Information we collect
When you submit an enquiry, we collect the contact details you provide, such as your name, work email address and business name, together with the process you describe and the example or offer you selected.
Some focused campaign pages use a short diagnostic before asking for contact details. The four-choice Trades Office Check records the recurring process that keeps landing back on you or the office, where it gets stuck, what it costs in time, cash, rework or customer impact, and who needs to use the fix. It uses those answers to show an initial finding and a suitable first step before asking for your name and work email.
If you request the action plan, we collect your name and work email. You can optionally add your type of business, how often you have to step in, business name, current apps or tools and context about how you handle it today. Earlier Trades and Plumbing Office Check submissions may contain the longer set of structured process answers used by those versions.
The site applies documented rules to those selections to derive an initial finding, practical operating rules, what you may be able to stop checking and the best next step. The result is checked again when the action-plan request reaches our server. It is an initial read to help frame a conversation—not a quote, a guaranteed time or cost saving, a platform recommendation, professional accounting advice or a solely automated decision about whether Nateleigh will work with you.
We also keep limited source information so we can understand which pages and campaigns produce useful enquiries: the landing page without its query string, the referring website's domain, the campaign metro where supplied, any UTM source, medium, campaign, content, term or campaign ID values, and an advertising click identifier included in the landing-page link. These values are stored with a requested action plan or enquiry for campaign attribution; they are not used to collect your wider browsing history.
If you book a Fit Check, Microsoft Bookings may also collect the appointment details and any optional contact information you provide. If we work together, we may collect your role, business and billing details, project communications, signed agreements, files you choose to provide, and invoice and payment records.
Our private operations portal can also hold relationship and delivery records created while we work with you, including lead and customer status, agreed next actions, internal notes, project records, tasks and milestones, manual time entries, file metadata, email history and an audit trail of operational changes. Internal notes are used to manage the relationship and delivery; they are not used to make solely automated decisions about you.
The site stores only your light or dark theme preference in your browser. Focused campaign pages may create and send first-party interaction events to Nateleigh's Vercel runtime logs so we can verify that the diagnostic, proof examples and action-plan path work. These events use an allowlist and may contain the campaign and page version, broad problem category, completed-step label, proof example, result category, recommended next step and approved campaign tags. They exclude your name, email, business name, free-text response, full tool selections and arbitrary query values.
Focused Google Ads landing pages also send Google a small set of named funnel events, such as landing viewed, Office Check started, result viewed, action plan requested, successfully saved lead and booking started, together with the standard page and advertising-request context needed for campaign attribution. We do not send Google your diagnostic answers, name, email, business name or free text. Advertising storage, advertising personalisation and Google Signals are disabled by default, so this implementation uses cookieless measurement rather than advertising or behavioural analytics cookies.
Where it comes from
Most information comes directly from you or another person at your organisation through the website, email, Microsoft Bookings, calls, proposals and project work. We may also record business contact details or context that you make public, that your organisation provides, or that a referral partner gives us lawfully.
If another person gives us your details, we use them only where it is reasonable to believe they may introduce or involve you in a genuine business enquiry. You can contact us if that context is wrong or you do not want us to retain it.
How we use it
We use this information to provide the initial campaign finding, prepare a requested action plan, respond to enquiries, schedule conversations, assess and scope work, manage our lead pipeline and customer relationships, plan and deliver projects, maintain project files and activity records, send service communications, manage invoices and records, keep our systems secure and meet legal obligations.
We also create internal operational analytics from these records—for example, lead response times, useful enquiries by source, pipeline movement, project health and planned versus recorded time. These reports help Nateleigh decide where attention is needed. They are not advertising profiles, public reports or automated eligibility decisions.
Submitting an enquiry allows us to reply about that enquiry. It does not subscribe you to a marketing list; we would ask separately before sending unrelated marketing communications.
We do not sell personal information or use enquiry details to build third-party advertising profiles.
Why we may use it
Depending on where you are and why we hold the information, we process it to take steps you request before a contract, perform a contract with your organisation, pursue legitimate business interests such as responding to genuine enquiries and operating our services, comply with legal obligations, protect people and systems, or act with consent where consent is required.
Where we rely on a legitimate interest, we consider whether the use is proportionate and reasonably expected in a business relationship. Where consent is required, you may withdraw it without affecting uses that were lawful before withdrawal.
International enquiries
Nateleigh is currently based in New Zealand and works with businesses in New Zealand, the United States and other countries. You may therefore provide information from outside New Zealand, and our service providers may process or store it in New Zealand, the United States or other locations where they operate.
We take reasonable steps to use reputable providers and safeguards appropriate to the information involved. Where local privacy law gives you additional rights, we will consider and respond to those rights where they apply.
Retention and security
We keep enquiry information, including any structured diagnostic answers and derived recommendation saved with an action-plan request, while we assess the opportunity and maintain a relevant business relationship. Unsuccessful or inactive enquiries are reviewed and normally deleted or de-identified from Microsoft 365 within 12 months, unless we need them for a continuing relationship, a legal obligation or the resolution of a dispute.
PII-free campaign interaction events are operational logs rather than customer records. We retain them only for as long as reasonably needed to verify the campaign path, diagnose failures and understand aggregate use, subject to Vercel's logging and retention controls.
Customer, project, communication and file records are kept while they are needed to deliver and support the work, manage the relationship and deal with reasonably foreseeable questions or claims. Customer contracts, invoices and associated business records may be retained for at least seven years where tax or legal recordkeeping requires it. We review operational records after the relationship ends and delete, de-identify or securely archive information that no longer has a business or legal purpose.
We use reasonable administrative and technical safeguards appropriate to the information involved, including private service boundaries, Microsoft Entra authentication, multi-factor authentication, scoped application permissions, transport encryption, provider access controls and operational audit records. No internet transmission or storage system can be guaranteed completely secure.
Your choices and rights
You can ask what personal information we hold about you, request a correction, ask us to delete information we no longer need, or object to a use of your information. These rights depend on the law that applies and are not always absolute. We may need to verify your identity and may retain information where law, security, a dispute or legitimate business records require it.
You may also ask for a usable copy of information you provided where a portability right applies, or ask us to restrict a disputed use while we review it. Nateleigh does not use website enquiry or CRM data for solely automated decisions that produce legal or similarly significant effects.
You may also withdraw consent where consent is the basis for processing, unsubscribe from optional marketing, or raise a privacy concern with us. If we cannot resolve a concern, you may contact the privacy regulator that applies where you live, including the New Zealand Office of the Privacy Commissioner where relevant.
Contact
Email our privacy contact at hello@nateleighgroup.com.