1. Information We Collect

Personal Information You Provide

We collect personal information that You voluntarily provide when You register for an account on the Platform, complete forms, subscribe to Our services, participate in activities on the Platform, or otherwise communicate with Us. The lawful basis for this collection is contractual necessity (where the information is required to provide You with access to the Platform and fulfil Our obligations under the Terms of Service) and, where applicable, Your consent. The categories of personal information We may collect include, but are not limited to:

• Full name, including any preferred or trading names
• Email address (corporate and, where provided, personal)
• Phone number (landline and mobile)
• Address, state, province, ZIP/postal code, city
• Company and role information, including job title, department, and organisational hierarchy
• Authentication credentials and account security data
• Content You upload, submit, or create within the Platform, including documents, images, form responses, annotations, and signatures
• Communications You send to Us, including support requests and feedback

Information Automatically Collected

We automatically collect certain technical and usage information when You visit, use, or navigate the Platform. This collection is undertaken on the basis of Our legitimate interest in maintaining the security, performance, and operational integrity of the Platform, and in understanding how Our users interact with the Platform so that We may improve it. While this information does not, by itself, reveal Your specific identity, it may include: IP address, browser type and version, device type and operating system, language and locale preferences, referring URLs, pages visited and features used within the Platform, timestamps and session duration, country and approximate geographic location derived from IP address, and click-stream data. We may also use cookies, web beacons, pixel tags, and similar tracking technologies to collect this information. You may manage Your cookie preferences through Your browser settings; however, disabling certain cookies may impair the functionality of the Platform. Analytics data collected through third-party services is processed in accordance with the respective privacy policies of those providers.

2. How We Use Your Information

We process personal information collected via the Platform for the purposes described below. Each purpose is supported by one or more lawful bases under the Privacy Act 2020, including contractual necessity (where processing is required to perform Our obligations to You), legitimate interest (where processing is necessary for the operation, security, or improvement of the Platform and is not overridden by Your rights), and consent (where You have provided explicit permission for a specific processing activity). The specific purposes include:

• Facilitating account creation, authentication, and the sign-in process (contractual necessity)
• Managing user accounts, permissions, roles, and organisational settings (contractual necessity)
• Sending administrative information to You, including service notifications, security alerts, system updates, and changes to Our terms or policies (contractual necessity and legitimate interest)
• Data analysis, identifying usage trends, and evaluating and improving our platform, products, and your experience (legitimate interest)
• Ensuring compliance with applicable laws, regulations, and industry standards, including health and safety requirements relevant to asset and site management (legal obligation and legitimate interest)
• Detecting, preventing, and responding to fraud, unauthorised access, security incidents, and other potentially prohibited or illegal activities (legitimate interest)
• Providing customer support and responding to Your enquiries and requests (contractual necessity)
• Generating anonymised and aggregated statistical data for internal reporting, benchmarking, and service improvement purposes (legitimate interest)

3. Disclosure of Your Information

We may share Your personal information with third-party service providers, subcontractors, and associated organisations solely for the purposes of completing tasks and providing services to You on Our behalf. Such third parties are bound by contractual obligations of confidentiality and data protection and are permitted to use Your personal information only for the specific purposes for which it was disclosed. The categories of recipients with whom We may share Your information include:

• Cloud infrastructure and hosting providers that store and process Platform data on Our behalf
• Analytics and monitoring service providers that assist Us in understanding Platform usage and performance
• Payment processors and billing service providers, where applicable to subscription or transactional services
• Professional advisers, including legal counsel, auditors, and accountants, where required for the administration of Our business
• Government authorities, regulators, or law enforcement agencies where We are compelled by law to make a disclosure or where necessary to protect Our legal rights

Your personal information may be transferred to, stored in, or processed in jurisdictions outside of New Zealand, including countries where Our cloud infrastructure providers maintain servers. Where such cross-border transfers occur, We take reasonable steps to ensure that adequate safeguards are in place to protect Your information to a standard comparable to that required under the Privacy Act 2020. These safeguards may include data processing agreements incorporating standard contractual clauses, reliance on the recipient's adherence to internationally recognised privacy frameworks, and ongoing due diligence assessments of Our third-party providers.

