By country

Refund Policy Generator New Zealand

The Privacy Act 2020, thirteen information privacy principles, IPP12 on offshore transfers, and the Consumer Guarantees Act.

Generate your refund policy Read the refund policy guide

A New Zealand refund policy is a statement about the Consumer Guarantees Act first. The Act gives remedies for goods that fail to meet a guarantee, and the customer chooses between repair, replacement and refund where the failure is substantial.

New Zealand’s Privacy Act 2020 replaced the 1993 Act and introduced mandatory notification of privacy breaches, compliance notices, and IPP12 - a cross-border disclosure rule requiring you to be satisfied the overseas recipient will protect the information to a comparable standard.

The Act applies to every agency handling personal information, with no turnover threshold. That is a meaningful difference from Australia, where businesses under AUD 3 million are largely outside the regime.

On the consumer side, the Consumer Guarantees Act and Fair Trading Act give statutory rights that cannot be contracted out of in consumer transactions, and misrepresenting them is itself a breach the Commerce Commission enforces.

What a refund policy in New Zealand has to cover

The consumer guarantees and the remedy tiers for substantial and minor failures
That the customer chooses the remedy for a substantial failure
Any voluntary change-of-mind policy, marked clearly as additional
Proof of purchase expectations, which cannot be limited to a receipt alone
A statement that nothing limits rights under the Consumer Guarantees Act

How New Zealand actually moves personal data

Offshore hosting and SaaS

Most New Zealand businesses use Australian or US infrastructure, which is a cross-border disclosure engaging IPP12 rather than an ordinary sub-processing arrangement.

Customer records and access requests

IPP6 gives individuals a right of access with a twenty-working-day response requirement.

Marketing lists

Governed by the Unsolicited Electronic Messages Act separately from the Privacy Act.

Employee information

Covered by the same principles, with additional obligations where the information is used in employment decisions.

Breach assessment

The serious-harm test drives whether a breach is notifiable, and the assessment has to happen quickly enough to notify as soon as practicable.

Third parties the draft will ask you about

Stripe · Xero · NZ Post · AWS ap-southeast-2 · Vend or Shopify · Mailchimp

The rules that apply

Privacy Act 2020 and the 13 IPPs

Collection, use, disclosure, storage, access and correction principles, applying to every agency regardless of size.

IPP12 cross-border disclosure

Before sending personal information overseas you must be satisfied the recipient is subject to comparable safeguards, or rely on a listed exception.

Notifiable privacy breaches

Breaches causing or likely to cause serious harm must be notified to the Privacy Commissioner and affected individuals as soon as practicable.

Consumer Guarantees Act

Non-excludable guarantees on goods and services in consumer transactions.

Unsolicited Electronic Messages Act

Consent, identification and unsubscribe requirements for commercial electronic messages.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

New Zealand compliance essentials

Document your IPP12 position per offshore recipient
What safeguards apply, and which exception you rely on if none do.
Publish a privacy statement covering all thirteen principles
Including collection purpose, access and correction, and complaints.
Build the twenty-working-day access workflow
With identity verification and a record of each request.
Write the breach assessment runbook
Applying the serious-harm test and the notification route to the Privacy Commissioner.
State consumer guarantees before your own terms
And never describe them as excluded.

Where this usually goes wrong

Treating offshore hosting as ordinary processing

IPP12 requires you to be satisfied about the recipient’s protections before disclosing, and to be able to explain why.

Assuming a small-business exemption

There is none. The Privacy Act applies to every agency.

Missing the twenty-working-day access deadline

It is a statutory timeframe with a complaint route attached.

Contracting out of consumer guarantees

Void in consumer transactions and independently actionable as a misrepresentation.

No breach assessment process

The serious-harm test cannot be applied retrospectively at leisure - notification is required as soon as practicable.

Frequently asked questions

Does the Privacy Act apply to small businesses in New Zealand?

Yes. Unlike Australia, there is no turnover threshold - the Act applies to every agency that handles personal information.

Can I use overseas cloud services?

Yes, but IPP12 requires you to be satisfied the recipient is subject to comparable safeguards before disclosing, or to rely on a listed exception such as the individual’s informed authorisation.

How quickly must I answer an access request?

As soon as reasonably practicable and no later than twenty working days after receiving it.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.