privacy policy.

HHD Limited (Trading as Roll’d NZ) – Privacy Policy

HHD Limited (NZBN: 9429052300752), trading as Roll’d NZ (“Roll’d NZ”, “us”, “we”, or “our”), recognises the importance of your privacy and is committed to protecting your personal information in accordance with the Information Privacy Principles (IPPs) set out in the Privacy Act 2020 (NZ) (Privacy Act) and other applicable New Zealand privacy laws (Privacy Laws).

1. Scope of this Policy

This privacy policy outlines the way in which we collect, hold, use and disclose your personal information (Privacy Policy).

By accessing or using our website, application, products or services, or by providing us with your personal information, you agree to the collection, storage, use and disclosure of your personal information in accordance with this Privacy Policy.

This Privacy Policy applies to all personal information collected in connection with Roll’d NZ operations. This includes information collected through our company-owned and franchised stores, customer service channels, our loyalty program, app and website (www.rolld.co/nz).

Whenever you provide your personal information to us in connection with our goods and services, you agree to the collection, use, storage and disclosure of that information in accordance with this Privacy Policy.

2. What is personal information?

Personal information is information about an identifiable individual, as that term is defined in the Privacy Act. Anytime we use the term ‘personal information’ in this Policy, we are referring to that statutory definition.

3. Collection of personal information by Roll’d NZ

We collect personal information in a variety of ways, including directly from you and indirectly from third parties.

Direct collection

The type of personal information that we collect will vary depending on the circumstances of collection, including whether you are a customer, supplier, independent contractor, employee, franchisee or are applying to be any one of these. We may collect this information directly from you when you interact with us, place an order, make any enquiry, complete a form or otherwise communicate with us.

For example, we may collect the following information about you that may be personal information, when:

• you purchase products or receive services at our stores, we may collect information on what you buy, rewards earned, the method of payment and how frequently you purchase from Roll’d NZ;
• you place an online order, we may confirm your name and contact details;
• you join or participate in competitions, promotions or surveys, we may collect your name, phone number, email address, social media handle, postal address or demographic information such as your postcode;
• you download our app, we may collect information such as your name, phone number, account login information, purchase history, payment preferences and location (if enabled);
• you access our website, create an account, sign up to receive marketing or join our loyalty program, we may seek information from you including, but not limited to, your name, address, username, email address, date of birth, phone number, postal address, financial information such as your credit card number or other information;
• you apply to be a supplier, information we collect may include your name, phone number, email address and postal address;
• you apply to become a franchisee, or if you seek employment with us or a Roll’d NZ franchisee — the collection, use and disclosure of information in connection with franchisee or employee applications is addressed separately in sections 7 and 8 below; and/or
• you have any other dealings with us, whether in person, by phone, online or through any of our business channels, where that information is reasonably necessary for us to provide our products or services or to operate our business.

Indirect collection

We may also receive personal information about you from third parties. This can occur when different parts of our organisation engage external agencies to run campaigns, generate leads or manage customer enquiries and those agencies provide that information to us.

Automated collection of information

Roll’d NZ website

Each time you visit our website, we may use automated tools and technologies (including cookies, analytics software and session trackers) to gather and store information about your visit. The information collected can include:

• the IP address and domain name used by your device to connect to the internet;
• the type of browser, operating system and search engine you use;
• the date, time and length of your visit;
• the specific pages or sections of our website you view;
• your general location (if enabled on your device); and
• any personal details you choose to provide to us, such as your name, email address or phone number.

Cookies

Our website makes use of temporary ‘cookies’ (small text files placed on your device) to keep sessions active once you log in. These cookies help us manage the website and improve usability by recognising repeat visitors and monitoring how the site is navigated.

We do not use cookies to store personal information or to access data held on your device, and they do not interact with cookies created by other websites. The information generated is used only for the purposes described above and to support the functionality of our website. You can customise or opt out of cookie use at any time by adjusting your browser settings. Please note that disabling cookies may limit the functionality of our website and affect your browsing experience.

Financial transactions

We do not directly process or store your full payment details when you make a purchase through our website or app. Payments are processed securely by independent third-party payment providers (including, for example, Windcave, Liven, Google Pay and Apple Pay). These providers may collect and store your personal information and financial information in accordance with their own privacy policies.

For more information about how your payment details are handled, please refer to the privacy policy of the relevant payment provider.

Online tracking technologies

In addition to cookies, we may use other tracking technologies on our website and app, such as pixels, tags, scripts and analytics tools (including but not limited to Google Analytics and Meta). These technologies help us understand how our website is used, measure the effectiveness of our marketing campaigns and deliver content or advertising that is more relevant to you.

The information collected through these technologies may include details about how you interact with our website or app (such as the pages you visit, links you click and features you use), as well as technical information such as your device type, operating system, browser, IP address and general location. This information is usually collected in aggregated or de-identified form, but in some cases may be linked with other personal information we hold about you.

