Aratohu · Guide
He aha ō ake raraunga?What is first-party data, and why it matters for NZ businesses
The information your own customers give you, on channels you run, is usually more accurate than data bought from others - and the one you control.
He whakautu poto / Short answer: First-party data is information you collect directly from your own visitors and customers on channels you run - website visits, form enquiries, purchases and email replies. It matters because it is usually more accurate than data bought from others or modelled by ad platforms, it stays under your control, and under the Privacy Act 2020 you can tell people plainly what you collect and why.
Updated 25 September 2026 · 6 min read
This guide explains first-party data for New Zealand businesses: what it is, how it differs from other kinds of data, and how to collect it well. The short version is that the most useful marketing data is often data you already have, or could have, if your website and CRM were joined up.
He rerekētangaHow is first-party data different from third-party data?
| Type | Who collects it | Example |
|---|---|---|
| First-party | You, directly, on your own website, shop, CRM or email list. | An enquiry form that records which page and campaign the person came from. |
| Zero-party | You, when a customer deliberately tells you something. | A customer choosing the products they want to hear about. |
| Second-party | Another organisation's first-party data, shared with you by agreement. | A co-marketing partner sharing event sign-ups with permission. |
| Third-party | Companies with no direct relationship with your customers, often combined from many sources. | Bought contact lists or audience segments built from third-party cookies. |
A third-party cookie is a cookie set by a domain other than the site the visitor is on, commonly used to follow people across sites. Safari and Firefox block many third-party cookies by default, and ad blockers remove more, which is one reason data built on them has become patchier.
Te takeWhy does first-party data matter for NZ businesses?
- It is closer to the truth. An enquiry in your CRM is a real person who contacted you. A modelled audience is an estimate.
- It shows what happens after the click. Ad platforms report their own clicks and conversions. Your own data can show which enquiries became paying customers.
- It is yours. You decide how long to keep it and who sees it, and you are not dependent on a platform's reporting rules.
- It is easier to explain. Under the Privacy Act 2020 you must tell people what you collect and why (IPP 3). Collecting directly, for a clear purpose, makes that explanation simple.
Ngā tauiraWhat counts as first-party data for a small business?
More than most businesses expect: website visits and the pages people read; the source of each visit, such as a search, a social post or a newsletter; form enquiries and quote requests; bookings and orders; email opens and replies; and notes from calls and meetings in your CRM. The value comes from joining these up, so that you can follow one enquiry from its first visit to a sale. That joining-up is what attribution means: deciding how much credit each marketing touch gets for a result.
Hei tīmataHow do you start building first-party data?
Decide what you need to know
Start with the business questions - which marketing brings enquiries, which enquiries become customers - and collect only what answers them (IPP 1).
Tag your links
Add UTM parameters (short labels in a link, such as utm_source=newsletter) to links in emails, social posts and ads so visits arrive labelled with their source.
Connect forms to your CRM
Send every enquiry into one customer record, with the page and source it came from, instead of an inbox or a spreadsheet.
Tell people and offer a choice
Explain in your privacy statement what you collect and why (IPP 3), and let visitors decline non-essential tracking.
Keep it tidy
Remove duplicates, set how long you keep records (IPP 9), and restrict who can see and export customer data (IPP 5).
Review it regularly
Once a month, check which sources produced enquiries and customers, and shift effort towards what the numbers show.
Ngā ture tūmataitiDoes first-party mean the privacy rules do not apply?
No. The Privacy Act 2020 applies to personal information whoever collects it. First-party data is easier to handle responsibly because you know what you collect and why, but you still need a lawful purpose, a clear privacy statement, fair collection, good security and sensible retention. If you pass data to advertising platforms for their own use, IPP 11 and IPP 12 come into play. Our guide to the Privacy Act 2020 and website tracking goes through each principle, and where your data lives covers overseas providers.
Te tūnga o uForgeWhere does uForge fit?
uForge is not available in New Zealand yet. In the markets where it is open, it puts the website, first-party tracking and attribution (Sadang) and the CRM on one platform, so a form enquiry arrives in the CRM with where it came from. Sadang records visits within the consent each visitor gives, and attribution is calculated once a day for sales orders, won deals and recruitment jobs. We will say plainly what is available in New Zealand, and where data will be hosted, before we open.
Register your interest in uForge Aotearoa and we will tell you when it opens in New Zealand, and where New Zealand data will be hosted.