Legal

New Zealand Privacy Policy

Purpose

We are committed to protecting privacy and confidentiality in accordance with the Privacy Act 2020 (“Privacy Act”).

Under the Privacy Act 2020, there are 13 information privacy principles (IPPs) our business must comply with, together with IPP 3A, which has applied since 1 May 2026. When collecting, using and disclosing, and protecting personal information of any description, we must do so in accordance with the IPPs. The IPPs can be summarised as follows:

Only collect information the business needs.
Wherever possible, get the personal information directly from the individual.
Be transparent about what you are going to do with the personal information.
Tell people when you collect their personal information from someone else (IPP 3A).
Be fair about how you get it.
Keep personal information secure.
Enable personal information to be accessed by the person it relates to.
Enable personal information to be corrected if it is incorrect.
Ensure personal information is correct before you use it.
Dispose of personal information securely once you no longer need it.
Only use personal information for the reason it was collected.
Only share personal information if you have a good reason.
Only send it overseas if it will be adequately protected.
Only use unique identifiers when it is clearly allowed.

It is one of our prime responsibilities, that any personal or sensitive information provided to us is not used for any other purpose than that for which it is intended and expected. This Privacy Policy describes other Visory policies and practices for collecting, handling, using and disclosing personal information. This policy also deals with how to complain about a breach of the privacy laws and how individuals can access the personal information we hold about them and how to have that information corrected as needed.

Scope

This Privacy Policy sets out how our business collects, uses, discloses and protects the personal information we deal with in a way that complies with the Privacy Act 2020. This Privacy Policy applies to Visory (NZ) Limited (company number 8117357) and its related bodies corporate (as that term is defined under the Companies Act 1993).

What is personal information?

Personal information is defined in the Privacy Act as information about an identifiable individual (a natural person as opposed to a company or other legal entity). Common examples of personal information can include; their name, address, photos of their face, their opinions or views, employment information and financial records.

Visory will not collect any personal information except when the individual has knowingly provided that information to us or authorised a third party to provide that information to us.

Visory may ask for identification information. This information may include but is not limited to name, address, contact details, date of birth, and IRD number.

Visory may collect and hold additional personal information about individuals. This could include transaction information or making a record of queries or complaints an individual makes.

We take particular care with sensitive personal information, such as information about religion, racial or ethnic origin, political opinions, membership of a trade union, criminal record, sexual orientation, health and biometric information.

Generally, Visory only collects this sort of information if it is necessary to provide a specific product or service and the individual has consented to that collection.

What if an individual chooses not to provide some information?

Visory may be unable to provide its services if it does not have all the relevant information it requires to deliver such services, or we may be prevented from complying with our legal obligations. You may also be unable to exercise your legal or contractual rights.

For what purposes does Visory collect, hold, use and disclose personal information?

The main reason Visory collect, use, hold and disclose personal information is to facilitate the provision of its service offerings including where we have obligations under outsourced provider or third-party agreements when providing certain services.

This includes:

checking whether an individual is eligible for the product or service;
the facilitation of those services or products, including bookkeeping, payroll, accounts payable and accounts receivable services that involve information about our clients’ employees, contractors, suppliers and customers;
providing information that you request; and
providing you with further information about our other products and services.

Visory may also use information to comply with legislative or regulatory requirements in any jurisdiction, prevent fraud, crime or other activity that may cause harm in relation to its products or services and to help run the business. Visory may also use information to tell individuals about products or services that it feels may interest them.

We will only use personal information for the purpose for which it was collected. If we need to use personal information for a purpose other than for which it was collected, we will provide information about the new purpose and any additional relevant information prior to using personal information in a new way. This will offer the opportunity to revoke consent to the new use or reapprove.

What service offerings does Visory provide?

Visory understands the importance of a holistic service offering, whereby its clients can see their goals, needs and expectations being met. This approach encompasses:

Bookkeeping
Payroll
Accounts payable
Accounts receivable
Visory Insights
Business Performance Partner sessions

How does Visory collect personal information?

