This Privacy Policy explains how Kiwi Dynamics ("we", "us", "our") collects, uses, discloses and protects personal information when you visit our website, enquire with us, or engage us to build and run systems for your business.
We operate from New Zealand and work with clients in New Zealand, Australia, Singapore and further afield. This policy is written to meet the New Zealand Privacy Act 2020, the Australian Privacy Act 1988 and the Australian Privacy Principles, the Singapore Personal Data Protection Act 2012, and, where they apply to you, the EU and UK GDPR and the California Consumer Privacy Act. Where those laws differ, we apply the standard that gives you the most protection.
If you only read one section, read "Your Rights". It sets out exactly what you can ask us to do with your information and how to make us do it.
Who Is Responsible For Your Information
For information collected through this website and through your enquiries, Kiwi Dynamics is the controller, or in New Zealand and Australian terms, the agency holding the information. We decide why and how it is used.
For information inside systems we build and operate for a client, that client is the controller and we act as their processor. We handle that information only on their documented instructions, and their own privacy policy governs how it is used. If you are dealing with a business that runs on a system we built, contact that business first, and contact us if you cannot resolve it with them.
Information We Collect
- Information you give us: your name, email address, phone number, company name, website, the content of your enquiry, and anything else you choose to include when you contact us, book a call, apply for a role or subscribe to updates.
- Information collected automatically: IP address, approximate location derived from that IP address (country, region, city), browser and device type, operating system, referring page, the pages you view, the time and duration of your visit, and similar technical data.
- Information from a live engagement: contact details for your team, access credentials you choose to share with us, and the business data needed to build and test the system you have asked for.
- Information from third parties: publicly available business information, and details passed to us by a referrer where you have asked them to introduce us.
We do not seek out sensitive information, which includes health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation and criminal records. Please do not send it to us. If you do, we may delete it.
Our services are not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.
Why We Collect It And Our Legal Basis
- To answer your enquiry and provide the services you asked for. Basis: performance of a contract, or steps taken at your request before entering one.
- To run and improve the website, keep it secure, and understand which pages are useful. Basis: our legitimate interests in operating a functioning business website.
- To send updates you have opted into. Basis: your consent, which you can withdraw at any time.
- To meet our legal, tax and accounting obligations, and to establish or defend a legal claim. Basis: compliance with a legal obligation and our legitimate interests.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to train AI models. Under the California Consumer Privacy Act we have not sold or shared personal information in the preceding twelve months.
Who We Share It With
We share personal information only with the service providers that let us operate, and only to the extent each one needs. Every provider is bound by contract to protect it and to use it only for the service they provide to us.
- Hosting, security and network: Cloudflare, which serves this site and provides the country data used to tailor page content.
- Analytics: Google Analytics and PostHog, used to understand site usage in aggregate.
- Email delivery: Google Workspace and Postmark, used to receive your enquiry and reply to it.
- AI model providers, where a system we build for a client sends content to a model for processing. Which providers apply is set out in that client engagement.
- Professional advisers, insurers, and authorities where we are legally required to disclose.
We may disclose information if we are required to by law, a court order, or a regulator, or where disclosure is necessary to prevent a serious threat to someone's life, health or safety. If we are ever compelled to hand over information about you, we will tell you unless we are legally prohibited from doing so.
If our business is sold or restructured, information may transfer to the acquirer. It stays subject to a policy no less protective than this one.
Sending Information Overseas
We are based in New Zealand, and our providers operate globally, so your information may be stored or processed outside your country, including in Australia, Singapore, the United States and the European Union.
Before sending personal information overseas we take the steps our law requires. Under New Zealand Information Privacy Principle 12 we satisfy ourselves that the recipient is subject to comparable safeguards. Under Australian Privacy Principle 8 we take reasonable steps to ensure overseas recipients do not breach the Australian Privacy Principles. Under the Singapore Personal Data Protection Act we ensure a comparable standard of protection. For transfers out of the EU or UK we rely on Standard Contractual Clauses or an adequacy decision.
How Long We Keep It
- Enquiries that do not become work: up to 24 months, then deleted.
- Client records, contracts and invoices: seven years after the engagement ends, which is the retention period New Zealand tax law requires.
- Website analytics: up to 26 months in aggregate form.
- Marketing subscriptions: until you unsubscribe, then a suppression record so we do not email you again by mistake.
When information is no longer needed for the purpose we collected it for, and we are not required to keep it, we delete it or de-identify it.
How We Protect It
We use access controls, encryption in transit, encrypted secret storage, least-privilege access for our own team, and providers that hold recognised security certifications. Systems we build are designed so client data stays in the client's own accounts wherever practical.
No system is perfectly secure and we do not claim otherwise. If a privacy breach occurs that is likely to cause serious harm, we will notify you and the relevant regulator as required: the Office of the Privacy Commissioner in New Zealand, the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, the Personal Data Protection Commission in Singapore, and the relevant supervisory authority within 72 hours where the GDPR applies.
Your Rights
Wherever you are, you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, stop using it for marketing, or explain what we are doing with it. Email us at the address below. We will respond within 20 working days, which is the New Zealand statutory timeframe, and sooner where another law requires it.
- New Zealand: Information Privacy Principles 6 and 7 give you the right to access and correct your information. If you are unhappy with our response you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
- Australia: the Australian Privacy Principles give you access and correction rights, and the right to complain to the Office of the Australian Information Commissioner at oaic.gov.au.
- Singapore: the Personal Data Protection Act gives you access, correction and withdrawal of consent rights, and the right to complain to the Personal Data Protection Commission at pdpc.gov.sg.
- EU and UK: you have rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to your local supervisory authority or the UK Information Commissioner's Office.
- California: you have the right to know, delete, correct, and opt out of sale or sharing, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information.
We will not charge you for a request unless it is manifestly unfounded or excessive, and we will tell you before charging anything. We may need to verify your identity before releasing information, which protects you as much as us.
Cookies And Tracking
This site uses cookies and similar technologies. What they are, which ones we use, and how to turn them off is set out in our Cookie Policy.
Changes To This Policy
We may update this policy as our services, our providers or the law change. The current version is always on this page, and material changes will be signalled on the site. Continuing to use our website or services after a change means you accept the updated policy.
Contact Us
Got questions, concerns, or just want to say hi? Reach us at [email protected].