Last updated: July 2025

Scripted Ventures Limited ("we", "us", or "our") is committed to protecting your privacy in accordance with the Privacy Act 2020 and its 13 Information Privacy Principles (IPPs). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

We particularly focus on:

• IPP5 (Storage and Security): Ensuring your information is protected against loss, misuse, and unauthorised access
• IPP6 (Access): Providing you with access to your personal information
• IPP7 (Correction): Allowing you to correct your personal information
• IPP12 (Disclosure Outside New Zealand): Protecting your information when disclosed overseas

1. Information We Collect

We collect information that you provide directly to us, including:

• Contact information (name, email address, phone number, company name)
• Project requirements and specifications
• Communications and correspondence
• Payment and billing information
• Technical information about your systems (when providing services)
• Professional background and experience (for partnership opportunities)

We automatically collect certain information when you visit our website:

• IP address and browser type
• Pages visited and time spent on site
• Referring website addresses
• Device and operating system information
• Location data (country/region)

2. How We Use Your Information

We use collected information for the following purposes:

• Providing and improving our services
• Communicating about projects and deliverables
• Processing payments and maintaining records
• Sending relevant updates and newsletters (with consent)
• Analyzing website usage to improve user experience
• Evaluating partnership and investment opportunities
• Complying with legal obligations
• Protecting against fraudulent or illegal activity

3. Legal Basis for Processing

We process personal data based on:

• Contract: Processing necessary to perform our services
• Legitimate Interests: For business operations and service improvement. We have conducted a balancing test and believe our processing is proportionate and does not override your fundamental rights and freedoms
• Consent: For marketing communications and certain cookies (see our Cookie Policy below)
• Legal Obligations: To comply with applicable laws including the Privacy Act 2020

4. Data Sharing and Disclosure

We do not sell or rent your personal information. We may share information with:

• Service providers who assist in our operations, who are required to:
  • Act only on our documented instructions
  • Keep information confidential
  • Enable audits upon request
• Professional advisers (lawyers, accountants) when necessary
• Authorities when required by law or to protect rights
• Business partners with your explicit consent
• Affiliated companies within our corporate structure

5. Data Security

We implement appropriate technical and organisational measures to protect your information in accordance with IPP5, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication protocols
• Employee training on data protection
• Secure cloud infrastructure (AWS)
• Regular backups and disaster recovery procedures

6. Privacy Breach Notification

In the event of a privacy breach that is likely to cause serious harm, we will:

• Notify affected individuals as soon as practicable and, where possible, within 72 hours of becoming aware of the breach
• Notify the Privacy Commissioner as required under the Privacy Act 2020
• Take immediate steps to contain and remediate the breach
• Provide you with information about the breach and steps you can take to protect yourself

7. Data Retention

We will not keep personal information for longer than necessary for the purpose for which it was collected. Our retention periods are:

• Project-related data: 7 years after project completion (to comply with Inland Revenue requirements and contractual limitation periods)
• Marketing contacts: 26 months from last interaction (in line with analytics platform limits)
• Financial records: 7 years (as required by tax legislation)
• Employment records: 7 years after employment ends
• Website analytics: 26 months

We may retain information longer if required by law or to resolve disputes.

8. Your Rights

Under the Privacy Act 2020 (particularly IPP6 and IPP7), you have the right to:

• Access (IPP6): Request copies of your personal data
• Correction (IPP7): Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal obligations)
• Restriction: Limit processing of your data
• Portability: Receive your data in a structured format
• Object: Oppose processing based on legitimate interests
• Withdraw Consent: For consent-based processing

9. How to Exercise Your Rights

To exercise any of your rights:

• Email us at privacy@scriptedventures.nz with your request
• Include your name and contact details for verification
• Specify which right you wish to exercise
• We will respond within 20 working days as required by section 44 of the Privacy Act 2020
• There is no fee for exercising your rights unless your request is manifestly unfounded or excessive

10. Cookies and Tracking

Our website uses cookies to enhance user experience. We use a cookie consent banner that allows you to manage your preferences.

You can manage your cookie preferences at any time through our cookie settings or your browser settings. Note that disabling certain cookies may impact website functionality.

11. International Data Transfers (IPP12)

In accordance with IPP12, personal information will only be sent outside New Zealand where:

• The recipient is subject to privacy laws that provide comparable safeguards to the Privacy Act 2020
• You have expressly authorised the transfer
• We have entered into a contract with the recipient requiring them to protect your information to New Zealand standards
• The recipient participates in a recognised certification scheme (such as EU-US Data Privacy Framework)

We use standard contractual clauses and conduct due diligence to ensure adequate protection.

12. Children's Privacy

Our services are not directed to individuals under 13 years of age. We do not knowingly collect personal information from children under 13.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be notified via email or website notice. The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of our services after changes constitutes acceptance of the updated policy.

Change Log:

• July 2025: Enhanced compliance with Privacy Act 2020, added breach notification procedures, clarified data retention periods, and improved IPP compliance

15. Contact Information

For privacy-related questions or to exercise your rights, contact our Privacy Officer:

Privacy Officer
Scripted Ventures Limited
Waikato, New Zealand
Email: privacy@scriptedventures.nz
Website: www.scriptedventures.nz

You also have the right to lodge a complaint with the New Zealand Privacy Commissioner if you believe we have not adequately addressed your concerns:

Office of the Privacy Commissioner
PO Box 10094
Wellington 6143
Website: www.privacy.org.nz