Privacy policy

1. Who we are

Fractyl is operated by D3 Digital Limited, a New Zealand company. In this policy, “Fractyl”, “D3”, “we”, “us” and “our” refer to D3 Digital Limited in its role as operator of Fractyl.

Privacy enquiries can be sent to alex.radford@d3.co.nz or to Shed 4B, City Works Depot, 90 Wellesley Street West, Auckland, New Zealand.

2. What this policy covers

This policy covers personal information we handle through the Fractyl website, sales and support activity, account administration and the Fractyl service.

When we process personal information for a client, the client’s agreement with us and its instructions also apply. The client is responsible for deciding why the information is used and for ensuring its collection, notices, permissions and intended destinations are lawful. We are responsible for handling the information in line with our agreement, the client’s instructions and applicable law.

3. Information we may handle

The information depends on how you or your organisation uses Fractyl. It may include:

• business contact details, enquiry information and correspondence;
• account, access, support and administrative records;
• website and device information, including pages viewed, interactions, browser and referral information where optional analytics has been accepted;
• customer, lead, lifecycle, behavioural, analytics, operational and server-side signals connected by a client; and
• identifiers and audience attributes required for approved identity, suppression, segmentation, activation and measurement use cases.

We may receive information directly from you or your organisation, from systems a client authorises us to connect, or from approved service providers and destinations.

4. How we use information

We use personal information where reasonably necessary to:

• respond to enquiries and manage business relationships;
• provide, administer, support and improve Fractyl;
• connect approved data sources, maintain customer records and apply agreed identity and lifecycle rules;
• build, suppress, synchronise and measure audiences for approved destinations;
• operate security, access, troubleshooting and incident processes; and
• meet contractual and legal obligations.

We do not treat a future product idea as permission to use information for a new purpose. Material changes to purpose, data or destination require appropriate review and approval.

5. Identity, matching and hashing

Fractyl may reconcile records using approved identity rules and prepare selected identifiers for audience matching. Identifiers used for media activation are hashed before transfer to approved destinations. Hashing is a security and matching control. It is not anonymisation and does not create permission to use the underlying information.

6. Website analytics and cookies

We use CookieYes to record privacy choices. Google Tag Manager and Google Analytics 4 are configured as optional analytics tools. They load only after analytics consent is recorded. You can change your choices at any time through “Privacy choices” in the footer.

See our Cookie notice for the current categories and controls.

7. Who may receive information

Information may be available to authorised D3 personnel, authorised client users and suppliers needed to provide hosting, security, consent, analytics, support and other agreed services. For a client implementation, information may also be sent to CRM systems, advertising platforms, measurement environments or data clean rooms the client has approved.

We may disclose information where required by law, to respond to a valid legal process, or to protect people, systems and legal rights. We do not sell personal information.

8. Hosting and overseas processing

The core Fractyl service is primarily hosted in Australia. Website delivery, analytics and connected client platforms may involve processing or access in other countries, depending on the provider and the client’s implementation.

We assess data roles, destinations and appropriate safeguards during implementation and contracting. A client’s own providers and destination platforms may have separate privacy terms.

9. Retention

We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, to deliver an agreed service, or to meet legal, security and contractual obligations.

Client service data is returned, deleted or retained in line with the client agreement, documented instructions and applicable law. Information already transferred to an approved client destination is also subject to that destination’s controls and retention obligations.

10. Security and incidents

We take reasonable technical and organisational steps to protect personal information against loss, unauthorised access, use, modification and disclosure. No system can be guaranteed completely secure.

We investigate suspected privacy and security incidents and notify affected clients, people or regulators where required by law or contract.

11. Access, correction and complaints

You can ask us for access to, or correction of, personal information we hold about you. We may need to confirm your identity before responding. Where information is held for a Fractyl client, contacting that organisation first may be the fastest route. We will support the client where required.

Send requests or complaints to alex.radford@d3.co.nz. You may also contact the Office of the Privacy Commissioner in New Zealand or the Office of the Australian Information Commissioner, where relevant.

12. Changes to this policy

We may update this policy when our services, suppliers or legal obligations change. The effective date above shows the latest published version. We will provide further notice or obtain consent where required.