Legal

New Zealand Privacy Policy

Purpose

We are committed to protecting privacy and confidentiality in accordance with the Privacy Act 2020 (“Privacy Act”).

Under the Privacy Act 2020, there are 13 information privacy principles (IPPs) our business must comply with, together with IPP 3A, which has applied since 1 May 2026. When collecting, using and disclosing, and protecting personal information of any description, we must do so in accordance with the IPPs. The IPPs can be summarised as follows:

Only collect information the business needs.
Wherever possible, get the personal information directly from the individual.
Be transparent about what you are going to do with the personal information.
Tell people when you collect their personal information from someone else (IPP 3A).
Be fair about how you get it.
Keep personal information secure.
Enable personal information to be accessed by the person it relates to.
Enable personal information to be corrected if it is incorrect.
Ensure personal information is correct before you use it.
Dispose of personal information securely once you no longer need it.
Only use personal information for the reason it was collected.
Only share personal information if you have a good reason.
Only send it overseas if it will be adequately protected.
Only use unique identifiers when it is clearly allowed.

It is one of our prime responsibilities, that any personal or sensitive information provided to us is not used for any other purpose than that for which it is intended and expected. This Privacy Policy describes other Visory policies and practices for collecting, handling, using and disclosing personal information. This policy also deals with how to complain about a breach of the privacy laws and how individuals can access the personal information we hold about them and how to have that information corrected as needed.

Scope

This Privacy Policy sets out how our business collects, uses, discloses and protects the personal information we deal with in a way that complies with the Privacy Act 2020. This Privacy Policy applies to Visory (NZ) Limited (company number 8117357) and its related bodies corporate (as that term is defined under the Companies Act 1993).

What is personal information?

Personal information is defined in the Privacy Act as information about an identifiable individual (a natural person as opposed to a company or other legal entity). Common examples of personal information can include; their name, address, photos of their face, their opinions or views, employment information and financial records.

Visory will not collect any personal information except when the individual has knowingly provided that information to us or authorised a third party to provide that information to us.

Visory may ask for identification information. This information may include but is not limited to name, address, contact details, date of birth, and IRD number.

Visory may collect and hold additional personal information about individuals. This could include transaction information or making a record of queries or complaints an individual makes.

We take particular care with sensitive personal information, such as information about religion, racial or ethnic origin, political opinions, membership of a trade union, criminal record, sexual orientation, health and biometric information.

Generally, Visory only collects this sort of information if it is necessary to provide a specific product or service and the individual has consented to that collection.

What if an individual chooses not to provide some information?

Visory may be unable to provide its services if it does not have all the relevant information it requires to deliver such services, or we may be prevented from complying with our legal obligations. You may also be unable to exercise your legal or contractual rights.

For what purposes does Visory collect, hold, use and disclose personal information?

The main reason Visory collect, use, hold and disclose personal information is to facilitate the provision of its service offerings including where we have obligations under outsourced provider or third-party agreements when providing certain services.

This includes:

checking whether an individual is eligible for the product or service;
the facilitation of those services or products, including bookkeeping, payroll, accounts payable and accounts receivable services that involve information about our clients’ employees, contractors, suppliers and customers;
providing information that you request; and
providing you with further information about our other products and services.

Visory may also use information to comply with legislative or regulatory requirements in any jurisdiction, prevent fraud, crime or other activity that may cause harm in relation to its products or services and to help run the business. Visory may also use information to tell individuals about products or services that it feels may interest them.

We will only use personal information for the purpose for which it was collected. If we need to use personal information for a purpose other than for which it was collected, we will provide information about the new purpose and any additional relevant information prior to using personal information in a new way. This will offer the opportunity to revoke consent to the new use or reapprove.

What service offerings does Visory provide?

Visory understands the importance of a holistic service offering, whereby its clients can see their goals, needs and expectations being met. This approach encompasses:

Bookkeeping
Payroll
Accounts payable
Accounts receivable
Visory Insights
Business Performance Partner sessions

How does Visory collect personal information?

Visory collects most of the personal information directly from the individual. This can be done electronically (see section “Does Visory collect personal information electronically?” of this policy for more information).

Visory will not collect any personal information except when the individual has knowingly provided that information to us or authorised a third party to provide that information to us.

