Privacy Policy

Last updated: 12 March 2024

3Z Mail Services Ltd ("3Z Mail", "we", "us", or "our") operates the email hosting service accessible at 3z.nz. This Privacy Policy describes how we collect, use, store, and disclose information in connection with the provision of our services.

We are a New Zealand company and comply with the Privacy Act 2020. We take privacy seriously. If you have questions about this policy, you can contact us at privacy@3z.nz.

1. Information we collect

1.1 Account information

When an account is created, we collect the email address associated with the account and a hashed representation of the account password. We do not store passwords in plaintext. We may also collect a recovery email address if the account holder chooses to provide one.

1.2 Email content

We store the contents of email messages sent and received through our service, including attachments, for as long as the account holder retains them in their mailbox. We do not access, read, or scan the content of email messages except as required to deliver the service (for example, spam filtering at the server level).

1.3 Service metadata

We maintain server logs that record connection timestamps, IP addresses, and protocol-level information (such as SMTP envelope data). These logs are retained for a maximum of 30 days and are used exclusively for diagnosing technical issues and preventing abuse of the service.

1.4 Website analytics

Our website at 3z.nz does not use third-party analytics, tracking cookies, or advertising pixels. We may review server access logs in aggregate to understand traffic patterns, but we do not track individual visitors across sessions or sites.

2. How we use information

We use the information we collect solely for the following purposes:

• To provide, maintain, and improve the email hosting service
• To communicate with account holders about service-related matters (billing, outages, policy changes)
• To detect and prevent abuse, fraud, and security incidents
• To comply with legal obligations under New Zealand law

We do not use email content or account information for advertising, profiling, or any purpose unrelated to the operation of the service.

3. Data sharing and disclosure

We do not sell, rent, or trade personal information. We do not share email content or account information with third parties except in the following limited circumstances:

• Service providers. We may engage third-party providers for infrastructure services (such as data centre operations). These providers are bound by contractual confidentiality obligations and are not permitted to use the data for their own purposes.
• Legal obligations. We may disclose information if required to do so by a valid legal order issued under New Zealand law. We will notify the affected account holder before complying, unless prohibited by the order.
• Business transfers. In the event of a merger or sale of assets, account holders would be notified and given the opportunity to close their accounts before any transfer of data.

4. Data location and jurisdiction

All user data is stored on servers located in Auckland, New Zealand. We do not replicate or transfer data to jurisdictions outside New Zealand. Your data is subject exclusively to New Zealand law, including the protections of the Privacy Act 2020.

5. Data retention

We retain email content for as long as the account is active. When an account is closed, email content is permanently deleted within 30 days. Server logs are retained for 30 days and then purged. Billing records are retained for seven years as required by New Zealand tax law.

6. Security

We implement technical and organisational measures to protect user data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of all connections using TLS
• Hashed and salted password storage
• Physical security at our data centre facilities
• Access controls limiting data access to authorised personnel
• Regular security review of our infrastructure

7. Your rights

Under the Privacy Act 2020, you have the right to request access to the personal information we hold about you and to ask for it to be corrected if it is inaccurate. To make a request, contact us at privacy@3z.nz. We will respond within 20 working days as required by the Act.

8. Changes to this policy

We may update this Privacy Policy from time to time. Account holders will be notified of material changes by email at least 14 days before they take effect. The latest version will always be available at this page.

9. Contact

If you have questions or concerns about this Privacy Policy, contact us at:

3Z Mail Services Ltd
Attn: Privacy Officer
Level 2, 79 Courtenay Place
Wellington 6011
New Zealand
privacy@3z.nz