We use this information to improve our products and services, analyse trends and provide personalised offers or advertising. You can manage or block the use of these technologies through your browser or device settings, but please be aware that doing so may limit your ability to use some features of our website or app.

Information from third parties

We may also receive personal information about you from third parties. This can include information from publicly available sources, delivery and service partners (such as Uber Eats, DoorDash or Menulog), recruitment platforms (such as Seek, Trade Me Jobs or recruitment agencies), marketing agencies, customer engagement platforms, and from promotions or competitions run with third-party partners. In addition, our business units (such as marketing, franchising or catering) may work with external agencies that generate leads or customer enquiries and provide that information to us.

Third-party websites

Our website may contain links to third-party websites; however, we are not responsible for the practices or content of such websites. These links are offered for your convenience only and do not constitute an endorsement by Roll’d NZ of any third-party website. We suggest that you review the privacy policies of these third parties before providing your personal information to them.

CCTV

We may collect personal information through CCTV installed at our premises. This is used for security, safety, loss prevention and operational purposes. CCTV footage is stored securely and is only accessed or disclosed where reasonably necessary for these purposes or as required by law.

Access via social media accounts

Customers of Roll’d NZ can connect a social account to expedite the authentication process during their subsequent logins. Some information, including the social account ID and the email address provided, is saved only for the purposes of matching it to a Roll’d NZ account and is not used for any other purpose.

4. Use of your personal information

We may use your personal information to:

• process customer orders and provide customer support;
• maintain, develop, operate, evaluate and improve our products and services;
• offer you products and services that we consider may be of interest to you;
• administer our loyalty program;
• manage your account, including processing your orders and responding to your enquiries;
• assess your suitability and eligibility to purchase and operate a Roll’d NZ franchise;
• improve the design and content of our website and app;
• assess and manage employment applications;
• review and manage complaints, feedback and enquiries to help us resolve issues and improve our service; and/or
• support our internal operations, including meeting legal and regulatory requirements.

Access to personal information by our employees, contractors and agents is limited to what is reasonably necessary for them to perform their duties and is managed in a manner consistent with this Privacy Policy and our obligations under the Privacy Act.

Direct marketing

With your consent, we may from time to time send you marketing communications about our products, services or promotions that we believe may be of interest to you. These messages may be delivered by email, SMS, post or other permitted channels, and will always comply with the Unsolicited Electronic Messages Act 2007 (NZ) and the Privacy Act.

You can choose to stop receiving marketing communications at any time by using the unsubscribe function in the message or by contacting us using the details set out in this Policy.

Even if you opt out of marketing, we may still get in touch with you where it is necessary to manage or support our ongoing relationship with you (for example, to provide important service updates).

5. Sharing your personal information

We may share or disclose your personal information with:

• our related entities, suppliers, contractors and agents for purposes related to our business operations;
• Roll’d Hospitality Group Pty Ltd (the master franchisor based in Australia) and its related entities, for purposes including brand management, system administration, franchise compliance, marketing coordination and the operation of group-wide loyalty programs (see section 10 for cross-border information);
• our franchisees;
• marketing providers, market research and data analytics companies;
• our professional advisors including auditors, insurers, consultants and representatives;
• our advertisers, sponsors, business partners or third-party vendors; and/or
• other parties where it is reasonably necessary to comply with a legal obligation, respond to lawful requests, enforce or defend our legal rights, investigate suspected unlawful activity or misconduct, protect the safety of our customers, employees or the public, or manage our exposure to legal liability; and/or third parties not mentioned above, or where you have otherwise provided consent to the disclosure.

6. Storage and security of personal information

We hold personal information in both electronic and physical form, using a combination of physical, technical and administrative safeguards to protect it from loss, misuse, unauthorised access, modification or disclosure. Information may be stored in our internal systems (such as customer service, marketing and franchise administration databases) as well as on secure third-party cloud services located in New Zealand and overseas (including Australia).

While we take reasonable steps to protect the security of personal information, please note that no transmission of data over the internet is completely secure, and caution should be exercised when providing information online.

Notifiable privacy breaches

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required under the Privacy Act.

7. Franchise applications

When you apply to become a Roll’d NZ franchisee, we collect personal information relevant to assessing your suitability. This may include details about your residency, employment history, financial capacity, qualifications, experience and other information you provide to us.

As part of the selection process, we may obtain information from third parties such as referees, previous employers or business contacts. With your consent, we may also collect sensitive information, for example, about criminal history or professional memberships. We may combine the information you provide with information held by others where reasonably necessary for the assessment of your application.

We use this information to:

• assess your application to become a franchisee;
• evaluate your suitability at each stage of the recruitment process; and
• keep your details on file for future franchise opportunities.

If you do not provide the information we request, we may be unable to progress your application.

