Enter Token
Enter Token

Privacy Policy

Home>Privacy Policy

1. Purpose and status

1.1 Purpose

This Privacy Policy explains how Credit Sense New Zealand (‘we‘, ‘us‘, ‘our‘) handles Personal Information and Credit Information when providing the Services in New Zealand. We are not a Credit Reporter and do not provide credit reporting services.

1.2 Status

This Privacy Policy explains how we comply with the Privacy Act 2020 (NZ), including the Information Privacy Principles. We are not a credit reporter and do not handle Credit Information for our own credit reporting purposes. Authorised Recipients remain responsible for their own obligations when using Credit Information received through the Services.

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, or legal requirements. The updated version will be made available through our usual channels (for example, our website).

2. Definitions

Authorised Recipient means a person or organisation, such as a bank, that a Customer authorises to access, receive, assess, use, or consider their Customer Data.

Credit Information has the meaning given in Part 5 of the Privacy Act 2020.

Customer means an Individual or business who consents to and authorises the collection, use, holding, access to, or disclosure of Customer Data through the Services.

Customer Data means Personal Information or Credit Information relating to a Customer, but excludes passwords and credentials.

Data Capture Mechanism means the technology, process, or functionality used, with the Customer’s consent and authorisation, to access a Data Source and retrieve Customer Data.

Data Source means the person, system, account, platform, or other source from which Customer Data is accessed using a Data Capture Mechanism.

Individual means a natural person.

Personal Information means information about an identifiable Individual.

Privacy Act 2020 means the Privacy Act 2020 (NZ).

Services means: data sharing services, which includes, with the Customer’s consent and authorisation: (a) accessing Customer Data and providing that Customer Data to an Authorised Recipient(s), to enable the Authorised Recipient(s) to access, assess, use, and consider the Customer Data; (b) storing, using, accessing, and holding Customer Data; and (c) any other services to which the Customer consents and authorises.

3. Our role in your information

3.1 Our role

With the Customer’s consent and authorisation, we access, hold, use, and transmit Customer Data through the Services. We collect Personal Information by lawful means and in a way that is fair and not unreasonably intrusive, taking into account the nature of our Services and the sensitivity of the information involved.

3.2 Authorised Recipients

An Authorised Recipient is responsible for how it assesses, uses, or otherwise handles Customer Data received through the Services, in accordance with its own privacy policy. This Privacy Policy applies to our handling of that Customer Data.

3.3 Our purposes

We handle Customer Data to provide and administer the Services, including: enabling Customers to connect Data Sources and authorise disclosure to Authorised Recipients; authenticating users and managing access; providing support, maintenance, security, testing, and quality assurance; responding to enquiries, complaints, and access or correction requests; complying with legal obligations and lawful requests; and providing other services authorised by the Customer.

If we use Personal Information for another purpose, we will do so only where permitted.

4. Types of Personal Information we collect (including credit information)

4.1 Customer Data processed through the Services

Customer Data (including information accessed from a Data Source) may include:

  • identity details (name, date of birth, previous names, and contact details);
  • government identifiers where lawful and necessary (for example, driver’s licence or passport details for identity verification);
  • financial and credit-related details (for example, credit applications, account information, repayment history, defaults, credit enquiries, and related indicators);
  • employment and income-related information (where relevant to credit assessment or verification services);
  • fraud and risk signals (for example, suspicious activity flags, device and network indicators, identity verification results);
  • public record information (for example, insolvency and certain court-related information where permitted);
  • interactions with us (support enquiries, complaint records, recordings where notified, correspondence);
  • technical and usage information (IP address, device identifiers, cookies, and similar technologies on our websites);
  • Credit Information made available through a Data Source.

5. How we collect Personal Information: direct vs indirect collection

5.1 Information provided by the Customer

We may collect Personal Information directly when a Customer:

  • creates an account, completes a form, submits an enquiry, or communicates with us;
  • accesses our websites or applications (including via cookies and similar technologies);
  • requests access to, or correction of, information we hold about you;
  • submits a complaint or privacy request.