Visory also collects personal information about an individual from other areas of its business including sharing information amongst other Visory subsidiaries and related parties or from third party organisations. This may happen without the individual’s direct involvement as authorised through Visory Terms of Business and the Client Services Agreement. For instance, Visory will collect personal information about an individual from:

publicly available sources of information;
the individual’s external representatives (including legal adviser, mortgage broker, executor, administrator, guardian, trustee, or attorney);
our clients, when they give us information about their employees, contractors, suppliers and customers so that we can provide our services, including from the accounting, payroll and banking systems they connect to Visory (such as Xero, MYOB or QuickBooks);
the individual’s employer;
other outsourced provider organisations, who jointly with Visory, provide products or services to the individual;
commercial information service providers, such as companies that provide fraud prevention reports; and
insurers, re-insurers and health care providers

Visory may ask for various kinds of personal information to the extent this information is necessary for us to carry out the activities involved in providing you with products, services and information. The kinds of personal information include, but is not limited to:

identification information, including but not limited to, name, address, contact details (including phone number, email address and other digital addresses and accounts, date of birth, IRD number as well as information to verify your identity such as driver licence, birth certificate or passport details;
financial information, including but not limited to, your assets, liabilities, income, expenses, bank and direct debit details, KiwiSaver, insurance details and other financial details;
employment and payroll information, including but not limited to, NZBN/Company number, occupation, salary and pay rates, hours of work, leave, KiwiSaver details and employment history dates;
transactional information of your dealings with us, including in relation to our products and services, making a record of queries or complaints an individual makes;
insights, responses to surveys such as experiences and information about your activities, interest, and attitudes/views or other feedback expressed;
your device information such as device ID, geo-location, computer and connection information, statistics on page views, traffic to and from our websites, ad data, IP address and standard web log information;
any other personal information that may be required in order to facilitate your dealings with us.

What laws require or authorise Visory to collect personal information?

Visory is required or authorised to collect:

certain identification information about an individual by the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and Anti-Money Laundering and Countering Financing of Terrorism Act Commencement Order 2011;
tax residency information by the Tax Administration Act 1994 and Foreign Account Tax Compliance Act (FATCA)
an individual’s IRD Number, if they choose to provide it, by the Income Tax Act 2007.

How does Visory hold personal information?

Visory strives to maintain the relevance, reliability, accuracy, completeness and currency of the personal information we hold and to protect its privacy and security. Much of the information Visory holds about an individual will be stored electronically in secure data centres owned by either Visory or external service providers. Some of these data centres are located outside New Zealand (see “Does Visory disclose personal information overseas?”). Some historical information Visory holds about an individual will be stored in paper files and these files may be held in secure offsite storage facilities.

Visory use a range of physical and electronic security measures to protect the security of the personal information they hold. For example:

access to information systems is controlled through identity and access management;
employees are bound by internal information security policies and are required to keep information secure;
all employees are required to complete training about information security; and
regular monitoring and review of compliance with internal policies and industry best practice.

Visory take reasonable steps to destroy or permanently de-identify any personal information after it can no longer be used.

We will not use identifiers assigned by the Government, such as an IRD number, for our own file recording purposes.

How long does Visory keep personal information?

We keep personal information only for as long as we need it for the purposes for which we may lawfully use it, or for as long as a law, or a court or tribunal order, requires us to keep it. This is how long we generally keep each kind of information:

Records of our work for a client. The bookkeeping, payroll, accounts payable and accounts receivable records we work on for a client, including information about the client’s employees, contractors, suppliers and customers, and our agreements, correspondence and meeting recordings, transcripts and notes with the client. We keep these while we provide services to the client, and then for seven years after the end of the financial year in which our services end. We keep them for that period so that we can answer questions about our work and deal with any claim about it, which can generally be made up to six years after the events concerned, and because New Zealand tax and employment laws require businesses to keep these kinds of records for six to seven years. When our services end, we also return or hand over the client’s records as our Terms of Business provide.
Our own financial records. Our invoices, payment records and other financial records, for seven years after the end of the income year they relate to, as the Tax Administration Act 1994 requires.
Visory Platform and Visory app accounts. A user’s sign-in details, while their account is open. When we close an account at the user’s request, we delete the sign-in details so that the account can no longer be used. The user’s name and the record of the actions taken in the account, such as documents sent and approvals given, form part of our client’s records and are kept for the period described above. If someone signed up on the Visory Platform and we have not provided services to their business, we delete or de-identify the business account they created and the information in it when they ask us to, except anything a law requires us to keep.
Support requests. Requests for help and our replies, while the business relationship is active and for a reasonable time afterwards, unless they form part of the records of our work for a client.
Enquiries and marketing. Enquiries, discovery calls and marketing records, while the business relationship is active and for a reasonable time afterwards. If you ask us not to send you marketing, we keep a record of that request with your contact details, so that we can respect it.
Website analytics and advertising. Analytics information linked to your browser or device, for no more than 14 months. Page visits that HubSpot links to a contact record are kept with that record, as described under “Enquiries and marketing”. The advertising platforms described under “Cookies and similar technologies” keep the information they collect under their own policies.

