Privacy & Terms

MDMC is a design and digital strategy studio. This site exists to show our work and let you get in touch — there are no accounts, no payments and no logins on it.

In short: we collect what you type into our contact or job-application form, we use Google Analytics to understand how the site is used, and we use Cloudflare Turnstile to keep spam out of our forms. Enquiries reach us as email; we do not store them in a database on this site. We never sell your information.

This privacy policy is issued by Finlayson Holdings New Zealand Limited, trading as MDMC, whose New Zealand studio is at Level 2, 47 Salisbury St, Christchurch Central, Christchurch 8013.

For anything in this document, or to ask about your personal information, email nz@mdmc.co or call +64 3 660 0336.

When you use our contact form we collect your name and email address, and — if you choose to fill them in — your company and an indication of budget, along with your message.

When you apply for a role we collect your name, email address, your message, a portfolio or LinkedIn link if you provide one, and any CV or cover letter you attach (.pdf, .doc or .docx, up to 15MB in total).

Automatically, as you browse, our analytics collects pages viewed, approximate location derived from your IP address, device and browser type, referring site, and a small number of specific actions: sending an enquiry, and clicking one of our email or phone links. We use this to understand which work and which markets people care about.

To protect our forms, Cloudflare Turnstile receives your IP address and signals about your browser in order to tell a person from an automated script. It runs only on pages with a form.

We do not ask for, and have no use for, information about your health, finances, ethnicity, or beliefs. Please don't send it to us.

We use what you send us to reply to you and, if it leads somewhere, to discuss and carry out work. We use analytics to improve the site and to measure our advertising. We use Turnstile to keep our inboxes usable.

If you email us, we will email you back. We do not add enquirers to a marketing list, and we do not send unsolicited commercial messages — consistent with the Unsolicited Electronic Messages Act 2007.

We advertise MDMC on Google, and we measure whether those ads lead to real enquiries.

Our Google Analytics property has Google Signals enabled. If you are signed in to a Google account and have ads personalisation turned on for it, this allows Google to associate your visit here with that account. It lets us see whether an ad led to an enquiry even when the two happened on different devices, understand the broad demographics and interests of people looking at our work, and show our ads again to people who have visited this site before — commonly called remarketing.

We only ever see this as aggregated reporting and audience sizes. We cannot see, and Google does not give us, the identity of any individual visitor.

You can turn this off without leaving our site. Google's My Ad Center controls ads personalisation on your Google account, and Google's Analytics opt-out browser add-on stops Google Analytics collecting anything from your browser at all. Blocking cookies in your browser also works.

Your enquiry or application is passed to our email provider and delivered to a studio inbox. It is not written to a database on this site. Attachments travel with the email and are not stored separately.

We rely on the following providers, all of which are located outside New Zealand — principally in the United States. Sending your information to them is an overseas disclosure under the Privacy Act 2020, and by using this site or our forms you understand that it takes place:

• Google — Google Analytics, and Google Workspace, which holds our inboxes. Analytics also contacts a Google advertising endpoint, which is how we measure ad campaigns.
• Cloudflare — DNS, security and content delivery for both of our domains, the Turnstile anti-spam check, and Cloudflare's own traffic measurement.
• Mailgun (Sinch) — delivery of the email your form becomes, in its United States region.
• Strapi Cloud — our content management system, which also hosts the endpoint your form posts to.
• GitHub — hosting of the site's pages.

We do not sell personal information, and we do not share it with anyone else except where we are required to by law.

This site sets the following cookies on our own domains. We set no advertising cookies ourselves — but see Advertising above: Google may set or read its own cookies on Google domains as part of the analytics and ads measurement described there.

• _ga and _ga_9TWMV1SZMR — Google Analytics. These distinguish one visitor from another so that repeat visits are not counted as new people.
• cf_clearance — set by Cloudflare when a security or anti-spam check is performed, so that you are not challenged repeatedly.

This site does not store a region or studio preference in your browser.

You can block or delete cookies in your browser settings. The site will continue to work; only the analytics will be incomplete.

In Google Analytics, event data — the record of pages viewed and actions taken — is retained for 2 months, and user-level data for 14 months, after which Google deletes it.

Enquiries and job applications stay in our email for as long as we need them for the purpose you sent them — to reply to you, and where it leads to work, for our project and business records. We review them periodically and delete what we no longer need.

We keep information only as long as we need it for the purpose we collected it for, and then delete it.

Under the Privacy Act 2020 you have the right to ask us for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong. Email nz@mdmc.co and we will respond within 20 working days, as the Act requires.

If you are not satisfied with how we have handled your information or your request, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

This site is served over HTTPS, and our forms are protected against automated abuse. No transmission over the internet can be guaranteed completely secure, so please do not send us anything highly sensitive through a web form.

About this site. The content here is provided for information. It describes work we have done and services we offer, and it is not an offer, a quote, or professional advice you should act on without talking to us first.

Our work and our clients'. The design, text, and code of this site are ours. Client work shown here is published with our clients' agreement, and the trade marks, logos and product names in it belong to those clients. Nothing here grants you a licence to reuse any of it.

Acceptable use. Please don't attempt to interfere with the site, submit anything unlawful or misleading through our forms, or use automated means to extract our content at a scale that affects the site's operation.

Links out. Where we link to another site, we don't control it and aren't responsible for it.

Availability and accuracy. We take care to keep this site accurate and available, but we don't promise it will be either at all times, and we may change or remove content without notice.

Liability. To the extent the law allows, we are not liable for loss arising from your use of this site or from reliance on its content. Nothing in these terms limits rights you have under New Zealand law that cannot be excluded, including under the Consumer Guarantees Act 1993 and the Fair Trading Act 1986 where those apply to you.

Governing law. These terms and this privacy policy are governed by New Zealand law, and the New Zealand courts have non-exclusive jurisdiction over any dispute about them.

Changes. We may update this page. The date at the top tells you when it last changed.