Legal
How Surf Digital collects, uses, and protects information from website visitors, campaign applicants, clients, and the prospects contacted through our cold email and LinkedIn services.
Surf Digital Limited (“Surf Digital”, “we”, “us”), based in Auckland, New Zealand, provides cold email and LinkedIn outreach services to marketing agencies and other B2B businesses. This Privacy Policy explains what information we collect through surf-digital.com (the “Website”) and in the course of providing our Services, why we collect it, who we share it with, and the rights you have over it.
This Policy is written to meet our obligations under the Privacy Act 2020 (New Zealand). Because our clients and the prospects contacted on their behalf are often based in Australia and elsewhere, we also have regard to relevant overseas privacy laws, such as the Australian Privacy Principles and, where they apply, the EU/UK GDPR.
To run cold email and LinkedIn outreach campaigns on behalf of clients, we source, hold, and process business contact information about the prospects targeted in a campaign — typically a prospect's name, job title, company, business email address, and, for LinkedIn outreach, publicly available LinkedIn profile information. We also process the outreach messages sent and any replies received, so that performance can be tracked and replies can be actioned. We process this prospect data as a service provider acting on behalf of our client for that campaign, not for our own independent marketing purposes.
When you browse the Website, we and our analytics providers automatically collect technical information such as your IP address, browser and device type, pages viewed, and how you interact with the Website. See Section 4 (Cookies and analytics) for details.
We use the information described above to:
We do not sell personal information. We do not use the prospect data we process on a client's behalf for our own marketing purposes.
The Website uses the following analytics, advertising, and scheduling tools. We have not enabled any tool on the Website beyond those listed here.
We use Microsoft Clarity to understand how visitors interact with the Website. Clarity uses cookies and similar technologies to collect information such as session recordings, heatmaps, clicks, scrolling and navigation behaviour, and browser and device information, so we can see how people use our pages and improve them. This data is processed by Microsoft under Microsoft's own privacy terms; we have not configured Clarity to mask or exclude specific page fields, so avoid entering sensitive information (for example, financial account details) into any form field on the Website if you would prefer it not be captured in a session recording. For more information, see Microsoft's Privacy Statement and Microsoft Clarity's documentation on the cookies it sets.
We use Google's tagging (gtag.js) to run Google Analytics and Google Ads conversion tracking. This collects information about pages visited, general location, device and browser information, and, when you arrive via a Google Ads campaign or complete an action such as booking a call, records that conversion event. This data is processed by Google under Google's Privacy Policy.
Our booking widget and call-booking links use Calendly. When you use Calendly to book a call, Calendly processes your booking information under its own privacy terms, and shares the details of the booking with us. If you complete a booking, we detect that event (via a message Calendly sends the page) to record a conversion for our own analytics — we do not receive anything beyond the booking confirmation itself through this mechanism. See Calendly's Privacy Notice.
Most browsers let you block or delete cookies through their settings. Blocking cookies may affect how some parts of the Website work, such as the Calendly booking widget.
We share information with the service providers we use to run the Website and deliver the Services, including:
We may also disclose information where required by law, to enforce our Terms of Service or a Service Agreement, or in connection with a business transfer (for example, a merger or sale of assets), in which case we would take reasonable steps to ensure the recipient continues to protect your information consistently with this Policy.
Several of the providers listed in Section 5 — including Google, Microsoft, Calendly, Resend, Web3Forms, Wise, and Stripe — store or process data outside New Zealand, including in Australia, the United States, and other countries where they operate. Where we disclose personal information to an overseas provider, we rely on the provider's own compliance obligations (including, for major providers, their standard contractual and security commitments) and take reasonable steps to ensure the information receives comparable protection to that required under New Zealand law.
We keep personal information for as long as needed for the purpose it was collected — for example, client and Service Agreement records for as long as needed for our accounting, tax, and legal obligations, and campaign and prospect data for the duration of the relevant campaign and a reasonable period afterward for record-keeping and to honour do-not-contact requests. We delete or anonymise information once it is no longer needed, unless we are required to keep it for legal or accounting reasons.
We take reasonable technical and organisational steps to protect the information we hold from loss, misuse, and unauthorised access, including restricting access to client and prospect data to the people who need it to deliver the Services. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Under the Privacy Act 2020, you have the right to ask us to confirm what personal information we hold about you, to access it, and to ask us to correct it if it is inaccurate. You can also ask us to delete personal information we hold about you, and we will do so unless we have a lawful reason to keep it (for example, an ongoing accounting or legal obligation).
If you are a prospect who has received a cold email or LinkedIn message from us on behalf of a client and would like to be removed from future outreach, you can reply to that message, use any unsubscribe link provided, or contact us directly at thomas@surf-digital.co and we will add you to the relevant campaign's do-not-contact list.
To make an access, correction, or deletion request, email thomas@surf-digital.co. If you are not satisfied with our response, you can contact the New Zealand Office of the Privacy Commissioner.
We may update this Privacy Policy from time to time, including to reflect a new tool or service provider. We will update the "Last updated" date above when we do, and encourage you to review this page periodically.
For any question about this Privacy Policy or how we handle your information, email us at thomas@surf-digital.co. Surf Digital Limited is based in Auckland, New Zealand.
