Privacy and Cookie Policy
Last updated: 30 September 2026
Xplosiv Supplements Limited (company number 3575632, NZBN 9429030928565) runs the xplosiv.nz online store and Xplosiv stores around New Zealand. This policy explains how we collect, use and share your personal information when you shop with us online, in store or through Click & Collect, and the choices you have. We follow the New Zealand Privacy Act 2020.
What we collect
- Contact and delivery details: your name, email address, phone number, and delivery and billing address.
- Order details: what you buy, how you pay, and any delivery instructions or notes you add. We never see your full card number: you enter your card details on our payment provider's secure page online, or on the card terminal in store.
- Account details: your login, saved addresses, hometown and preferred store, and your Loyalty Points, VIP Club and store credit.
- In-store details: if you give them to our team at the till, your name, email address, phone number and sometimes your address, recorded with your purchase. You can shop in store without giving them.
- Gift vouchers: the name and email address of the person you're sending a voucher to, and your message.
- Messages: what you tell us when you contact us.
- Device and usage information: your IP address, browser and device, the pages you visit, what you search for, and the products you view or add to your cart. We collect this with cookies and similar technologies (see Cookies and advertising).
We also receive some information from others: payment confirmations from our payment providers, delivery updates from our couriers, the reviews you post through REVIEWS.io, and the name of the affiliate who referred you, if you used their link.
We need your contact and delivery details to process an online order. Creating an account, or joining our newsletter or VIP Club, is up to you.
How we use it
- To process your orders: to take payment, pack and deliver your order or have it ready for Click & Collect, handle returns and refunds, and send you order and delivery updates.
- To run your account and rewards: your account, Loyalty Points, VIP Club, store credit, gift vouchers and our affiliate programme.
- To help you: to answer your questions and sort out any problems.
- Marketing: to send you our newsletter and offers if you've signed up. We may also remind you about items left in your cart, and ask you to review products you've bought.
- Advertising: to measure how our ads perform, and to show our ads to people who have visited our website or bought from us, on Facebook, Instagram, Google and other websites.
- To improve our website: to understand how people use it.
- Security and legal reasons: to prevent fraud and misuse, keep the records the law requires, and respond to lawful requests.
Who we share it with
We share personal information only when we need to, with:
- Payment providers (Windcave, Afterpay and POLi), to process your payment.
- Delivery partners (GoSweetSpot and New Zealand Couriers), to deliver your order.
- Service providers who run parts of our business for us, such as our email systems (including Klaviyo and Postmark), product reviews (REVIEWS.io), website security (Cloudflare), staff messaging, and our retail and stock system.
- Advertising and analytics partners, including Meta (Facebook and Instagram) and Google, as explained below.
- Others, where the law requires or allows it, for example to prevent fraud, to respond to a lawful request, or if we sell our business.
Some of these providers are based overseas, mainly in the United States and Australia, and store or process information there. The privacy laws in those countries may not protect your information in the same way as New Zealand law.
Cookies and advertising
Cookies are small files that a website saves in your browser. We use them to keep your cart and sign-in working, remember your choices, understand how our website is used, and measure and target our advertising.
We use pixels, cookies and similar technologies from third parties, including Meta and Google, to collect information from our website and elsewhere on the internet. Those third parties use this information to provide measurement services and to target and deliver ads.
- Meta (Facebook and Instagram). The Meta Pixel on our website, and our own server, tell Meta what you view, search for, add to your cart and buy, along with your IP address, browser details and Meta's cookie IDs. When you're signed in, and when you buy online or in store and give us your email address, we also send your contact details in a scrambled (hashed) form, so Meta can match the activity to a Facebook or Instagram account without receiving the details themselves. Meta uses this to measure our ads, to show our ads to you, and for its own purposes, as set out in Meta's Privacy Policy.
- Google. We use Google Analytics to understand how people use our website. We use Google Ads to measure our ads and to show them to you. Google, as a third-party vendor, uses cookies to show our ads on websites across the internet based on your past visits to our website. When you buy online, we send Google your email address and phone number in hashed form, so it can tell us which ads led to purchases. See how Google uses information from sites that use its services.