5.2 Direct collection notices

When we collect Personal Information directly from you, we take reasonable steps to ensure you are aware of:

  • the fact that the information is being collected;
  • why we are collecting it and how it will be used;
  • the recipients or categories of recipients we may disclose it to;
  • whether collection is required by law or voluntary, and what may happen if you do not provide it; and
  • how you can access and correct your information and make a complaint.

5.3 Customer Data accessed from a third party

With the Customer’s consent and authorisation, we may use a Data Capture Mechanism to access Customer Data from a Data Source. We may also access Customer Data from third parties such as:

  • Banks and deposit-taking institutions, and credit providers;
  • other credit reporters or credit bureaus (where lawful and permitted);
  • public records and registers (for example, New Zealand Companies Office, insolvency registers, and certain court-related records where permitted);
  • Utility providers and real estate agents;
  • fraud prevention networks and identity verification providers; and
  • government agencies where permitted or required.

5.4 Indirect collection and notification

Where we collect Personal Information indirectly, we will provide any notice required by IPP 3A, subject to applicable exceptions. An Authorised Recipient may be responsible for its own notification obligations. We may reasonably rely on information and notices provided by those parties in some circumstances.

We may rely on an exception to notification only where permitted by IPP 3A, including where the Individual has already been made aware of the relevant matters, notification would prejudice the purpose of collection, compliance is not reasonably practicable in the circumstances, or another statutory exception applies.

5.5 How we use identifiers

We may collect, use, or assign identifiers where reasonably necessary to provide, secure, and administer the Services, including internal Customer reference numbers, transaction identifiers, device identifiers, account identifiers, and identifiers used to manage authorised access to Customer Data.

6. Who we disclose Personal Information to

6.1 General disclosures

We may disclose Customer Data to:

  • an Authorised Recipient and its authorised users, where necessary to provide the Services;
  • hosting, cloud, security, support, and other service providers that assist us to provide the Services, subject to appropriate confidentiality and security obligations;
  • professional advisers;
  • regulators, law enforcement agencies, courts or tribunals where required or authorised by law; and
  • another person where the Customer has authorised the disclosure or the disclosure is otherwise permitted by law.

6.2 Disclosure controls

We take reasonable steps to ensure disclosures are authorised or otherwise permitted by law and protected by safeguards appropriate to the circumstances. Recipients remain responsible for their own handling and use of Customer Data.

7. Overseas disclosures and cross-border transfers

7.1 When we may disclose or process information overseas

Companies or individuals within our organisation, and organisations or individuals that support our Services and products, may be located outside New Zealand. As a result, Personal Information may be held or processed outside New Zealand, including where:

  • we use offshore hosting or cloud infrastructure;
  • we engage offshore support, security, or development teams; or
  • a Customer or Authorised Recipient requests a cross-border service outcome.

7.2 How we safeguard overseas disclosures

We take reasonable steps to use a permitted transfer mechanism or otherwise satisfy its requirements. Measures may include contractual protections, an assessment of the recipient’s legal framework, customer authorisation, or another lawful mechanism. We are not responsible for an overseas recipient’s independent acts or omissions except to the extent required by law.

7.3 Risks

Overseas recipients may be required to disclose information under their local laws. We manage this risk through due diligence and contractual controls where practicable.

8. Access, correction, and deletion

8.1 Access

You may request access to Personal Information we hold about you. We will respond within a reasonable time and may need to verify your identity before providing access.

8.2 Correction

You may request correction of your Personal Information if you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading. If we do not make the correction requested, we will:

  • tell you why (where required); and
  • if requested and where appropriate, we may attach a statement of correction sought to the information.

8.3 Customer Data provided to an Authorised Recipient

We will provide reasonable assistance in relation to Customer Data that is under the control of an Authorised Recipient, and remain responsible for responding to requests concerning Customer Data that we hold.

