1. About this policy
1.1 This policy explains how MAITS Limited (NZBN 9429051871221) (MAITS, we) collects, uses, discloses and protects personal information. It applies to our website, the customer portal and our services, and follows the Privacy Act 2020 (New Zealand) and its Information Privacy Principles.
1.2 Where we process personal information for a customer organisation, for example on a website we host for them, that organisation is responsible for it. We handle it under our Data Processing Agreement with them.
2. What we collect and why
| Situation | Information | Purpose |
|---|---|---|
| Website enquiries | Name, organisation, email, phone and enquiry details | To respond, and to keep a record of the enquiry |
| Accounts and organisations | Name, email, role, organisation details, membership and verification records | To provide the portal and services, verify organisations and prevent fraud |
| Sign-in | Sign-in identifier, email and sign-in events, through Microsoft Entra External ID | To authenticate you securely. We do not store passwords. |
| Quotes, orders and agreements | Requirements, and acceptance records (name, role, date and time, document versions and price) | To form, perform and evidence agreements |
| Billing | Billing contacts, invoices, payment status and masked card details | To bill and collect payments. Stripe holds the full card details. |
| Communications | Email address, message content and delivery status | To send service notices, such as quotes, invoices, renewal reminders and invitations |
| Security and operations | IP address, request metadata and error logs | To protect our systems, detect misuse and fix faults |
| AI-assisted features | Content you choose to submit | To generate the content you request |
3. Information from others
3.1 We sometimes receive information about you from someone else. For example:
- a colleague invites you to an organisation account;
- a customer names you as a contact or representative; or
- we check an organisation against public registers.
When we do, we take reasonable steps to let you know that we hold it and why, unless an exception under the Privacy Act applies.
4. Cookies and analytics
4.1 We use essential cookies for sign-in and security, and first-party records of how people arrive at our sign-up pages (campaign tags only). We do not use advertising pixels or third-party analytics. Our website loads fonts from Google Fonts, so your browser shares your IP address with Google.
5. Disclosure
5.1 We disclose personal information to the providers who help us deliver our services, as listed in our Hosting and Data Residency Schedule. These are Microsoft (hosting, storage, sign-in, email, AI and monitoring), Stripe (payments) and Google (fonts). We may also disclose it:
- to our professional advisers;
- where the law requires or allows it; or
- to a purchaser of all or part of our business.
We do not sell personal information.
6. Overseas processing
6.1 Our application servers and databases are in Microsoft's Australia East region. Some processing takes place in other countries:
- website delivery through Microsoft's global network;
- email delivery to your mail provider;
- AI-assisted features using a global Azure OpenAI deployment; and
- payment processing by Stripe, including in the United States.
6.2 Where a provider stores or processes information only on our behalf, we remain responsible for it. Where we disclose information to an overseas organisation for its own purposes, we do so in line with Information Privacy Principle 12.
7. Retention
7.1 We keep personal information only for as long as it is needed for the purpose it was collected for and to meet legal obligations. For example, we keep financial and tax records for 7 years. Operational logs are kept for 30 days. When information is no longer needed, we delete or de-identify it.
8. Security
8.1 We protect personal information with:
- encryption;
- restricted, least-privilege access;
- secure management of credentials; and
- monitoring.
If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and the people affected, as required by law.
9. Your rights
9.1 You can ask to access or correct the personal information we hold about you by emailing info@maits.co.nz. We will respond within 20 working days.
10. Questions and complaints
10.1 Please contact us first at info@maits.co.nz. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (privacy.org.nz). If you are in Australia, you can also contact the Office of the Australian Information Commissioner (oaic.gov.au).
11. Changes
11.1 We publish each version of this policy, with its effective date, in our legal documents register.