Privacy Statement

1. Who we are

Fairway Flow provides a digital ordering platform that participating golf clubs and other venues can use to receive customer orders and, where enabled, facilitate online payment.

When you order food, drinks or other products through Fairway Flow, the venue shown in the ordering experience is the seller and receives and fulfils your order. Fairway Flow provides the technology used to place and manage that order.

For privacy questions or requests relating to Fairway Flow, you can contact us using the details at the end of this statement.

2. What information we collect from customers

Fairway Flow is designed to collect a relatively small amount of customer information. Customers do not currently need to create a Fairway Flow account.

Depending on how you order, we may collect:

• your name;
• your mobile or phone number;
• your email address, if you choose to provide it;
• the items you order, quantities, prices and any item notes you enter;
• your selected venue, ordering location and pickup or delivery choice;
• information needed to identify or describe the selected fulfilment location;
• order timestamps and order-status history;
• feedback, ratings or comments you choose to provide after an order;
• payment status and payment-related identifiers returned through the payment process; and
• information about the QR or ordering source used to reach the ordering experience, where that source is included in the link.

Some fields may be optional for pickup orders and required for delivery orders so that the venue can identify you and fulfil the order.

3. Information generated when you use Fairway Flow

Fairway Flow generates information needed to operate the service, including order identifiers, order tokens, timestamps, status history and payment status.

The customer ordering application also uses a short-lived anonymous analytics session identifier to understand basic use of the ordering flow. It is generated randomly, is scoped to the venue, and is not designed to be joined to your name, phone number, email address, order identifier or Stripe payment identifier.

Fairway Flow does not currently use behavioural advertising or cross-site tracking.

4. Information we do not currently collect

The current Fairway Flow customer ordering service does not intentionally collect:

• a customer account or password;
• precise GPS or background location;
• customer date of birth, government identifiers or identity documents;
• structured health, allergy or dietary information;
• customer photographs;
• IP address or browser/user-agent information in Fairway Flow application data; or
• full payment-card numbers or card security codes.

Free-text order notes and feedback fields can contain personal information if you choose to enter it. Please avoid including unnecessary sensitive information in those fields.

5. How we use customer information

We use customer information where reasonably necessary to provide and operate Fairway Flow, including to:

• send your order to the correct venue and location;
• allow the venue to prepare, manage and fulfil the order;
• facilitate online payment where you choose that payment method;
• send an order confirmation where you provide an email address;
• support payment reconciliation and refunds;
• maintain order and status records;
• respond to customer-service, privacy, security or technical enquiries;
• maintain the security and integrity of the platform; and
• understand basic anonymous use of the ordering flow and improve the service.

Fairway Flow does not currently use customer order information to subscribe customers to a marketing mailing list.

6. Payments and Stripe

Where a venue offers online payment, Fairway Flow uses Stripe to provide the payment and connected-account infrastructure.

Payment-card details are entered into Stripe's hosted payment interface. Fairway Flow does not receive or store your full card number or card security code.

Fairway Flow may store payment-related information returned through the payment process, such as the payment status, amount, currency, Stripe Checkout Session identifier, PaymentIntent identifier, connected merchant account identifier, Fairway Flow application-fee amount and refunded amount.

Stripe may collect and process additional information under its own privacy practices when providing payment services.

7. Information about merchant owners, administrators and staff

Merchant and platform users require authenticated accounts. Depending on the user's role and onboarding process, Fairway Flow and its service providers may hold information including:

• email address and full name;
• authentication user identifier;
• organisation and venue memberships and roles;
• invitation records;
• audit records showing actions performed in the platform; and
• support-access records where support access is granted.

Passwords are handled by Fairway Flow's authentication provider, Supabase. Fairway Flow application tables do not store users' passwords.

During merchant payment onboarding, Stripe may collect business representative information such as name, address, phone number, date of birth, identity-verification information and bank-account information. Fairway Flow does not store the merchant representative's identity documents or bank-account details in its own database.

8. Who can access information

Customer order information is made available to the venue receiving the order so that its authorised users can manage and fulfil it.

Access within Fairway Flow is role- and venue-scoped. Merchant users are restricted to information associated with the organisations and venues they are authorised to access. Some actions involving payment information, including initiating refunds, are further restricted to authorised merchant roles.

