Privacy policy

Introduction

Druid Lab Limited (Druid Lab) complies with the New Zealand Privacy Act 2020 (the NZPA), the General Data Protection Regulation 2016/679 of the European Union (GDPR), the UK Data Protection Act 2018 and UK GDPR as that term is defined in that Act (together, UK Data Protection Laws), the California Consumer Privacy Act 2018 (CCPA) and other applicable privacy and data protection laws, (together, applicable privacy laws) when dealing with personal information.  

Personal information is information about an identifiable individual (a natural person), and includes personal data, personally identifiable information and equivalent information under applicable privacy laws.  Under GDPR, UK Data Protection Laws, and some other applicable privacy laws, personal information is called personal data – Druid Lab uses these terms interchangeably in this policy.

This policy sets out how Druid Lab will collect, use, disclose and protect your personal information.  Druid Lab does not collect or process all types of personal information.  Druid Lab does not process, and you must not provide to Druid Lab, or use Druid Lab’s website or any of Druid Lab’s services and products to process, personal information that is regulated by:

• the Payment Card Industry Data Security Standards (PCI DSS)
• the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

This policy does not limit or exclude any of your rights under applicable privacy laws.  

This policy was drafted with brevity in mind.  It does not provide exhaustive details of all aspects of Druid Lab’s collection and use of personal information.  Druid Lab is happy to provide any additional information or explanation.  Any request for further information should be sent to compliance@druidlab.com.

Changes to this policy

Druid Lab may change this policy by uploading a revised policy onto Druid Lab’s website.  The change will apply from the date that Druid Lab uploads that revised policy.  

This policy was last updated on 1 September 2025.

When does this privacy policy apply?

This privacy policy applies to personal information that Druid Lab collects from visitors to Druid Lab’s website, Druid Lab’s customers, and other persons with whom Druid Lab deals directly.  

In addition, Druid Lab, on behalf of its customers, may collect personal information from individuals (e.g. individuals inputting details into Druid Lab’s software relating to an IT issue on the individual’s device) and upload or process that information on or through Druid Lab systems.  That information is described in this policy as User Data.

We require our customers to obtain the necessary consents from individuals to provide User Data to us and permit us to use it as set out in this privacy policy.  If you have any concern about our collection and use of personal information about you contained in User Data, please contact us at privacy@druidlab.com.

For the purposes of GDPR and UK Data Protection Laws:

• Druid Lab customers are the data controller when storing or processing User Data and Druid Lab is the data processor; but
• Druid Lab stores and uses device identifiers (which forms part of the User Data) to determine licensing metrics.  In that storage and use, Druid Lab is the data controller.

Druid Lab only processes User Data as authorised by Druid Lab’s customers in Druid Lab’s EULA or separate agreements with those customers.  Unless required otherwise under applicable privacy laws, if Druid Lab receives any request or enquiry relating to User Data, Druid Lab will forward this request to the relevant customer.  If we receive any request or enquiry relating to User Data that we use for our own purposes, we will deal with this request or enquiry as set out in this privacy policy.

Children

Druid Lab does not intend to collect personal information from or about children aged under 16.  If you have reason to believe that Druid Lab has collected personal information from or about a child under the age of 16, please contact Druid Lab at privacy@druidlab.com.

What personal information does Druid Lab collect?

Directly from you

Druid Lab collects the following information directly from you.  

When you contact Druid Lab, or register with Druid Lab, subscribe to Druid Lab’s newsletter, or complete a website form, Druid Lab collects your name, email address, phone number, role, organisation name, location, and any other information Druid Lab requires or asks for to fully respond to you.  Druid Lab may collect some of this information using third-party authentication services.

When you purchase services and products from Druid Lab, Druid Lab collects your name, email address, nationality, and professional details (your work email, job title/position, work name, industry, and work country, city, and region), and any other information you submit to Druid Lab for service fulfilment purposes.

When Druid Lab bills you, Druid Lab collects your invoicing/billing address, email address, service/product description, purchase order number (if applicable), and any other information you submit to Druid Lab for billing purposes.

