

We use reasonable technical and organisational measures to protect personal information from loss, misuse or unauthorised access — including encrypted transmission (HTTPS), access controls on our internal tools, and restricting business data access to the business's own listings. No online service can guarantee perfect security, but if we ever became aware of a privacy breach likely to cause serious harm, we'd notify the Office of the Privacy Commissioner and affected individuals as required by law.

Cookies, analytics and advertising

We use a small amount of cookie-based storage to keep a business signed in to the portal across visits — that part is functional, not advertising-driven.

We use Google Analytics to understand overall site traffic — how many people visit, roughly where from (country/region, not a precise location), and which pages or referring sites they came from. This is aggregate reporting to help us run the site, not used to individually identify you. You can opt out using Google's Analytics opt-out browser add-on.

When we're running ad campaigns, pages on this site may also load the Meta (Facebook/Instagram) Pixel, which lets us measure whether an ad led to a signup and show ads to people likely to be interested. It can set cookies and share information such as pages you viewed and whether you signed up with Meta. You can control this through your Facebook ad preferences. Standard browser tracking-protection or ad-blocking tools will generally block both of these.

Data retention

We keep business account and listing records for as long as needed to operate the site and meet legal requirements, and delete or anonymise other personal data when it's no longer needed for the purposes above.

Your rights

Under the Privacy Act 2020 you can, at any time:

• Unsubscribe from marketing emails using the link in any email
• Request a copy of the personal data we hold about you
• Ask us to correct or delete your personal data

To exercise any of these, reach out via our contact page. We'll normally respond within 20 working days, as required by the Privacy Act. If you're not satisfied with how we've handled a privacy request or complaint, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

If we make material changes to how we handle your data, we'll update this page and, where appropriate, let you know directly.