8.4 Requests for deletion

You may ask us to delete Personal Information we hold about you. We may decline or limit a request where retention is reasonably required for our business or Services, by a Customer or other relevant party, or by law.

8.5 How to make a request

You may make a request to access or correct your Personal Information using the contact details at section 14.

We may ask for information to help us locate the relevant records and confirm your identity. If a fee applies, we are permitted by law to withhold certain information, or we are unable to make the correction requested, we will advise you as soon as reasonably possible.

9. Storage, security, and retention

9.1 Security

We use reasonable safeguards appropriate to the nature of the information, the Services, and the risks involved. No security measure is guaranteed to prevent every incident, and Customers and other recipients are responsible for securing their own systems, credentials, and use of the Services.

9.2 Retention and disposal

We retain Customer Data for as long as reasonably required for the Services, our business operations, or legal, contractual, audit, security, and risk-management purposes. When no longer required, we may delete, destroy, or de-identify it using reasonable processes.

9.3 Safeguards

Where we use automated tools to provide, secure, monitor, or maintain the Services:

  • we aim to ensure those tools are fit for their operational purpose and appropriately tested;
  • we use access controls and monitoring to reduce misuse; and
  • we provide avenues for Individuals to request access and correction.

These safeguards do not apply to an Authorised Recipient’s independent assessment or decision-making processes, which are governed by that Authorised Recipient’s practices and privacy policy.

10. Cookies, online identifiers, and digital services

10.1 Cookies and similar technologies

We may use cookies, pixels, and similar technologies to operate our websites, keep them secure, and understand usage.

10.2 Managing cookies

You can manage cookies through your browser settings. Some functionality may be affected if you disable certain cookies.

11. Marketing and Authorised Recipient assessment

11.1 Marketing

We will not use or disclose Personal Information for direct marketing purposes.

11.2 Assessment by an Authorised Recipient

An Authorised Recipient may access, assess, use, or consider Customer Data received through the Services. Any assessment or decision made by an Authorised Recipient using Customer Data is the responsibility of that Authorised Recipient.

12. Notifiable Privacy Breaches

12.1 What is a privacy breach

A privacy breach is an incident that involves unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, Personal Information, or an action that prevents an agency from accessing Personal Information (for example, ransomware).

12.2 Notification approach

We will assess and respond to privacy breaches in accordance with applicable law. Where another party is responsible for notification, we may notify and reasonably assist that party. We will make notifications for which we are legally responsible.

13. Complaints

13.1 How to complain

If you have concerns about how we handle your Personal Information, you may contact our internal dispute resolution team at the details set out in section 14.

Please include sufficient detail so we can understand and investigate the issue.

13.2 Our process

Once we have received and recorded your complaint, we will:

  1. Acknowledge your complaint as soon as is practicable (but no later than one (1) working day after receipt), including providing you with the contact details of the person managing your complaint;
  2. Investigate your complaint; and
  3. Make a decision about your complaint and communicate that decision to you in writing.

We will work with you to achieve a fair and balanced outcome, provide you with a progress update every 10 days, and aim to resolve all complaints within 30 days. You can get updates on the progress of your complaint at any time by contacting the person managing your complaint.

If we cannot resolve your complaint within 30 days, we will notify you, provide an update on our progress, and advise you of your right to escalate your complaint to our external dispute resolution service, Financial Services Complaints Ltd (FSCL).

13.3 External escalation

If you are not satisfied with our response, you may escalate your complaint to our external dispute resolution service, or the Office of the Privacy Commissioner at the details set out at section 14. If your complaint concerns an Authorised Recipient’s assessment, use, or disclosure of Customer Data, you may also contact that Authorised Recipient using the contact details in its privacy policy.

14. Contact details

14.1 Privacy enquiries, deletion, access or correction requests

14.2 Complaints

14.3 External dispute resolution

14.4 Office of the Privacy Commissioner