We may keep information for longer than these periods where a law, or a court or tribunal order, requires it, or where we need it for a complaint, dispute or legal claim that has been made or is reasonably expected. Our database backups are replaced within days. Some of our systems keep earlier saved versions of files after they are no longer in use; we keep these secure and do not use them for any other purpose.

Who does Visory disclose personal information to, and why?

Visory may provide personal information about individuals to external organisations. To protect personal information, Visory enter into contracts with their service providers that require them to comply with the Privacy Act. These contracts oblige them to only use the personal information Visory disclose to them for the specific role they ask them to perform.

Generally, Visory disclose personal information to organisations that help them with their business. These may include:

Visory agents, contractors and external service providers (for example, mailing houses and, technology service providers);
insurers, re-insurers and health care providers;
payment systems operators (for example, merchants receiving card payments);
other organisations, who jointly with Visory, provide products or services to the individual;
financial services organisations, including banks, superannuation funds, stockbrokers, custodians, fund managers and portfolio service providers;
debt collectors;
Visory legal advisers or auditors;
An individual’s representatives (including their legal adviser, accountant, mortgage broker, executor, administrator, guardian, trustee, or attorney);
fraud bureaus or other organisations to identify, investigate or prevent fraud or other misconduct;
IT Service Providers;
external dispute resolution schemes; and
our clients, where we handle information about their employees, contractors, suppliers or customers on their behalf;
Regulatory bodies, government agencies (including Inland Revenue) and law enforcement bodies in any jurisdiction; and
Other companies in the event of a corporate sale, merger, reorganisation, dissolution or similar event.

We may also disclose an individual’s personal information to others where:

Visory are required or authorised by law or where they have a public duty to do so;
The individual may have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances; or
Visory are otherwise permitted to disclose the information under the Privacy Act.

Does Visory disclose personal information overseas?

Visory may disclose an individual’s personal information to a recipient which is located outside New Zealand. This includes:

Any financial institution which the individual holds an account with overseas where they have given Visory permission to make enquiries on their behalf.
Other members of the Visory Group that are located outside New Zealand, in some circumstances, including Visory Pty Ltd in Australia.
Our data hosting and other IT service providers.
Other third-party service providers.

Some encrypted data may be backed up or mirrored in overseas jurisdictions by third parties. We will not send personal information to recipients outside of New Zealand unless:

we have taken reasonable steps to ensure that the recipient does not breach the Privacy Act, and the Information Privacy Principles;
the recipient is subject to privacy laws that, overall, provide comparable safeguards to the Privacy Act; or
the individual has authorised the disclosure after we have told them it may not be protected in the same way.

Does Visory use or disclose personal information for marketing?

Visory will use personal information to offer individuals products and services they believe may interest them but will not do so if the individual tells them not to. Visory may offer individuals products and services by various means, including mail, telephone, email, SMS or other electronic means, such as through social media or targeted advertising through Visory’s website.

Visory may also disclose an individual’s personal information to external companies who assist Visory to market their products and services to the individual, such as a mailing house.

If individuals do not wish to receive marketing offers from Visory, they can tell us at any time using the contact details below. Every marketing email we send identifies Visory and includes a working unsubscribe link, and we act on unsubscribe requests within five working days.

Does Visory collect Personal Information electronically?

Visory will collect information from individuals electronically, for instance through internet browsing, mobile or tablet applications.

Each time an individual visits one of Visory’s websites, Visory collects information about the individual’s use of the website, which may include the following:

The date and time of visits;
Which pages are viewed;
How users navigate through the site and interact with pages (including fields completed in forms and applications completed);
Location information about users;
Information about the device used to visit our website; and
IP addresses.

Visory uses cookies and similar technologies on its websites, as described under “Cookies and similar technologies” below.