- Klaviyo (our email provider) recognises you when you're signed in or when you enter your email address at checkout. It records the products you view and add to your cart.
- Other services on our website receive your IP address and browser details, and may set their own cookies: REVIEWS.io reviews, Google Maps and reCAPTCHA, Instagram images, our payment providers' checkout tools and Cloudflare's security checks.
| Cookie | Used by | What it's for | How long |
|---|---|---|---|
| PHPSESSID, form_key and other website cookies | Xplosiv | Keep the website working: your session, cart, sign-in and checkout | From the end of your visit to 10 years |
| persistent_shopping_cart | Xplosiv | "Remember me": keeps your cart and sign-in after you leave | 7 days |
| xplosiv_store | Xplosiv | Remembers the store you chose | 1 year |
| current_affiliate_account_code | Xplosiv | Records which affiliate referred you | 120 days |
| _ga, _ga_9X586Q85R0, wp_ga4_user_id, wp_ga4_customerGroup | Google Analytics | Tell visitors apart and measure how the website is used, including your customer number and group when you're signed in | Up to 2 years |
| _gcl_au and other _gcl_ cookies | Google Ads | Link a click on one of our ads to a purchase | 90 days |
| _fbp, _fbc | Meta | Identify your browser for advertising and analytics | 90 days |
| _wp_meta_ext_id, _wp_meta_guest_user | Xplosiv, for Meta | A random ID that links your browsing for Meta; after a guest order, your hashed contact details | 1 year; 30 days |
| __kla_id | Klaviyo | Recognises you for our emails | Up to 2 years |
| __cf_bm, cf_clearance | Cloudflare | Security checks against automated traffic | About 30 minutes |
Meta and Google also use cookies on their own websites. See Meta's Cookies Policy and Google's cookie information.
Your choices
- Marketing emails: to not sign up, untick the newsletter box at checkout or when you create an account, or tell our team in store. You can unsubscribe at any time using the link in any of our marketing emails, or by contacting us. We'll still send you emails about your orders.
- Facebook and Instagram ads: review and disconnect the information businesses share with Meta in Your activity off Meta technologies, and turn off future activity.
- Google ads and analytics: turn off personalised ads in Google's Ads Settings, and install the Google Analytics opt-out browser add-on.
- Other advertising companies: opt out of interest-based ads at aboutads.info/choices, youronlinechoices.eu and the Network Advertising Initiative.
- Cookies: you can block or delete cookies in your browser settings. If you block them all, our cart and checkout won't work.
Keeping your information safe
Our website uses encrypted connections and is protected by Cloudflare. Card payments are made on our payment provider's secure page or card terminal, passwords are stored in scrambled form, and the contact details we send to Meta and Google are hashed first. If we have a privacy breach that is likely to cause you serious harm, we'll tell you and the Privacy Commissioner.
How long we keep it
How long we keep personal information depends on why we have it. For example, we keep your account details while you have an account, and order and payment records for at least seven years, because New Zealand tax law requires it.
Your rights
You can ask for a copy of the personal information we hold about you, and ask us to correct it if it's wrong. You can also update most of your details yourself when you sign in to your account. To make a request, contact us (details below). We'll need to confirm who you are, and we'll respond within 20 working days.
If you're unhappy with how we've handled your information, please talk to us first. If we can't sort it out, you can complain to the Office of the Privacy Commissioner.
Children
We don't knowingly collect personal information from children under 13. If you think we hold information about a child, please contact us and we'll deal with it.
Changes to this policy
We'll update this policy when the way we handle personal information changes, and change the "Last updated" date at the top.
Contact us
For any questions about this policy or your personal information, contact us:
- Xplosiv Supplements Limited, 1/5 Northside Drive, Westgate, Auckland 0814
- Phone: 0800 883 371
- Email: [email protected]