1. Who I am
This site, cutthewaffle.nz, and the services it advertises are operated by Ben Harris, trading as Cut the Waffle, based in Auckland, New Zealand.
For privacy questions: hello@cutthewaffle.nz
For NZ Privacy Act purposes, I'm the "agency" handling your personal information. For GDPR purposes (if you're in the UK or EU), I'm the "data controller". For the Australian Privacy Principles, I'm the "APP entity".
2. What personal information I collect
From you directly (when you contact me)
- Name - so I can address you properly when I reply.
- Email address - so I can reply at all.
- Company name and one-liner - so I know what you do before the call.
- Service interest - what you selected in the form dropdown.
- Your message - anything you tell me about your situation.
Automatically (when you visit the site)
- Google Analytics 4 (GA4) - anonymised page views, session duration, referral source, country, device type, browser. Used to understand which content is working. IP addresses are anonymised before storage.
- Microsoft Clarity - anonymised session recordings and heatmaps. Used to spot UX issues. Clarity automatically masks sensitive form fields and personal text.
- Server access logs - standard web server logs (IP, timestamp, page requested) kept for security and debugging, typically rotated within 30 days.
What I do not collect
- Payment card details (any future billing goes through Xero / Stripe / Wise - see their policies).
- Sensitive personal information (health, race, religion, sexual orientation, etc.).
- Information about anyone under 18 (this site is not intended for minors).
3. Why I collect it (purpose and legal basis)
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Your contact form details | To respond to your enquiry and, if you become a client, to deliver the work. | Consent (you submitted the form) + contract performance once you're a client. |
| Email correspondence | Ongoing communication about your project, proposals, invoices. | Contract performance + legitimate interest. |
| Analytics data (GA4 / Clarity) | To improve the site, understand which content lands, fix UX issues. | Legitimate interest + consent where required by EU/UK law. |
| Server logs | Security, fraud prevention, debugging. | Legitimate interest. |
4. Who I share your information with
Short answer: nobody, unless one of these applies.
- Service providers I use to run the business - Google (Analytics + workspace email), Microsoft (Clarity), my web host, accounting software (Xero), payment processors (Stripe / Wise when you become a paying client). They process data on my behalf under their own privacy policies.
- Legal obligation - if I'm legally required to disclose (court order, regulator request).
- Sale or transfer of the business - if I ever sell or transfer Cut the Waffle, your data may transfer to the new operator under the same privacy commitments.
I do not sell, rent, or trade your personal information to anyone. Ever.
5. International data transfers
Some of my service providers (Google, Microsoft) store and process data outside of New Zealand, including in the United States, the European Economic Area, and other jurisdictions. Where this happens, I rely on those providers' Standard Contractual Clauses, adequacy decisions, or equivalent safeguards. If you're in the UK or EU, your data is protected under the GDPR / UK GDPR by those mechanisms.
6. How long I keep your information
- Contact form submissions - kept in email for as long as the conversation is active, then archived. Deleted on request.
- Client records - kept for 7 years after the engagement ends, to satisfy NZ tax and record-keeping obligations.
- Analytics data - GA4 default retention (14 months). Clarity default retention (30 days for session recordings).
- Server logs - typically 30 days.
7. Your rights
Under the NZ Privacy Act 2020 (and equivalent rights under GDPR for UK/EU residents, and the Australian Privacy Principles for Australian residents), you have the right to:
- Access - ask what personal information I hold about you.
- Correct - ask me to correct anything that's wrong or out of date.
- Delete - ask me to delete your data, subject to legal obligations to retain records (tax, accounting).
- Object - to direct marketing or to processing based on legitimate interest.
- Portability (GDPR) - get a copy of your data in a machine-readable format.
- Withdraw consent - at any time, for any processing that's based on consent.
- Complain - to the NZ Privacy Commissioner, the UK ICO, the Australian OAIC, or your local data protection authority.
To exercise any of these rights, email hello@cutthewaffle.nz with the subject line "Privacy request". I'll respond within 20 working days (NZ standard).
8. Cookies and tracking
This site uses a small number of cookies and similar tracking technologies:
- Essential cookies - required for the site to work (none currently, the site is largely static).
- Analytics cookies (GA4) - track usage patterns. Anonymised. Set by
googletagmanager.com. - Behaviour cookies (Microsoft Clarity) - record anonymised session behaviour for UX research. Set by
clarity.ms.
You can disable cookies in your browser settings. The analytics ones won't affect site functionality if turned off.
9. Security
The site runs over HTTPS with HSTS enabled. Server-level security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are in place. Personal information collected via the contact form is sent to my email and handled inside Google Workspace, which has its own enterprise-grade security. No system is perfectly secure, but I take this seriously.
10. Children's privacy
Cut the Waffle's services are for B2B buyers, founders, and marketers. The site is not intended for, marketed to, or designed for anyone under 18. If you're under 18, please don't submit personal information through the site.
11. Third-party links
Blog posts and other pages may link to third-party sites (LinkedIn, validator tools, etc.). I'm not responsible for the privacy practices of those sites. Check their privacy policies before submitting personal information to them.
12. Changes to this policy
If I make material changes, I'll update the "Last updated" date at the top and, for significant changes that affect existing clients, I'll email you directly. Minor changes (typos, clarifications) are made without notice.
13. Contact
Privacy questions, requests, or complaints:
- Email: hello@cutthewaffle.nz
- Subject line: "Privacy request" - gets routed straight to me.
- Response time: within 20 working days.