Privacy Policy

Scope and relationship to other notices

This Policy covers processing carried out via zodmarixez.world and related email inboxes operated by us. Offline processing at physical events is rare; when it occurs, on-site signage points back to this document. The Cookie Policy adds device-level detail, and the Terms of Service describe acceptable site behaviour. Nothing here is legal advice; consult independent counsel if you need jurisdiction-specific guidance.

Categories of personal data

Depending on your interaction we may process:

• Identity and contact: name, billing and shipping addresses, phone number, email, communication preferences.
• Commercial: order contents, quantities, loyalty notes you volunteer, return references.
• Financial metadata: payment card type and last four digits as echoed by payment processors, dispute identifiers—we do not store full card numbers on our web servers.
• Technical and usage: IP address, approximate location derived at regional level, user agent, referring URL, pages viewed, and hashed identifiers from optional analytics cookies if you consent.
• Support content: free-text messages including attachments you send; please omit sensitive health details unless you accept that stewards may read them.
• Compliance evidence: consent logs, suppression files, fraud screening scores from service providers, audit trails required by payment networks.

Lawful bases under the GDPR

Where EU or UK law applies, we rely on:

• Contract (Article 6(1)(b)) for fulfilling orders and answering pre-contract enquiries materially linked to a purchase you initiate.
• Legitimate interests (Article 6(1)(f)) for securing infrastructure, debugging errors, understanding broad traffic trends with privacy-oriented configuration, and enforcing our terms—balanced against your rights.
• Legal obligation (Article 6(1)(c)) for tax invoices, anti-money-laundering checks where triggered, and responding to court orders we cannot lawfully refuse.
• Consent (Article 6(1)(a)) for non-essential cookies, some marketing emails, and experimental product research invitations where no other basis fits.

For New Zealand residents, comparable reasoning maps to Information Privacy Principles, particularly purposes connected to the reason we collected data, security safeguards, and access rights.

Specific processing purposes

We process data to authenticate payments, arrange courier labels, send transactional emails (receipts, shipping updates), maintain customer service threads, improve copy clarity on product pages, detect credential-stuffing attacks, generate aggregate readership statistics, comply with dietary supplement advertising guardrails in applicable regions, and archive documentation for regulatory inspections. Where you consent, limited event data may be shared with advertising platforms (for example Google) for conversion measurement and audience controls subject to their terms and our Cookie Policy. Marketing personalisation, when present, remains proportionate and can be withdrawn without affecting core order handling.

Retention schedule highlights

Accounting and tax ledgers remain for seven New Zealand financial years unless a longer period is mandated by an active investigation. Marketing consents and unsubscribe evidence persist to honour perpetual suppression. Server access logs with IP addresses typically rotate after ninety days unless implicated in security incident forensics. Backup snapshots may briefly contain deleted records until the next purge cycle completes. Cookie preference files on your device survive until you clear browser storage.

Recipients and processors

We engage hosting providers, email transport services, customer relationship tooling, carriers, translation vendors for multilingual support, and payment gateways. Contracts impose confidentiality, subprocessors reviews, and instructions to delete or return data at offboarding. Some recipients act as independent controllers—payment networks and banks set their own retention policies disclosed in their statements.

International transfers

Data may transit through Australia, the European Economic Area, the United Kingdom, or the United States. Where adequacy decisions do not exist we implement Standard Contractual Clauses, supplementary technical measures such as encryption in transit and at rest for databases holding contact details, and data minimisation reviews before exporting large extracts.

Security measures

We enforce least-privilege access for staff, mandatory multifactor authentication on administrative tools where supported, TLS for public endpoints, periodic log monitoring, and vendor security questionnaires before onboarding services that touch personal data. No control eliminates all risk; notify us promptly if you suspect unauthorised account use.

Your rights and complaints

Subject to applicable law you may request access, correction, erasure, restriction, portability, objection, and human review of automated decisions with legal effects. Withdrawing consent does not invalidate earlier processing that was lawful. EU and UK users may lodge complaints with their supervisory authority; New Zealand users may contact the Office of the Privacy Commissioner. Email ask@zodmarixez.world with “Privacy request” in the subject line; we generally respond within thirty calendar days and may extend where complexity warrants under statute.

Relationship to cookies

Device identifiers generated through cookies or similar storage are further detailed in the Cookie Policy, including how to reopen the consent banner choices in supported browsers.

Children

The Revion site targets adults capable of forming contract or purchasing with guardian supervision depending on local rules. We do not knowingly profile minors for marketing. If you believe a child submitted personal data without authority, contact us to delete it promptly subject to legal holds.

Updates

We revise this Policy when our processing activities, regulatory guidance, or corporate structure changes materially. The date at the top reflects your browser’s current day when scripts run locally; substantive edits receive an internal version note in our wiki even if not duplicated on the public page. Continued use after posting constitutes notice where the law permits.