Fairway Flow platform-operator status does not, by itself, provide ordinary access to a venue's order or payment information. Where support access is required, Fairway Flow uses a separate, scoped and auditable support-access mechanism.

Server-side service functions may access information where required to operate the platform, enforce permissions, process orders, reconcile payments, send transactional communications or provide authorised support.

9. Service providers

Fairway Flow currently relies on a small number of service providers to operate the platform:

• Supabase — database hosting, authentication, server-side functions and related platform infrastructure;
• Stripe — online payments, Stripe Connect and merchant payment onboarding;
• Brevo — transactional email delivery; and
• Cloudflare — website/application hosting and email-routing infrastructure.

These providers may process information on Fairway Flow's behalf or, in some circumstances, under their own terms and privacy practices.

Some service providers may process or store information outside New Zealand. The exact locations can depend on the provider, service configuration and provider infrastructure. Fairway Flow will review overseas processing and disclosure arrangements as part of its privacy and legal compliance process rather than making a location claim that has not been verified.

10. Transactional emails

If you provide an email address when ordering, Fairway Flow may send you an order confirmation and other transactional information reasonably necessary for that order.

Fairway Flow currently uses Brevo to deliver transactional emails. The information provided to Brevo for this purpose may include your email address and order information needed for the message.

Fairway Flow does not currently operate a customer newsletter or automatically subscribe ordering customers to marketing communications.

11. Cookies, browser storage and tracking

Fairway Flow does not currently set application cookies in the customer ordering experience and does not currently use third-party advertising or behavioural-tracking pixels.

The customer ordering application uses browser local storage for limited operational purposes, including:

• keeping your cart on your device before checkout;
• temporarily recording a pending-payment marker so the application can recover the payment flow; and
• holding the anonymous analytics session identifier described above.

The pending-payment marker has a short expiry. Cart information remains on the device according to the application's local-storage behaviour and can also be affected by browser/device storage controls.

Standard browser autofill may offer to fill contact fields based on information saved in your browser or device. Fairway Flow does not currently maintain its own customer 'remember me' profile.

12. How long we keep information

Fairway Flow needs to retain some information for legitimate operational, financial, security, dispute-resolution, audit and legal purposes.

At present, Fairway Flow does not operate an automated retention or deletion schedule for customer orders, payment records, feedback, audit events or analytics events. These records are currently retained unless they are dealt with through an authorised administrative process.

Fairway Flow is reviewing appropriate retention periods for different categories of information. Any retention framework adopted should take account of why the information is held, applicable New Zealand legal and accounting requirements, security and audit needs, and whether continued retention remains reasonably necessary.

Fairway Flow does not intend to retain personal information merely because it is technically possible to do so.

13. Accessing or correcting your information

You may contact Fairway Flow if you want to ask what personal information Fairway Flow holds about you or request correction of personal information you believe is inaccurate.

Fairway Flow does not currently provide a customer self-service privacy portal. Requests are handled manually. We may need enough information to verify your identity and locate the relevant records before responding.

If your request relates to information held directly by a venue or by a third-party provider acting in its own capacity, we may direct you to the appropriate organisation.

You can also contact us if you want to ask about deletion or another privacy concern. Whether information can or should be deleted will depend on the circumstances, including applicable legal, financial, security and record-keeping requirements.

14. Keeping information secure

Fairway Flow uses technical and organisational controls intended to protect information against unauthorised access, use, modification or disclosure.

These controls include authenticated merchant access, role- and venue-based permissions, database row-level security, server-side authorisation checks and audit records for privileged activity.

No internet-based service can guarantee absolute security. If Fairway Flow becomes aware of a privacy or security incident, it will assess and respond to it in accordance with applicable obligations.

15. Information collected by venues and other organisations

The venue that receives your order has its own responsibilities for the personal information it receives and uses in connection with the sale and fulfilment of your order.

Stripe and other service providers may also collect information directly from you or merchant representatives under their own privacy statements and legal obligations.

This Fairway Flow Privacy Statement describes Fairway Flow's handling of information. It does not replace the privacy information of a venue, Stripe or another organisation where that organisation is independently responsible for its own collection or use.

16. Changes to this Privacy Statement

Fairway Flow may update this Privacy Statement as the service, our privacy practices or applicable requirements change.

The current version should show its effective date. Where a change is material, Fairway Flow should take reasonable steps to make the updated statement available through the Fairway Flow website and relevant ordering experience.