Some of the personal information that Druid Lab collects directly from you may be mandatory and some may be optional.  Druid Lab will let you know which of these applies at the time Druid Lab collects the relevant personal information.  While you do not have to provide Druid Lab with any of the information that Druid Lab may request, this might mean that Druid Lab cannot provide all or part of its services and products to you, or they may not perform as well as they should.  If you require further information about the consequences of not providing Druid Lab with any personal information, please contact Druid Lab at privacy@druidlab.com.

We use a third party service provider to process credit card transactions.  We do not have access to your credit card information.  The name of this third party provider will generally be displayed when you are requested to enter your credit card information.  You can see further information about how they process your credit card information in their privacy policy.

If possible, Druid Lab will collect personal information directly from you.

Automatically

When you access and use Druid Lab’s website or related services and products, Druid Lab may automatically collect information about your device and usage of Druid Lab’s website and services and products, including your IP address and/or other device identifying data, time spent on certain pages of the website, pages visited, and links clicked.

Some of this data is collected through third party tools and/or the use of cookies, web beacons and similar storage technologies.  Please refer to Druid Lab’s cookie policy set out in Appendix A for more information on Druid Lab’s use of cookies, including information on how you can disable these technologies.

From public sources and other third parties

Druid Lab may collect personal information about you that is publicly available, including using third party sources (e.g. data brokers and providers of natural language processing and artificial intelligence services) to collect and supply to Druid Lab that publicly available personal information.  
Druid Lab may otherwise collect personal information about you from third parties where you have consented to, or authorised, this.  

Druid Lab may link personal information collected from public sources and other third parties with personal information supplied by you or supplied automatically.

How Druid Lab uses your personal information

Druid Lab may use your personal information (including personal information collected from public sources and other third parties) for our legitimate interests to:

• provide Druid Lab’s website, and services and products, to you or to a business that you work in or that provides services to you, including to confirm licensing metrics and pricing (which is based on user and/or device numbers)
• market Druid Lab’s services and products to you, including contacting you electronically (e.g. by text or email for this purpose)
• improve Druid Lab’s website, and services and products, and to improve the user experience related to that, including to enable Druid Lab users to identify new customers
• bill you and collect money that you owe Druid Lab, including authorising and processing credit card transactions
• respond to communications from you, including orders, enquiries and complaints
• conduct research and statistical analysis (on an anonymised basis)
• protect and/or enforce Druid Lab’s legal rights and interests, including defending any claim
• respond to lawful requests by public authorities, including to comply with law enforcement requirements,
• or for any other purpose authorised by you or applicable law (including applicable privacy laws).

Druid Lab may transfer your information in the case of a sale, merger, consolidation, liquidation, reorganisation or acquisition.

You can stop receiving our marketing emails by following the unsubscribe instructions included in those emails.

Disclosing your personal information

Druid Lab may disclose your personal information to:

• another company within the Druid Lab group
• any business that supports Druid Lab’s website, and services and products, any person that hosts or maintains any underlying IT system or data centre that Druid Lab uses to provide its website, or services and products, or that Druid Lab uses to process payments
• third parties (for anonymized statistical information)
• professional advisers e.g. accountants, lawyers or auditors
• a person who can require Druid Lab to supply your personal information (e.g. a law enforcement agency or regulatory authority)
• any other person with your consent
• any other company in the case of a sale, merger, consolidation, liquidation, reorganization or acquisition
• any other person authorised by applicable law. 

International transfers of personal information

A business that supports Druid Lab’s website, and services and products, may be located outside of New Zealand (the country where Druid Lab is incorporated) and also outside of the country where you are located, e.g. we currently process data through in secure servers in the United States of America.  This means that the personal information Druid Lab collects may be transferred to, and stored in, a country outside of New Zealand and the country where you are located.

If you are located in the European Union (EU), your personal information may be transferred outside of the European Economic Area (EEA).  Under GDPR, the transfer of personal information to a country outside the EEA may take place where the European Commission has decided that the country ensures an adequate level of protection.  In the absence of an adequacy decision, Druid Lab may transfer personal information if other appropriate safeguards are in place.

If you are located in the United Kingdom (UK), your personal information may be transferred outside of the UK.  Under the UK Data Protection Laws, the transfer of personal information to a country outside the UK may take place where the UK government has decided that the country ensures an adequate level of protection.  In the absence of an adequacy decision, Druid Lab may transfer personal information if other appropriate safeguards are in place.

