Privacy Policy

Privacy Policy

The Privacy Act 2020 has principles covering the collection, use and disclosure of personal information, as well as the access to and correction of that personal information by the individuals concerned.

Personal information under the Privacy Act 2020 means “information about an identifiable individual”.

A breach of the privacy principles may amount to interference to privacy, which may be investigated by the Privacy Commissioner. Complaints not settled by the Privacy Commissioner may be referred to the Proceedings Commissioner and may fall to be determined by the Complaints Review Tribunal.

The general principles provided for by the Privacy Act 2020 include:

• Purpose: Information must be collected for a lawful purpose connected with the activity and functions of Our company.
• Source: Personal information should be collected directly from the individual concerned, where specifically authorised for collection by that individual, or where publicly available.
• Collection: When personal information is collected directly from an individual, the person collecting must ensure that the individual is aware of a number of matters, including the purpose for which it is collected, the intended recipient, the fact that the individual has a right to access to, and a right to request correction of, that information.
• Manner of Collection: Personal information may not be collected unlawfully, or in any way that is unfair in the circumstances or which intrudes unreasonably on personal privacy.
• Storage and Security: We ensure that we have reasonable safeguards for securing the protection of the information.
• Access to Personal Information: Any individual is entitled to confirmation from Us as to whether We hold personal information, and access to that information about them if it is readily retrievable.
• Correction: An individual is entitled to request correction of personal information about them held by Us. This may be requested in writing by contacting us.
• Accuracy: We cannot use personal information without taking reasonable steps to ensure that the information is up to date, complete, relevant and not misleading.
• Time Limit: Personal information may not be kept longer than necessary for the purpose for which it may lawfully be used (maximum time limit – six years after our last transaction).
• Limits on Use: Personal information obtained for one purpose may not be used for another purpose without your authority.
• Limits on Disclosure: We must not disclose personal information to any person or agency, unless one of the following applies:
  • there is a reasonable belief that disclosure is one of the purposes for which information has been obtained;
  • disclosure is for the individual concerned;
  • disclosure is necessary to enable the sale of the business;
  • disclosure is necessary to prevent a serious or imminent threat to public health or safety;
  • it has been authorized by the Privacy Commission;
  • that the information is publicly available;
  • that non-compliance is necessary to avoid prejudice to the maintenance of law; and
  • the information will not be used in a form which identifies the individual concerned; and
• Disclosure of Personal Information Outside of NZ: We may only disclose your personal information to foreign persons/entities, if the individual concerned authorises the disclosure after being expressly informed by Referall that that party may not be required to protect the information in a way that, overall, provides comparable safeguards to this Act; or
  • where that Foreign person/entity is carrying on business in NZ and in relation to the information, we believe on reasonable grounds that that party is subject to this Act; or
  • We believe on reasonable grounds that the foreign person/entity is subject to privacy laws that, overall, provide comparable safeguards to this Act; or
  • We believe on reasonable grounds that the foreign person/entity is a participant in a prescribed binding scheme; or
  • We believe on reasonable grounds that the foreign person/entity is subject to privacy laws of a prescribed country; or
  • We otherwise believe on reasonable grounds that the foreign person.entity is required to protect the information in a way that,overall, provides comparable safeguards to those in this Act.
• Unique Identifier: We may not assign a unique identifier to an individual unless this is necessary to enable it to carry out its functions effectively. A “unique identifier” is a tag that does not use the individual’s name.

Application of Privacy Policy

We have developed the following rules to ensure its obligations under the Privacy Act 2020 are observed and upheld:

