Privacy Policy

Tawhai Stand operates under the New Zealand Privacy Act 2020. This policy explains what personal information we collect, why we collect it, how we use it, and what your rights are.

Who we are

Tawhai Stand
Rotorua, New Zealand
Email: hello@tawhaistand.co.nz
Web: tawhaistand.co.nz

What information we collect

We only collect information that we actually need. Depending on how you interact with us, that may include:

When you contact us or enquire about our services:

• Your name
• Your email address and/or phone number
• Your business name and role
• The nature of your enquiry

When you become a client:

• Business contact details
• Information about your business operations relevant to the service we're providing
• Payment details (processed securely through a third-party payment provider, we do not store card details)
• Any documents, data, or materials you share with us as part of service delivery

When you visit our website:

• Standard web analytics data (pages visited, time on site, device type) via cookies. See our Cookie section below

We do not collect sensitive personal information (such as health information, ethnicity, or financial records) unless you specifically provide it as part of a service engagement and it is directly relevant to the work.

Why we collect it

We collect information for the following purposes:

• To respond to your enquiries and provide our services
• To communicate with you about your project or engagement
• To process payments
• To meet our legal and contractual obligations
• To improve how we work and what we offer

We will not use your information for any purpose that isn't listed here without asking you first.

How we collect it

We collect information directly from you, through our website contact form, email, phone, or in person. We do not purchase or source personal information from third parties.

In some cases, as part of delivering our services, you may share business data with us that includes information about your own customers or staff. We treat that information with the same care as your own, and we only use it for the purpose of delivering the agreed service.

How we use AI tools in our work

Tawhai Stand uses AI systems and third-party software platforms as part of delivering our services. This is central to what we do, so we want to be transparent about it.

What this means in practice:

When we work with your business data, for example to build an automated workflow, conduct research, or deploy an AI agent, that data is processed using third-party AI and automation tools.

What we commit to:

• We only use third-party tools to process data that is necessary for the service you've engaged us for
• We do not input personally identifiable information into any tool unless it is required to deliver the service and you have been informed
• We take reasonable steps to anonymise or de-identify data before processing where possible
• We do not use your business data to train AI models
• We do not sell or share your data with any third party for their own purposes

Third-party tools:

A current list of the third-party platforms we use is maintained separately and is available on request. That list sits outside this policy so it can be kept up to date as our tools change, without requiring a full policy revision. To request a copy, contact us at hello@tawhaistand.co.nz.

All third-party tools we use are required to maintain appropriate data security standards. Where tools are hosted outside New Zealand, we take reasonable steps to ensure comparable privacy protections are in place. See the Overseas Transfer section below.

Overseas transfer of data

Some of the tools we use to deliver our services are hosted outside New Zealand. When we use these tools to process your information, your data may be transferred to and stored in other countries, including the United States and the European Union.

Under the NZ Privacy Act 2020, we are required to take reasonable steps to ensure that overseas recipients of personal information provide comparable privacy protections. The platforms we use are established, reputable services with documented data protection policies.

If you have concerns about overseas data transfer, please contact us before engaging our services.

How we store and protect your information

We take reasonable steps to keep your information secure. This includes:

• Using encrypted communication (HTTPS) on our website and email
• Limiting access to your information to only the people who need it to deliver your service
• Not keeping information longer than necessary
• Using reputable, security-certified third-party platforms

No system is completely secure. If we become aware of a privacy breach that is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

How long we keep your information

We keep your information for as long as it's needed for the purpose it was collected, or as required by law. In general:

• Enquiry records: 12 months if no engagement follows
• Client records: 7 years from the end of the engagement (to meet standard business record-keeping requirements)
• Payment records: As required by the Inland Revenue Department

When information is no longer needed, we delete it or de-identify it.

Sharing your information

We do not sell your personal information. We do not share it with third parties for their own marketing purposes.

We may share your information:

• With third-party platforms as part of delivering our services (see Third-party tools section above)
• With a professional adviser (e.g. accountant or lawyer) where required
• If required by law or a court order
• If we believe disclosure is necessary to protect the safety of any person

Cookies

Our website uses cookies (small files stored on your device) to understand how people use the site. We use this to improve the website experience.

We use:

• Analytics cookies: to understand traffic and usage patterns
• Essential cookies: required for the website to function

We do not use cookies to track you across other websites or for advertising purposes.

You can control cookies through your browser settings. Disabling cookies may affect how some parts of our website work.

Your rights under the NZ Privacy Act 2020

You have the right to:

Access your information

You can ask us what personal information we hold about you. We will respond within 20 working days.

Correct your information

If any information we hold is inaccurate or out of date, you can ask us to correct it.

Ask us to delete your information

In some cases, you can ask us to delete information we hold about you. We'll let you know if there's a reason we're required to keep it (e.g. for tax records).

Withdraw consent

If you've consented to us using your information for a specific purpose, you can withdraw that consent at any time.

Make a complaint

If you think we've mishandled your information, please contact us first and we'll do our best to resolve it. If you're not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

How to contact us about privacy

To exercise any of your rights, request our third-party tools list, or if you have any questions about this policy:

Email: hello@tawhaistand.co.nz
Post: Tawhai Stand, Rotorua, New Zealand

We will acknowledge your request within 5 working days and respond in full within 20 working days, as required by the Privacy Act 2020.

Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. If we make significant changes, we'll let current clients know directly.

Tawhai Stand is committed to handling your information with care and respect. If something in this policy is unclear, please ask. We'd rather explain it than have you wonder.