Where Druid Lab transfers personal information outside the EEA or UK, it will only be transferred to countries that have been identified as providing adequate protection for EU/UK data (and, if a sub-processor is relying on a country-specific adequacy decision, to a sub-processor who meets any applicable condition or requirement set out in that decision), or to a third party where approved transfer mechanisms are in place to protect your personal information (e.g. by entering into Standard Contractual Clauses or the UK’s International Data Transfer Addendum to the Standard Contractual Clauses).  For further information, please contact Druid Lab at privacy@druidlab.com.

Some of the personal information Druid Lab collects is processed in New Zealand.  New Zealand is recognised by the European Commission and the UK adequacy regulations as a country that has an adequate level of data protection and Druid Lab relies on this decision in transferring personal information to New Zealand.

Protecting your personal information

As required by applicable law, Druid Lab will take steps to keep your personal information safe from loss, unauthorised activity, or other misuse.  Druid Lab implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks inherent in processing personal information.  

If you would like further information on those measures, please contact Druid Lab at privacy@druidlab.com. 

Accessing and correcting your personal information

Subject to certain grounds for refusal under applicable privacy laws, you have the right to access your personal information that Druid Lab holds and to request a correction to your personal information.  Before you exercise this right, Druid Lab will need evidence to confirm that you are the individual to whom the personal information relates.

Where you request a correction, if Druid Lab thinks the correction is reasonable and Druid Lab is reasonably able to change your personal information, Druid Lab will make the correction.  In all other cases, Druid Lab will take reasonable steps to make a note of the personal information that was the subject of your correction request.

If you want to exercise either of the above rights, email Druid Lab at privacy@druidlab.com.  Your email should provide evidence of who you are and set out the details of your request (e.g. the personal information to be corrected and the correction that you are requesting).

Subject to applicable law, Druid Lab may charge you its reasonable costs of providing you copies of your personal information or correcting that information.  

Other rights

In addition to the rights to access and correct your personal information, if you are based in:

• the EU or UK, you have the additional rights set out in the EU and UK Additional Terms set out in Appendix B
• California, you have the additional rights set out in the CCPA Additional Terms set out in Appendix C.

Internet use

While Druid Lab takes reasonable steps to maintain secure internet connections, if you provide Druid Lab with personal information over the internet, the provision of that information is at your own risk.

If you follow a link on Druid Lab’s website to another website, the owner of that website will have its own privacy policy relating to your personal information.  Druid Lab suggests you review that website’s privacy policy before you provide personal information to that owner or website.

Data retention policy

The personal information that Druid Lab collects and uses will not be kept longer than necessary for the purposes for which it is collected, or for the duration required for compliance with applicable law, whichever is longer.  

Contacting Druid Lab

If you have any question about this privacy policy or Druid Lab’s privacy practices, or if you would like to request access to, or correction of, your personal information, you can contact Druid Lab at privacy@druidlab.com.

Introduction

When you visit or log on to Druid Lab’s website and/or use Druid Lab’s services and products, Druid Lab, and its online data partners or vendors, use cookies (alphanumeric identifiers that transfer to your computer’s hard drive so that Druid Lab can recognise your browser) and similar technologies to monitor your use of the website and the services and products and to receive information collected through cookies.  This cookie policy explains how Druid Lab uses cookies and how you can opt out of cookies.
When Druid Lab refers to a cookie, it covers the use of cookies, web beacons, APIs, clear GIFs, pixel tags, and similar storage technologies.

Druid Lab and its partners and vendors use cookies to:

• monitor your use of Druid Lab’s website, services and products
• enable you to maintain your session using the website, service and/or product
• track your activity using the website, service and/or product.  

You may disable cookies by changing the settings on your browser, although this may mean that you cannot use all of the features of the website, services or products.  This is discussed in more detail below.

What are cookies

Cookies are text files containing small amounts of information which are downloaded to your browsing device, e.g. a computer or smartphone, when you visit a website.  Cookies can be recognised by the website that downloaded them, or by other websites that use the same cookies.  This helps a website know if the browsing device has visited that or other websites before.  