• Purpose: Any information collected on this website will be collected for the purpose of furthering the relationship between Us and You, and enabling you to access Referall properties and our web-based services.
• Source: We will only collect personal information on this website from you. You will be identified by your Client number and date of birth if you wish to add personal information. Where a financial relationship is being applied for such as a Tenant-Landlord relationship, further information, that may be relevant to approving and furthering that application, We will only obtain that information legally in accordance with the Privacy Principles.
• Collection: Any information about you will be collected directly from you, unless otherwise authorized, and we advise that: We are the only intended recipient of this information; you have a right to access and correct any information; and> the purpose of collecting this information is as described above.
• Manner of Collection: Information gathered on this website will be limited to that information necessary to serve the purpose outlined above, and will be collected in a fair and lawful manner.
• Storage and Security: We will take all practicable steps to safeguard and secure any personal information gathered by way of this website or otherwise. By using this site, You are consenting to Us contracting with a third party service provider for the storage and security of your personal information.
• Access to Personal Information: You may contact us at any time to confirm that we hold personal information about you, and are entitled to request a copy of that personal information, which will be provided to you within 20 working days. This may be requested in writing by contacting us.
• Correction: As noted above, you may request that we correct any personal information held about you.
• Accuracy: We will not use any personal information about you without taking reasonable steps to ensure that the information is up-to-date, complete, relevant and not misleading. This means that we will not act on any information provided without:being satisfied that it is accurate; and/or seeking verification of that information from you or if necessary and with your consent, from a third party.
• Time Limit: We will keep personal information about you for as long as you continue to be a Client of ours. Thereafter, personal information will be destroyed within six years of the termination of the relationship.
• Limits on Use:
  • Personal information obtained by this website or otherwise will not be used except in association with any past or future financial services, transactions, interactions or proposals between Us and You.
  • Unless you have specifically requested otherwise, We may use information provided to this website for the purposes of marketing Our services or Our subsidiaries services to you.
  • For the avoidance of doubt, marketing material accompanying any use of your personal information which is authorized will not be a breach of the Privacy Act 2020 and this Privacy Policy.
  • For the avoidance of doubt, We may search information collected from you on this website or otherwise for statistical analysis or to target special offers to you.
• Limits on Disclosure: We will not disclose to any person or agency your personal information. In particular, we will not give information you have provided on this website or otherwise to a third party unless:
  • it is one of the purposes for which the information has been obtained (for example to undertake a credit check for the purpose of processing an application for tenancy);
  • it is disclosure to you or a person authorized by you;
  • it is necessary to enable a sale of Our business;
  • it is necessary to prevent a serious or imminent threat to public health or safety;
  • it is authorized by the Privacy Commission;
  • the personal information is publicly available;
  • it is necessary to avoid prejudice to the maintenance of law; and/or
  • the information will not be used in a form which identifies you.
• Disclosure of Information outside of NZ: We do not currently provide any personal information to Foreign Persons or Entity’s. If a requirement to do so does occur, our Privacy Officer will handle the exception, provide all relevant disclosures, obtain your necessary authority’s and record the event for future retrieval by you if needed.
• Unique Identifier: We will only assign a unique identifier to you if this is necessary to enable us to carry out our functions effectively.
• Independent Dispute Resolution: If we are not able to solve any complaint which you may raise in relation to our non-compliance with with the Privacy of your information, you have the right to refer your complaint to the Privacy Commissioner. Information can be found on their website.
• Updating this Policy: We reserve the right to change this Privacy Policy at all times. It is your responsibility to periodically verify the applicable privacy statement and to comply with its most recent version. This Privacy Policy statement was last modified in November 2025.
• Employment Data: As an employer, We may collect personal information of Our employees including name, address, email, date of birth, bank information, work experience, and education history. This information is provided to Us by Our employees through an application form. In the event a conditional employment offer is made, we may share this information with third parties for the completion of background screenings, payment distribution, and enrolment in legal certification/s. We may require such third parties to maintain confidentiality of employee personal information.We release account and other personal information when we believe release is appropriate to comply with the law, as well as to protect Our rights, property or safety, our clients or others. Certain laws or government regulations may require us to disclose non-public personal information about you to respond to court orders or legal investigations. Please note, that such disclosures do not include selling, renting, sharing, or otherwise disclosing personally identifiable information from Clients for commercial purposes in violation of the commitments set forth in this Privacy Policy.

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection. An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year. If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser. When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed. If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue. For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account with Referall, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Visitor comments may be checked through an automated spam detection service. Referall may retain and securely store some client data to enable us to communicate effectively with our clients.