Visory won’t ask individuals to supply personal information publicly over LinkedIn, Facebook, X, or any other social media platform that we use. Sometimes Visory may invite individuals to send their details to them via private messaging, for example, to answer a question. Individuals may also be invited to share their personal information through secure channels to participate in other activities, such as competitions.

Does Visory collect personal information through the Visory app?

The Visory app lets people with a Visory Platform account, such as the people our clients authorise and our own team, use the Visory Platform on a phone or tablet. You cannot create an account in the app: accounts are created on the Visory Platform, either by our team or when a business signs up online. When you use the app, we collect and use the following information.

Account and sign-in details. Your name, email address and phone number, your user ID, the codes and settings you use to sign in securely, and any changes you make to your profile or notification preferences.
Documents you choose to send. If you scan a document with your camera, or choose photos or files from your device, we collect only the images and files you choose to send to Visory. They go to your business’s Visory mailbox and are processed like the emails and attachments described below. This includes being read by AI services from third-party providers.
Emails and attachments in your account mailbox. When you or others send emails or documents to your business’s Visory mailbox address, we collect and store their content, including sender and recipient details, attachments and any personal or financial information they contain. Our software, including AI services from third-party providers, reads them to identify and extract the details of invoices, receipts and other documents, and those details can be published to your business’s accounting software, such as Xero. We use this information to provide our services to your business.
Video meetings. If your Visory team offers meetings in the app, the app uses your camera and microphone for the meeting. Meetings run on a third-party video service, which receives your user ID and display name, and the meeting’s audio, video, shared screens and chat. Meetings with your Visory team are recorded, and AI services from third-party providers transcribe the recording and help prepare notes of the meeting. You can choose not to join, or leave at any time. The recording, transcript and notes are kept with your business’s records.
Feature settings. We use a feature-management provider to switch app features on or off. It receives your user ID, name, role and the app version, and records which features were shown.

The app asks for permission before it uses your camera or microphone. When you import photos or files, you choose them in your device’s picker, and the app receives only the ones you choose. You can turn camera and microphone access off at any time in your device settings, but you may then be unable to scan documents or join meetings. The app does not show advertising, does not track you across other companies’ apps or websites, and does not collect your location or contacts. Where we ask for your permission in the app, you can withdraw it at any time: device permissions in your device settings, and any other permission by contacting us using the details under “Key Contact”. Withdrawing a permission may stop some features working, but it doesn’t affect anything we did before you withdrew it.

Our service providers that receive personal information through the Visory app, including the providers described above and our hosting providers, give it the same or equal protection as this policy describes. Their agreements with us require them to keep it secure, to follow our instructions, and to use it only to provide their services to us, which can include keeping it for a limited period as described under “Does Visory use AI?”. Our related entities that receive it handle it under this policy.

Our sign-in service is hosted in Australia. Documents you scan or import are saved on your device until you delete them in the app, including after you sign out, and attachments you open are stored on your device only temporarily. Signing out removes your sign-in details from the app. If you stop using a device, or someone else will use it, delete any saved documents in the app first.

Cookies and similar technologies

Our websites use cookies and similar technologies, such as tags, pixels and browser storage. A cookie is a small file that a website stores on your device. We group them as follows.

Strictly necessary. These keep the site working and remember your choices, such as the region you selected. They are always on.
Analytics. These help us understand how visitors use the site so we can improve it. We use Google Analytics, loaded through Google Tag Manager.
Marketing. These help us measure our advertising and follow up with people who contact us. We use Google Ads and HubSpot’s tracking code.

Google and HubSpot collect information such as your IP address, device and browser details, the pages you visit and how you arrived at the site. They may process this information outside Australia and New Zealand. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can block or delete cookies in your browser settings at any time, and doing so does not stop you using the site.

Where information collected through cookies is personal information, we handle it in accordance with this Privacy Policy.

Does Visory use AI?

Visory uses software, including its own AI, Delphi, to help our team deliver bookkeeping, payroll, accounts payable and accounts receivable services, for example by reading and coding invoices and transactions and preparing draft pay runs. Delphi uses the personal information in our clients’ financial and payroll records to do this. Our team reviews Delphi’s work and signs it off, and nothing is paid or sent without a person checking it.

Delphi and our other software use AI services from third-party providers, for example to read documents and emails, and to transcribe meetings with our team and help prepare notes of them. We also use service providers to check the quality of the AI’s work and to search our records, and they may keep copies of some information to do this. Some of these providers are located outside New Zealand (see “Does Visory disclose personal information overseas?”). They must protect the information under their agreements with us, and may keep it for a limited period, for example to detect misuse of their services.

