1. Who We Are
Aho Farms Limited ("Aho Farms", "we", "us", or "our") is a New Zealand company registered under the Companies Act 1993, operating a licensed medicinal cannabis cultivation and supply business from Hawke's Bay, New Zealand.
We are committed to protecting the privacy of individuals who interact with our website, and we handle all personal information in accordance with the Privacy Act 2020 (NZ) and the thirteen Information Privacy Principles (IPPs) it contains.
Privacy Officer: admin@ahofarms.com | Aho Farms Limited, Hawke's Bay, New Zealand
2. What Information We Collect
We collect personal information only where it is necessary for a legitimate business purpose. The types of information we collect depend on how you interact with our website:
Contact Form Submissions
When you submit an enquiry through our website contact form, we collect: your name, email address, organisation or company name, and the content of your message. This is the minimum required to respond meaningfully to your enquiry.
Consumer Portal Enquiries
When you ask to be connected with a prescriber through our Consumer Portal, we collect: your name, email address, mobile number, country and region, your contact and consultation preferences, how you heard about us, and any message you choose to leave, together with confirmation that you meet the applicable age requirement and your consent. We do not ask for medical information. We use these details to identify the approved independent prescriber partner for your market, to make the introduction (by email, referral link or QR code) and to follow up on your enquiry, and we share them only with that partner. Enquiries are stored securely with a reference code and referral status so we can support you and measure the pathway.
Newsletter Subscriptions
If you subscribe to our professional newsletter, we collect your email address and optionally your professional category (e.g. GP, pharmacist, nurse practitioner) so we can send relevant content.
Website Analytics
We collect anonymised analytics data through Google Analytics 4, including: page views, session duration, device and browser type, and referral source. IP addresses are anonymised before storage. This data does not identify you personally.
Cookies
Our website uses cookies, small text files stored on your device. See Section 7 for full details of our cookie use.
3. Why We Collect It
We collect and use personal information for the following purposes, each of which constitutes a lawful basis under the Privacy Act 2020:
- To respond to enquiries, so we can provide timely and relevant responses to messages submitted via our contact form.
- To verify professional registration, to confirm that portal access requests are made by eligible healthcare professionals, as required by our licence conditions.
- To send newsletters, to deliver professional updates, product information, and regulatory news to opted-in subscribers only.
- To improve our website, anonymised analytics data helps us understand how our site is used and where we can make improvements.
- To comply with legal and regulatory obligations, we may be required by law to retain certain records or disclose information to regulators, including the Ministry of Health, Medsafe, or the New Zealand Police.
We do not use your personal information for automated decision-making, profiling, or any purpose unrelated to the above.
4. How We Store and Protect It
We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, use, modification, or disclosure.
- Contact form data is stored in HubSpot CRM, a US-based platform operating under an EU, US Data Privacy Framework and data processing agreements that provide equivalent protections to NZ law.
- Analytics data is processed by Google Analytics 4 with IP anonymisation enabled. No personally identifiable information is stored in GA4.
- Newsletter subscriber data is stored in Mailchimp (Intuit Inc.), under data processing agreements consistent with our obligations under the Privacy Act 2020.
- Portal access credentials are managed with industry-standard security practices. Passwords are hashed and salted, they are never stored in plaintext.
- No sensitive health or patient data is collected or stored on our systems. We are not a healthcare provider and do not collect clinical information.
- Data retention: We retain personal information for a maximum of three years from the date of last interaction, after which it is securely deleted or anonymised. Portal access credentials are removed upon deactivation of the account.
5. Who We Share It With
We do not sell, rent, or trade your personal information. We share information only with the following third-party service providers, each under a data processing agreement:
- HubSpot, Inc.CRM and contact management (United States)
- Google LLCWebsite analytics via Google Analytics 4 (United States)
- Mailchimp (Intuit Inc.)Email newsletter distribution (United States)
All third-party providers are contractually bound to use your information only for the purpose for which it was shared, and to maintain appropriate security standards.
We may also disclose personal information if required to do so by New Zealand law, or in response to a lawful request from a government agency or regulatory body (including the Ministry of Health, Medsafe, New Zealand Police, or the Office of the Privacy Commissioner).
We will not disclose personal information to overseas recipients beyond those listed above without first taking reasonable steps to ensure that the recipient provides comparable privacy safeguards.
6. Your Rights Under the NZ Privacy Act 2020
Under the Privacy Act 2020, you have the following rights in relation to personal information we hold about you:
- Right of access (IPP 6): You may request a copy of personal information we hold about you.
- Right to correction (IPP 7): If you believe information we hold is inaccurate, incomplete, or misleading, you may request that we correct it.
- Right to request deletion: While not an absolute right under NZ law, we will consider requests to delete personal information where it is no longer needed for the purpose for which it was collected.
- Right to unsubscribe: You may opt out of newsletter communications at any time using the unsubscribe link in any email, or by contacting us directly.
To exercise any of these rights, please contact our Privacy Officer at admin@ahofarms.com. We will acknowledge your request and respond within 20 working days, as required by the Privacy Act 2020. If we are unable to meet this timeframe, we will notify you and provide a revised date.
If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner: www.privacy.org.nz.
7. Cookies
Our website uses the following categories of cookies:
Essential Cookies
These cookies are necessary for the website to function. They manage your session, remember cookie consent preferences, and enable secure access to portals. You cannot disable essential cookies without affecting site functionality, and no consent is required to set them.
Analytics Cookies
We use Google Analytics 4 cookies (_ga, _ga_*) to collect anonymised data about how visitors use our website. These cookies are only set with your consent. You can accept or decline analytics cookies via the CookieYes consent banner displayed on your first visit.
Declining analytics cookies will not affect your ability to browse the website or access any public-facing content.
You can manage or withdraw your cookie consent at any time by clicking the "Cookie Settings" link in the footer.
8. Children
This website is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from someone under 18, we will promptly delete it. If you believe a minor has submitted information to us, please contact us at admin@ahofarms.com.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance. The "Last updated" date at the top of this page will reflect when the policy was most recently revised.
If we make material changes to how we collect or use personal information, we will notify users via a notice on our website homepage for a reasonable period. We encourage you to review this policy periodically.
10. Contact Us
For any questions, requests, or concerns relating to your privacy or this policy, please contact our Privacy Officer:
Privacy Officer
Aho Farms Limited
Hawke's Bay, New Zealand
admin@ahofarms.com
If you believe Aho Farms has interfered with your privacy in a way that breaches the Privacy Act 2020, you may make a complaint to the Office of the Privacy Commissioner:
- Website: www.privacy.org.nz
- Phone: 0800 803 909
We recommend contacting us first, as we are committed to resolving privacy concerns directly and promptly.