Visory collects most of the personal information directly from the individual. This can be done electronically (see section “Does Visory collect personal information electronically?” of this policy for more information).

Visory will not collect any personal information except when the individual has knowingly provided that information to us or authorised a third party to provide that information to us.

Visory also collects personal information about an individual from other areas of its business including sharing information amongst other Visory subsidiaries and related parties or from third party organisations. This may happen without the individual’s direct involvement as authorised through Visory Terms of Business and the Client Services Agreement. For instance, Visory will collect personal information about an individual from:

publicly available sources of information;
the individual’s external representatives (including legal adviser, mortgage broker, executor, administrator, guardian, trustee, or attorney);
our clients, when they give us information about their employees, contractors, suppliers and customers so that we can provide our services, including from the accounting, payroll and banking systems they connect to Visory (such as Xero, MYOB or QuickBooks);
the individual’s employer;
other outsourced provider organisations, who jointly with Visory, provide products or services to the individual;
commercial information service providers, such as companies that provide fraud prevention reports; and
insurers, re-insurers and health care providers

Visory may ask for various kinds of personal information to the extent this information is necessary for us to carry out the activities involved in providing you with products, services and information. The kinds of personal information include, but is not limited to:

identification information, including but not limited to, name, address, contact details (including phone number, email address and other digital addresses and accounts, date of birth, IRD number as well as information to verify your identity such as driver licence, birth certificate or passport details;
financial information, including but not limited to, your assets, liabilities, income, expenses, bank and direct debit details, KiwiSaver, insurance details and other financial details;
employment and payroll information, including but not limited to, NZBN/Company number, occupation, salary and pay rates, hours of work, leave, KiwiSaver details and employment history dates;
transactional information of your dealings with us, including in relation to our products and services, making a record of queries or complaints an individual makes;
insights, responses to surveys such as experiences and information about your activities, interest, and attitudes/views or other feedback expressed;
your device information such as device ID, geo-location, computer and connection information, statistics on page views, traffic to and from our websites, ad data, IP address and standard web log information;
any other personal information that may be required in order to facilitate your dealings with us.

What laws require or authorise Visory to collect personal information?

Visory is required or authorised to collect:

certain identification information about an individual by the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and Anti-Money Laundering and Countering Financing of Terrorism Act Commencement Order 2011;
tax residency information by the Tax Administration Act 1994 and Foreign Account Tax Compliance Act (FATCA)
an individual’s IRD Number, if they choose to provide it, by the Income Tax Act 2007.

How does Visory hold personal information?

Visory strives to maintain the relevance, reliability, accuracy, completeness and currency of the personal information we hold and to protect its privacy and security. Much of the information Visory holds about an individual will be stored electronically in secure data centres owned by either Visory or external service providers. Some of these data centres are located outside New Zealand (see “Does Visory disclose personal information overseas?”). Some historical information Visory holds about an individual will be stored in paper files and these files may be held in secure offsite storage facilities.

Visory use a range of physical and electronic security measures to protect the security of the personal information they hold. For example:

access to information systems is controlled through identity and access management;
employees are bound by internal information security policies and are required to keep information secure;
all employees are required to complete training about information security; and
regular monitoring and review of compliance with internal policies and industry best practice.

Visory take reasonable steps to destroy or permanently de-identify any personal information after it can no longer be used.

We will not use identifiers assigned by the Government, such as an IRD number, for our own file recording purposes.

Who does Visory disclose personal information to, and why?

Visory may provide personal information about individuals to external organisations. To protect personal information, Visory enter into contracts with their service providers that require them to comply with the Privacy Act. These contracts oblige them to only use the personal information Visory disclose to them for the specific role they ask them to perform.

