Sensitive information privacy and cookie policy for New Zealand businesses

The difference is usually the level of detail and risk. If your business handles health details, financial information or other sensitive categories, the policy needs to explain those practices more carefully than a general website notice would. The same applies where your site uses analytics, advertising tools or other tracking technologies that affect what users are told online. A generic policy can leave gaps between what the document says and what your systems actually do. The document needs to line up with your actual privacy practices, including how information moves through the business.

It will often cover what sensitive information is collected, how it is collected, why it is used, when it may be disclosed, whether third-party providers are involved, and what rights individuals have to request access or correction. On the cookie side, it can address tracking technologies, analytics, advertising-related tools, website functionality cookies and user-facing disclosures about those activities. Depending on your operations, the policy may also touch on direct marketing, overseas service providers, retention-related statements and contact channels for privacy concerns. The exact wording depends on your real data flows.

We usually need a practical outline of your information handling rather than technical legal language. That might include the kinds of sensitive information you collect, where it comes from, what forms or systems collect it, whether your website uses analytics or advertising tools, and which providers help you host, process or store information. If you already have a privacy policy, cookie notice or website banner, those materials are also useful for comparison. The more accurately your practices are described, the easier it is to produce policy wording that matches them.

They can be. A template may use broad statements that sound acceptable on paper but do not reflect your actual handling of sensitive information or your website's tracking setup. That creates a practical risk if users, customers or regulators compare the policy against what your business is really doing. Templates also tend to gloss over higher-risk areas such as disclosures involving sensitive data, direct marketing touchpoints and the interaction between a privacy policy and cookie wording. A tailored document is generally more useful where your business has multiple systems, integrations or regulated data categories.

After the draft is prepared, you can review the wording and identify any factual points that need correcting or clarifying. This is often where businesses confirm details such as which tools are active on the website, whether any providers are based offshore, and how user requests are handled internally. Once the document is settled, you can arrange for it to be published alongside your website's cookie messaging and other privacy materials. If your tracking tools, data categories or service providers change later, the policy may need updating so it continues to reflect actual practice.

Just submit an enquiry via this page or click the 'get started' button on our website to submit an enquiry. After you've submitted an enquiry, one of our legal consultants will review your enquiry within 1 business day and get in touch to get a better idea of exactly what you are looking for.

Then your legal consultant will send through an email with a bit more information about the services you need, along with a fixed fee quote setting out costs, scope of the service and timing. Have a read through it, and if you're happy with the scope, you can accept and sign our engagement letter online - easy!

Once you've formally accepted, we'll connect you with a specialist lawyer and they will work with you to complete your project. They will contact you by email or phone if they need to get in touch.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the Sensitive Information Privacy Cookie Policy service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We operate completely online, which means we can help you wherever you are in New Zealand. We have office spaces in Sydney, and in Melbourne, but our use of technology allows our team members to work remotely from around the world. Our legal team are mostly based in Sydney, Melbourne, Brisbane and Perth. We also have a London office for Sprintlaw UK.

Our legal team is made up of experienced lawyers, who are specialists in various areas of law and hold an Australian legal practising certificate. None of our Sprintlaw lawyers are New Zealand qualified lawyers and they do not currently hold a New Zealand practising certificate.

They provide legal services working remotely from Australia via our 'legal consultancy' model, through which (under section 6 and section 35 of the New Zealand Lawyers and Conveyancers Act 2006) our Australian legal team are permitted to provide legal services to New Zealand businesses provided they do not provide services in certain 'reserved' areas of law. You can read our FAQ page to learn a bit more about our 'legal consultancy' model.

Given the strong similarities between Australian and New Zealand law, and the areas of law in which we practice (being small business and startup law), we do not view the fact that our lawyers have not qualified in New Zealand as having any substantive impact on the quality of our service. We are committed to ensuring that we provide high quality, affordable legal services to all our New Zealand clients.

Our legal team have all trained at leading firms, but have left the traditional corporate law world to join us on our mission to create a new and better way of delivering legal services. They have specialist expertise in technology law, intellectual property law, contract drafting and review, corporate law and commercial law.