4. Security

We implement and maintain administrative, technical, and physical security measures designed to protect Your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to: encryption of data at rest and in transit using industry-standard protocols, role-based access controls limiting access to personal information on a need-to-know basis, multi-factor authentication for administrative and privileged accounts, regular security audits and vulnerability assessments, and secure software development practices. While We have taken reasonable steps to secure the information You provide, no electronic transmission over the Internet or information storage technology can be guaranteed to be completely secure, and We cannot warrant absolute security. In the event of a notifiable privacy breach as defined under Part 6 of the Privacy Act 2020, We shall notify the Office of the Privacy Commissioner and affected individuals as soon as practicable in accordance with Our obligations under that Act. Our incident response procedures include immediate containment and assessment, determination of the scope and severity of the breach, notification within the statutory timeframes, and implementation of remedial measures to prevent recurrence.

5. Children's Policy

The Platform is designed for use by businesses and professionals and is not directed at children. We do not knowingly solicit, collect, or process personal information from individuals under the age of 18 years. By using the Platform, You represent and warrant that You are at least 18 years of age or that You are the parent or guardian of such a minor and consent to such minor dependent's use of the Platform. In accordance with Our obligations under the Privacy Act 2020 and the Information Privacy Principles, if We become aware that We have inadvertently collected personal information from a child under the age of 18 without appropriate parental or guardian consent, We shall take prompt steps to delete such information from Our systems and records. If You believe that We may hold information relating to a child, please contact Us immediately at admin@waldo.co.nz so that We may investigate and take appropriate action.

6. Data Retention

We retain Your personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, as set out in this Policy. The criteria We use to determine the appropriate retention period include: the duration of Your active account and ongoing use of the Platform; any applicable statutory, regulatory, or contractual obligations that require retention for a specified period; the necessity of retaining information for the establishment, exercise, or defence of legal claims; and Our legitimate business interests, including record-keeping and audit requirements. Upon the expiry of the applicable retention period, or upon receipt of a valid deletion request (subject to any overriding legal obligations), We shall securely delete or anonymise Your personal information so that it can no longer be associated with You. Where anonymisation is used as an alternative to deletion, the resulting data shall be retained only for statistical and analytical purposes and shall not be capable of re-identification.

7. Your Rights

Under the Privacy Act 2020 and the Information Privacy Principles contained therein, You have a number of rights in relation to Your personal information, including:

• The right to access and receive a copy of your personal data held by Us (IPP 6)
• The right to rectify or update your personal information where it is inaccurate, incomplete, or misleading (IPP 7)
• The right to request deletion of your personal data, subject to any overriding legal obligations or legitimate interests that require continued retention
• The right to withdraw consent where we rely on consent to process your information, without affecting the lawfulness of any processing carried out prior to such withdrawal
• The right to request information about the recipients or categories of recipients to whom Your personal information has been disclosed
• The right to lodge a complaint with the New Zealand Privacy Commissioner if You believe Your privacy rights have been infringed

To exercise any of these rights, please submit a written request to Us at admin@waldo.co.nz. We may require You to verify Your identity before processing Your request, which may involve providing government-issued identification or confirming details associated with Your account. We shall respond to all valid requests within twenty (20) working days of receipt, as required under the Privacy Act 2020. If We are unable to comply with Your request, We shall provide You with written reasons for the refusal. You may also contact the Office of the Privacy Commissioner directly at: PO Box 10094, The Terrace, Wellington 6143, New Zealand; phone 0800 803 909; or visit privacy.org.nz.

8. Changes to This Policy

We reserve the right to amend, modify, or replace this Policy at any time at Our sole discretion. Where We make changes that We determine, in Our reasonable judgement, to be material — including but not limited to changes in the categories of personal information collected, the purposes for which information is processed, or the third parties with whom information is shared — We shall notify You by email to the address associated with Your account at least thirty (30) days prior to such changes taking effect. For non-material amendments, We may provide notice by posting an in-Platform banner or updating the "Last updated" date at the top of this Policy. Your continued use of the Platform following the effective date of any revised Policy shall constitute Your acceptance of and agreement to be bound by the amended terms. We encourage You to review this Policy periodically to remain informed of how We protect Your personal information.

9. Contact Us

If You have any questions, concerns, or complaints regarding this Policy or Our handling of Your personal information, You may contact Our Privacy Officer using the details below. We shall acknowledge receipt of Your enquiry and endeavour to provide a substantive response within twenty (20) working days, in accordance with the timeframes prescribed by the Privacy Act 2020.

Email: admin@waldo.co.nz

Postal Address: WALDO CRM Limited, [Registered Office Address], New Zealand

If You are not satisfied with Our response, You have the right to lodge a complaint with the Office of the Privacy Commissioner at: PO Box 10094, The Terrace, Wellington 6143, New Zealand; phone 0800 803 909; or online at privacy.org.nz.