Privacy notice

Who is collecting this

Annelize du Toit, operating as a sole trader in Auckland, New Zealand, as a speaker, facilitator and mentor. She is the agency responsible for this information under the Privacy Act 2020. If a company is later registered to carry on this business, this notice is updated with its name and details. For anything in this notice, write to [email protected].

The short version

• Your information is only ever collected from you, and only when you choose to send it.
• It is never sold, rented or traded. Not now, and not later.
• It is never shared for anybody else’s marketing.
• It is kept only for as long as the reason you gave it still applies, and then deleted.
• You can ask what is held, have it corrected, or have it deleted, at any time.
• Requesting a Discernment Project interview never adds you to the email list. The two are kept separate.

What is collected, and why

Three things, and only when you choose to send them.

• Enquiry form. Your name, email, and whatever else you fill in about your event or your situation. Used to reply to you and to prepare a proposal. Lawful basis under the GDPR: steps taken at your request before entering into a contract.
• Email list. Your email address, plus the date and time you confirmed. Used to send you new writing. Lawful basis: consent, which you give by clicking the link in the confirmation email and can withdraw at any time.
• Discernment Project interview requests. A request for an interview comes through the enquiry form and is handled in the same way: your name, your email address, anything else you choose to add, and whether you would like updates about the project. It is used to arrange your interview and, if you asked, to keep you updated about the project. It does not add you to the email list.

The interview itself. Before your interview you will be told in writing how it works and asked for your permission. That covers whether the conversation is recorded or notes are taken, how your personalised workbook is prepared, how what you share may be used in research, in a book or in a discernment awareness tool, whether anything is attributed to you, and how long it is kept. Nothing you share in an interview is used in those ways without that permission. This notice will be updated with those details once they are final.

You are not asked for, and should not send, information about your health, your finances, or anything else you would consider sensitive. If you do, it is treated as confidential and deleted on request.

Everything held about you was given by you, through a form on this site or in correspondence with you. Nothing is bought from a data broker, scraped from the web, enriched from a third-party database, or collected about you from anyone else. This matters under the Privacy Act 2020, which requires that information be collected directly from the person it is about wherever that is practicable, and which from May 2026 also requires that you be told when information about you has been collected from another source. There is nothing to tell you, because there is no other source.

Email marketing

The list is confirmed opt-in. You give an address, you receive one email asking you to confirm, and nothing further is sent unless you click the link in it. Every email carries a working unsubscribe link and identifies the sender, as required by the Unsolicited Electronic Messages Act 2007 in New Zealand and the Spam Act 2003 in Australia. Unsubscribing takes effect immediately.

Cookies and measurement

This site sets no cookies of its own. Visit statistics are collected through Cloudflare Web Analytics, which does not use cookies and does not fingerprint or track individuals across sites.

Advertising measurement is not currently running. If it is switched on later, it will be Google advertising cookies used only to measure which pages lead to an enquiry, denied by default, with consent asked for before anything is set. This notice will be updated on the day that changes, not after it.

Who else sees it

• Cloudflare hosts the site and processes form submissions.
• Resend sends the email.
• Google Workspace holds the mailbox the enquiry arrives in.
• Google Ads would receive conversion measurement if advertising measurement is switched on. It is not currently.

Each of these is a supplier doing a specific job on instruction. None of them is given your information to use for their own purposes.

What is never done with it

Your name, your email address and anything you write in a form are never sold, rented, traded, or handed to anybody for their own marketing. There is no arrangement under which that could happen, and there will not be one. If that position ever changes it would require your explicit consent first, asked for separately, and silence would not count as agreement.

Your information is also not used to build a profile of you, not combined with data bought from anywhere else, and not used to make an automated decision about you.

Where it goes, and why that is allowed

These providers operate servers outside New Zealand, including in the United States and the European Union. Principle 12 of the Privacy Act 2020 allows personal information to be sent overseas only in defined circumstances. The basis relied on here is that each provider is bound by a written data processing agreement requiring it to protect the information to a standard that, overall, provides safeguards comparable to those in the Act, and to act only on instruction.

These are ordinary hosting and email suppliers acting as agents, not parties given your information to use for themselves.

How long it is kept

Principle 9 of the Privacy Act 2020 says personal information must not be kept for longer than it is needed for the purpose it was collected for. So each thing has a stated life, and the clock is tied to the purpose rather than to a filing habit.

Enquiries and contact details: for as long as the working relationship lasts.

Speaking and facilitation relationships are slow. An enquiry can go quiet for a year and become a booking, and somebody who books once often books again, so the purpose here genuinely persists rather than expiring on a date. These are reviewed every three years: if there has been no contact at all in that time and you are not subscribed, they are deleted. You can ask for deletion at any point before that.

Email list: until you unsubscribe.

The purpose is to send you new writing, and that purpose lasts exactly as long as you want it to. Unsubscribing ends it. Your address is then removed, and a record that it unsubscribed is kept only so that you are not accidentally added again.

Discernment Project interview requests: as enquiries, above.

Deleted on request at any time.

What you share in an interview: as set out before the interview.

How long interview material is kept, and in what form, is part of what you are told and asked to agree to before you take part.

Site statistics: no personal information, so nothing to keep.

Visit counts are aggregate and cannot be traced to a person.

If you ask for your information to be deleted before these periods are up, it is deleted, unless there is a legal reason it has to be kept, in which case you are told what that reason is.

Your rights

Under the Privacy Act 2020 you can ask for a copy of the personal information held about you, and ask for it to be corrected. Under the UK and EU GDPR, if you are in the UK or the EU, you can also ask for it to be deleted, restricted, or provided in a portable format, and you can object to how it is used.

Write to [email protected]. Requests are answered within 20 working days under the Privacy Act, and within one month under the GDPR.

If you are unhappy with the response, you can complain to the New Zealand Office of the Privacy Commissioner, free of charge, at privacy.org.nz or on 0800 803 909. If you are in the UK or the EU you can also complain to your own supervisory authority.

Security, and what happens if something goes wrong

The site is served over HTTPS. Form submissions are transmitted encrypted. Access to the mailbox is protected by two-factor authentication.

If a privacy breach occurs that is likely to cause serious harm, the Office of the Privacy Commissioner and the people affected are notified, as the Privacy Act 2020 requires. Where the GDPR applies, the relevant supervisory authority is notified within 72 hours.

Changes

Any change is published here with a new date at the top. Material changes affecting people on the email list are sent to that list.