Cookies can be used to collect information relating to your use of a website or your device, let you navigate between pages effectively, help to remember your preferences and generally improve your browsing experience.  

Cookies can be session or persistent cookies.  Session cookies are temporary and only stay on your browser until you stop browsing.  Persistent cookies stay on your device until they expire or are deleted.

The cookies used on the website and as part of the services and products may be first party cookies (i.e. set by Druid Lab) or third party cookies (i.e. cookies set on the website by a person other than Druid Lab).

The third party companies that place cookies on Druid Lab’s website will have their own privacy policies. 

What types of cookies does Druid Lab use

The types of cookies used by Druid Lab, and most websites, can generally be categorised as follows.

Strictly necessary cookies

These cookies are essential for the full functionality of the website, services and/or products.  They enable you to navigate around the website, service and/or product, and use their features, e.g. accessing secure areas and enabling the service or product that you have asked to receive.  If you opt out of these cookies, you may not be able to access all the functions of the website and some parts of the service and/or product, that you have asked to receive.  

These cookies do not track where else you have been on the internet and do not remember your preferences beyond your current visit.  These cookies are generally first party session cookies which will expire when you close your browsing session.  These cookies do not collect information that could be used for marketing purposes.

Functionality cookies

These cookies allow a website to remember choices you make and provide enhanced, more personal features.  E.g. these cookies allow Druid Lab to remember the settings you have applied to the website, service and/or product, identify whether you are a returning visitor and present you with a personalised version of the website, service and/or product, or eliminate the need for you to re-enter your login details.

The information these cookies collect is generally anonymous and they do not track your browsing activity on other websites.  These cookies may be first or third party, session or persistent cookies

Performance cookies

These cookies collect information about how you use a website, e.g. which pages are the most visited and if you receive any error message from any page.  This information helps Druid Lab improve the way the website, services, and products work, and helps Druid Lab manage the performance and design.  These cookies do not gather information that identifies you.  All of the information these cookies collect is aggregated and anonymous.  These cookies may be first or third party, session or persistent cookies.

Google cookies

Druid Lab uses Google Analytics to collect information about visitors to the website, services and products.  Google Analytics collects information related to your device, browser, IP address, network location, and website activities to measure and report statistics about your interactions on the website, services and products.  Druid Lab uses this information to help it manage the performance and design of the website, services, and products, and to improve the website, services and products.

We use Google Analytics Advertising Features, including Remarketing with Analytics, Demographic and Interests reporting in Analytics, Campaign Manager integration (formerly known as DoubleClick), Display & Video 360 integration, Google Display Network (GDN) Impression Reporting and Segments.  We also use Google Ads.  

For further information on how Google uses your personal information when you use the website, service and/or product, and how to opt out of Google’s use of cookies, see here.  In addition to the process described in this link, you can opt out using the process described below.

How to control or opt out of cookies

You can control and/or delete cookies as you wish.  You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed.  However, if you do this, you may have to manually adjust some preferences every time you visit the website and attempt to use the service and/or products, you may not be able to access certain parts of the website, service and/or products, and some functionalities may not work.  

You can find out more information about how to change your browser cookie settings at www.aboutcookies.org.uk.  

To learn more about how to control cookie settings through your browser:

• click here to learn more about the Private Browsing setting and managing cookie settings in Firefox
• click here to learn more about Incognito and managing cookie settings in Chrome
• click here to learn more about InPrivate and managing cookie settings in Internet Explorer
• click here to learn more about Private Browsing and managing cookie settings in Safari.

Third party website cookies

If you follow a link on Druid Lab’s website to another website, the owner of that website will have its own cookies.  Druid Lab suggests you review that website’s cookie policy before you visit that website.

This Appendix B sets out additional details about the personal information Druid Lab collects about individuals located in the EU or the UK and the rights afforded to them under GDPR and/or UK Data Protection Laws.

Lawful basis for processing personal information

Druid Lab’s lawful basis for processing (as that term is defined in GDPR and UK Data Protection Laws) personal information that Druid Lab collects, uses and discloses depends on the personal information collected and the context in which Druid Lab collects it.  