We may disclose personal information to referees or previous employers, recruitment agencies, our related entities, the master franchisor and its related entities, contractors engaged to assist us, law enforcement agencies (to confirm criminal history), financial institutions (to confirm financial standing) or educational institutions (to verify qualifications). Where third-party contractors are engaged to perform services involving your personal information, we will take reasonable steps to ensure it is used only for the purposes for which it was provided.

8. Employment applications

When you apply for a role with us, we collect personal information such as your contact details, employment history, qualifications and any information you provide in application forms.

We may also obtain information from third parties, including referees, previous employers, recruitment agencies, government bodies or regulatory authorities. With your consent, we may collect sensitive information if relevant to the role or required by law.

We use this information to verify your identity, communicate with you, assess your suitability for a role (with us or a related entity), and keep your details for future opportunities unless you ask us not to. If you do not provide the requested information, we may be unable to progress your application.

We may disclose your information to referees, recruitment agencies, our related entities, contractors engaged to assist us or educational institutions (to verify qualifications). Where contractors handle your information, we will take reasonable steps to ensure it is used only for the purposes for which it was provided.

9. Franchisees

Some of our stores are owned and operated by franchisees. We require our franchisees to comply with this Privacy Policy and the Privacy Act when handling your personal information in connection with their stores. If you have concerns about a possible breach of this Privacy Policy by a franchisee, you may contact the franchisee directly or raise the matter with us.

Please note that this Privacy Policy does not cover the conduct of franchisees in relation to any websites or apps that they independently operate.

10. Cross-border disclosure

Because Roll’d NZ operates under licence from Roll’d Hospitality Group Pty Ltd in Australia, your personal information may be disclosed to, or stored on systems located in, Australia. We may also use third-party service providers (including cloud hosting, IT, marketing and analytics providers) located outside New Zealand.

Where we disclose your personal information overseas, we will take reasonable steps to ensure that the recipient is required to protect that information in a way that, overall, provides comparable safeguards to those in the Privacy Act — for example, because the recipient is subject to privacy laws that provide comparable protections, or because the recipient has agreed in writing to protect the information in accordance with the Privacy Act.

By providing your personal information to us, you acknowledge that it may be transferred to, and processed in, countries other than New Zealand (including Australia).

11. Children’s privacy

We do not knowingly collect personal information from children under 16 years of age, unless it relates to a specific activity and we have received consent from their parent or guardian.

If you become aware that we have collected personal information from a child without parental consent, please contact us and we will take steps to remove that information from our systems.

12. Opting out of marketing communications

You can choose not to receive marketing communications from us at any time. Each marketing message we send will include a functional unsubscribe option. You can opt out by:

• clicking the unsubscribe link in the communication; and/or
• contacting us directly using the details provided in this Privacy Policy.

When we receive and process your opt-out request, we will stop sending you the marketing communications covered by that request. Please note:

• you may still receive service messages relating to your transactions, applications or account; and
• we may contact you again if you later resubscribe or participate in activities such as competitions or promotions.

13. Access to, and correction of, personal information

Under the Privacy Act, you have the right to request access to, and correction of, the personal information we hold about you. You can make a request by contacting our Privacy Officer in writing using the details below. We may need to verify your identity before processing your request, and in some cases we may refuse a request where permitted under the Privacy Act. If we do refuse, we will provide reasons.

If you have an account with us, you can also view and update your information directly by logging in.

We do not generally charge for access requests, but a reasonable charge may apply where permitted under the Privacy Act (for example, for providing copies of records).

14. Overseas users

If you are accessing Roll’d NZ services from outside New Zealand, you acknowledge and agree that your personal information will be transferred to, and processed in, New Zealand (and potentially Australia, where the master franchisor’s systems are located) and handled in accordance with this Privacy Policy and New Zealand Privacy Laws. Your personal information may also be stored on secure servers operated by third-party providers located outside New Zealand.

15. Contacting us

If you have any questions about our Privacy Policy, the personal information we collect or hold, wish to exercise your privacy rights, or would like to raise a concern about our privacy practices, you may contact our Privacy Officer using the details below:

Address: The Privacy Officer, HHD Limited, c/- Burton Partners, Level 7, 30 Daldy Street, Auckland Central, Auckland 1010, New Zealand

Email: hello@rolld.nz

We will contact you within 20 working days to acknowledge your query or request and let you know the next steps.

If you are not satisfied with our response, or if you wish to lodge a complaint, you may refer the matter to the Office of the Privacy Commissioner at: www.privacy.org.nz or 0800 803 909.

16. Changes to this Privacy Policy

We may amend this Policy from time to time, with or without notice to you. We recommend that you visit our website regularly to keep up to date with any changes.

Your connection to our site will be through servers located in New Zealand and/or Australia, and personal and general information collected by us will be processed in those jurisdictions where Roll’d NZ and its master franchisor’s servers and internal systems are located.

Last updated: May 2026