Generally, Visory disclose personal information to organisations that help them with their business. These may include:

Visory agents, contractors and external service providers (for example, mailing houses and, technology service providers);
insurers, re-insurers and health care providers;
payment systems operators (for example, merchants receiving card payments);
other organisations, who jointly with Visory, provide products or services to the individual;
financial services organisations, including banks, superannuation funds, stockbrokers, custodians, fund managers and portfolio service providers;
debt collectors;
Visory legal advisers or auditors;
An individual’s representatives (including their legal adviser, accountant, mortgage broker, executor, administrator, guardian, trustee, or attorney);
fraud bureaus or other organisations to identify, investigate or prevent fraud or other misconduct;
IT Service Providers;
external dispute resolution schemes; and
our clients, where we handle information about their employees, contractors, suppliers or customers on their behalf;
Regulatory bodies, government agencies (including Inland Revenue) and law enforcement bodies in any jurisdiction; and
Other companies in the event of a corporate sale, merger, reorganisation, dissolution or similar event.

We may also disclose an individual’s personal information to others where:

Visory are required or authorised by law or where they have a public duty to do so;
The individual may have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances; or
Visory are otherwise permitted to disclose the information under the Privacy Act.

Does Visory disclose personal information overseas?

Visory may disclose an individual’s personal information to a recipient which is located outside New Zealand. This includes:

Any financial institution which the individual holds an account with overseas where they have given Visory permission to make enquiries on their behalf.
Other members of the Visory Group that are located outside New Zealand, in some circumstances, including Visory Pty Ltd in Australia.
Our data hosting and other IT service providers.
Other third-party service providers.

Some encrypted data may be backed up or mirrored in overseas jurisdictions by third parties. We will not send personal information to recipients outside of New Zealand unless:

we have taken reasonable steps to ensure that the recipient does not breach the Privacy Act, and the Information Privacy Principles;
the recipient is subject to privacy laws that, overall, provide comparable safeguards to the Privacy Act; or
the individual has authorised the disclosure after we have told them it may not be protected in the same way.

Does Visory use or disclose personal information for marketing?

Visory will use personal information to offer individuals products and services they believe may interest them but will not do so if the individual tells them not to. Visory may offer individuals products and services by various means, including mail, telephone, email, SMS or other electronic means, such as through social media or targeted advertising through Visory’s website.

Visory may also disclose an individual’s personal information to external companies who assist Visory to market their products and services to the individual, such as a mailing house.

If individuals do not wish to receive marketing offers from Visory, they can tell us at any time using the contact details below. Every marketing email we send identifies Visory and includes a working unsubscribe link, and we act on unsubscribe requests within five working days.

Does Visory collect Personal Information electronically?

Visory will collect information from individuals electronically, for instance through internet browsing, mobile or tablet applications.

Each time an individual visits one of Visory’s websites, Visory collects information about the individual’s use of the website, which may include the following:

The date and time of visits;
Which pages are viewed;
How users navigate through the site and interact with pages (including fields completed in forms and applications completed);
Location information about users;
Information about the device used to visit our website; and
IP addresses.

Visory uses cookies and similar technologies on its websites, as described under “Cookies and similar technologies” below.

Visory won’t ask individuals to supply personal information publicly over LinkedIn, Facebook, X, or any other social media platform that we use. Sometimes Visory may invite individuals to send their details to them via private messaging, for example, to answer a question. Individuals may also be invited to share their personal information through secure channels to participate in other activities, such as competitions.

Cookies and similar technologies

Our websites use cookies and similar technologies, such as tags, pixels and browser storage. A cookie is a small file that a website stores on your device. We group them as follows.

Strictly necessary. These keep the site working and remember your choices, such as the region you selected. They are always on.
Analytics. These help us understand how visitors use the site so we can improve it. We use Google Analytics, loaded through Google Tag Manager.
Marketing. These help us measure our advertising and follow up with people who contact us. We use Google Ads and HubSpot’s tracking code.

Google and HubSpot collect information such as your IP address, device and browser details, the pages you visit and how you arrived at the site. They may process this information outside Australia and New Zealand. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can block or delete cookies in your browser settings at any time, and doing so does not stop you using the site.

Where information collected through cookies is personal information, we handle it in accordance with this Privacy Policy.

Does Visory use AI?