Generally, Druid Lab collects personal information from you where Druid Lab has your consent, where processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, or where processing is necessary for the purposes of Druid Lab’s legitimate interests (except where such interests are overridden by your interests or fundamental rights and freedoms).  

Where Druid Lab processes personal information based on your consent, you may withdraw your consent at any time.  

Despite the above, Druid Lab may process your personal information where such processing is necessary for compliance with applicable laws.

If you have any question about the legal basis on which Druid Lab processes personal information or need further information, please contact Druid Lab at privacy@druidlab.com.

Your rights under GDPR and UK data protection law

If you are located in the EU or the UK, your rights in relation to your personal information include: 

• right of access – if you ask Druid Lab, Druid Lab will confirm whether Druid Lab is processing your personal information and will provide you with a copy of that personal information
• right to rectification - if the personal information Druid Lab holds about you is inaccurate or incomplete, you have the right to have it rectified or completed.  Druid Lab will take reasonable steps to ensure inaccurate personal information is rectified.  If Druid Lab has shared your personal information with any third party, Druid Lab will tell them about the rectification where possible
• right to erasure – when your personal information is no longer needed for the purposes for which you provided it, Druid Lab will delete it.  You may request that Druid Lab deletes your personal information and Druid Lab will do so if deletion does not contravene any applicable law.  If Druid Lab has shared your personal data with any third party, Druid Lab will take reasonable steps to inform those third parties that they must delete your personal information
• right to withdraw consent - if the basis of Druid Lab’s processing of your personal information is consent, you can withdraw that consent at any time
• right to restrict processing - you may request that Druid Lab restricts or blocks the processing of your personal information in certain circumstances.  If Druid Lab has shared your personal information with any third party, Druid Lab will tell them about this request where possible 
• right to object to processing - you may request that Druid Lab stops processing your personal information at any time and Druid Lab will do so to the extent required by GDPR and/or UK Data Protection Laws
• rights related to automated decision-making, including profiling - you have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such automated decision-making is necessary for entering into, or the performance of, a contract with you, is authorised by applicable laws or is based on your explicit consent 
• right to data portability - you may obtain your personal information from Druid Lab that you have consented to give Druid Lab or that is necessary to perform a contract with you.  Druid Lab will provide this personal information in a commonly used, machine-readable and interoperable format to enable data portability to another data controller.  Where technically feasible, and at your request, Druid Lab will transmit your personal information directly to another data controller
• the right to complain to a supervisory authority - you can report any concern you have about Druid Lab’s privacy practices to your local data protection authority.

Where personal information is processed for the purposes of direct marketing, you have the right to object to such processing, including profiling related to direct marketing. 

If you would like to exercise any of your above rights, please contact Druid Lab at privacy@druidlab.com.  If you are not satisfied by the way Druid Lab deals with your query, you may refer your query to your local data protection authority.

The CCPA provides consumers that are California residents with specific rights regarding their personal information.  This Appendix C provides additional details about the personal information Druid Lab collects about Californian consumers and the rights afforded to them under CCPA.

Any term defined in the CCPA have the same meaning when used in this Appendix C.

Collection, using, and sharing information

For more details about the personal information Druid Lab has collected over the last 12 months, including the categories of sources, please see the What Personal Information Does Druid Lab Collect section above.  Druid Lab collects this information for the business and commercial purposes described in the How Druid Lab Uses Your Personal Information section above.  Druid Lab shares this information with the categories of third parties described in the Disclosing Your Personal Information section above.  

Druid Lab does not sell the personal information Druid Lab collects.

Your California privacy rights

If you are a California resident, you have the following rights:

• right to know - you have the right to request that Druid Lab disclose certain information to you about Druid Lab’s collection and use of your personal information over the past 12 months
• right to delete - subject to certain exceptions, you have the option to delete personal information about you that Druid Lab has collected from you
• right to non-discrimination - you have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations
• right to opt-out of sale – Druid Lab does not sell your personal information, so Druid Lab does not offer an opt out.

To exercise the rights described above, please submit a request to Druid Lab by emailing Druid Lab at privacy@druidlab.com.  Requests for access to or deletion of personal information are subject to Druid Lab’s ability to reasonably verify your identity in light of the information requested and relevant CCPA requirements, limitations, and regulations.