Visory uses software, including its own AI, Delphi, to help our team deliver bookkeeping, payroll, accounts payable and accounts receivable services, for example by reading and coding invoices and transactions and preparing draft pay runs. Delphi uses the personal information in our clients’ financial and payroll records to do this. Our team reviews Delphi’s work and signs it off, and nothing is paid or sent without a person checking it.

Access to and correction of personal information

Under the Privacy Act, individuals have a right to seek access to information which we hold about them; although, there are some exceptions to this. They also have the right to ask us to correct information about them which is inaccurate, incomplete or out of date. To do so, they can contact Visory using the details under “Key Contact”. We will respond within 20 working days.

We do not charge for receiving a request for access to personal information or for complying with a correction request. We do however reserve the right to charge you for all reasonable costs and outgoings specifically incurred in meeting your request for information. In processing an individual’s request for access to their personal information, a reasonable cost may be charged if they have requested access more than once within twelve months. This charge covers such things as locating the information and supplying it to them.

There are some circumstances in which Visory are not required to give individuals access to their personal information. If Visory refuse to give an individual access to or to correct their personal information, Visory will give them a notice explaining the reasons why, except where it would be unreasonable to do so. If we refuse an individual request to correct their personal information, the individual also has the right to request that a statement be associated with their personal information noting that they disagree with its accuracy.

If Visory refuses an individual’s request to access or correct their personal information, we will also provide them with information on how they can complain about the refusal.

Reporting privacy breaches

We work hard to keep all personal information safe. However, despite applying strict security measures and following industry standards to protect personal information, there is still a possibility that our security could be breached. If you are aware of a privacy breach, where there is a loss or unauthorised access or disclosure of personal information, whether or not you think it is likely to cause serious harm, please tell us as soon as you become aware of it at hello@visory.com.au. This will allow us to:

Seek to quickly identify and secure the breach to prevent any further breaches and reduce the harm caused by the breach;
Assess the nature and severity of the breach, including the type of personal information involved and the risk of harm to affected individuals;
Advise and involve the appropriate authorities where criminal activity is suspected;
Where appropriate, notify any individuals who are affected by the breach (where possible, directly);
Where appropriate, put a notice on our website advising our clients of the breach; and
Notify the Privacy Commissioner.

All employees receive training to enable them to identify a privacy breach, how to reduce the risk of a privacy breach occurring and how to respond to a privacy breach if one does occur.

We keep a register of all privacy breaches, whether or not they pose a risk of serious harm. When a breach is notifiable, we report it to the Privacy Commissioner as soon as practicable after we become aware of it.

We also may be required to notify any affected individuals or the public depending on the circumstances. Failure to notify affected persons may be a further interference with their privacy under the Act and may result in a complaint.

Resolving privacy concerns and complaints

If an individual is concerned about how their personal information is being handled or if they have a complaint about a breach by Visory, they can contact Visory using the details under “Key Contact”.

Visory will acknowledge the complaint as soon as practical after receipt of the individual’s complaint. Visory will let the individual know if they need any further information from the individual to resolve their complaint.

We aim to resolve complaints as quickly as possible. We strive to resolve complaints within five business days however, some complaints can take longer to resolve. If a complaint is taking longer, we will let the individual know what is happening and a date by which they can reasonably expect a response.

If the individual is unhappy with our response, there are other bodies they can go to.
Under the Privacy Act, an individual may complain to the New Zealand Privacy Commissioner about the way Visory handled their personal information.

The Commissioner can be contacted at:
Office of the Privacy Commissioner
PO Box 10 094
Wellington 6140
Phone: 0800 803 909
Online: privacy.org.nz

Key Contact

The individual can contact Visory by:
• emailing hello@visory.com.au

Visory can be contacted in relation to privacy concerns by writing to: Disputes Manager, Visory (NZ) Limited, Level 42, 600 Bourke Street, Melbourne VIC 3000, Australia.

Changes to the Privacy Policy

We may change the way we handle personal information from time to time for any reason. If so, we will update this Privacy Policy.

Updated 6 October 2026 and approved on legal review 14 October 2026. Previous version 31 August 2022.