Access to and correction of personal information

Under the Privacy Act, individuals have a right to seek access to information which we hold about them; although, there are some exceptions to this. They also have the right to ask us to correct information about them which is inaccurate, incomplete or out of date. To do so, they can contact Visory using the details under “Key Contact”. We will respond within 20 working days.

We do not charge for receiving a request for access to personal information or for complying with a correction request. We do however reserve the right to charge you for all reasonable costs and outgoings specifically incurred in meeting your request for information. In processing an individual’s request for access to their personal information, a reasonable cost may be charged if they have requested access more than once within twelve months. This charge covers such things as locating the information and supplying it to them.

There are some circumstances in which Visory are not required to give individuals access to their personal information. If Visory refuse to give an individual access to or to correct their personal information, Visory will give them a notice explaining the reasons why, except where it would be unreasonable to do so. If we refuse an individual request to correct their personal information, the individual also has the right to request that a statement be associated with their personal information noting that they disagree with its accuracy.

If Visory refuses an individual’s request to access or correct their personal information, we will also provide them with information on how they can complain about the refusal.

Asking us to delete personal information

You can ask us to delete personal information we hold about you by contacting us using the details under “Key Contact”. This includes Visory app users. There is no charge for making a request.

If you think information we hold about you is inaccurate, out of date, incomplete or misleading, you can instead ask us to correct it under the Privacy Act, and a correction can include deleting the information. We handle those requests as described under “Access to and correction of personal information”, including the time limits, and if we decide not to correct the information you can ask us to attach a statement of the correction you asked for.

We will delete the information that we are able to delete and do not need to keep. We may keep some or all of it where:

a law, or a court or tribunal order, requires us to keep it, for example the tax and employment records described under “How long does Visory keep personal information?”;
we need it to provide services that one of our clients has engaged us for;
we need it to deal with a complaint or dispute, or to establish, exercise or defend a legal claim;
we need it to prevent fraud or misuse, or to keep our systems secure;
our systems cannot remove it, for example an earlier saved version of a file; or
you have asked us not to contact you, in which case we keep only what we need to respect that request.

If we keep any information, we will tell you what we are keeping and why. We will keep it secure and use it only for the reason we kept it.

Information we handle for our clients. If we hold your information only on behalf of a business you work for, supply or buy from, for example to run that business’s payroll, the Privacy Act treats that business as holding it, and the business decides which of its records it needs to keep. We will pass your request to that business, help it respond, and tell you we have done so. If we also use the information for our own purposes, we will respond to your request ourselves as well.

Visory Platform and Visory app accounts. If you have a user account for the Visory Platform or the Visory app, you can ask us to close it. We will delete your sign-in details so that the account can no longer be used and, if your account was set up for a business you work for, we will let that business know. Closing your account does not delete your name or the records you created or approved in it, such as documents you sent or approvals you gave, because they form part of that business’s records. If you signed up on the Visory Platform and we have not provided services to your business, we will also close the business account you created, and delete or de-identify the information in it, except anything a law requires us to keep. Closing your account does not remove documents saved on your device: delete them in the app, or delete the app.

To protect your information, we will check that a request comes from you, or from someone you have authorised to act for you, before we act on it, and we may ask for more information to do so. We will respond to a deletion request as soon as reasonably practicable, and no later than 20 working days after we receive it, telling you what we will delete and anything we need to keep, and why. If we need more time, we will tell you within those 20 working days why, and when you can expect a response. If we do not delete some or all of the information, we will tell you why and that you can complain to the Privacy Commissioner. We aim to complete the deletion within 30 days after we respond to you, and we will confirm to you in writing when it is complete. Copies in our database backups are replaced within days. If our systems keep another copy, for example an earlier saved version of a file, we will keep it secure and not use it.

Reporting privacy breaches

We work hard to keep all personal information safe. However, despite applying strict security measures and following industry standards to protect personal information, there is still a possibility that our security could be breached. If you are aware of a privacy breach, where there is a loss or unauthorised access or disclosure of personal information, whether or not you think it is likely to cause serious harm, please tell us as soon as you become aware of it at hello@visory.com.au. This will allow us to:

Seek to quickly identify and secure the breach to prevent any further breaches and reduce the harm caused by the breach;
Assess the nature and severity of the breach, including the type of personal information involved and the risk of harm to affected individuals;
Advise and involve the appropriate authorities where criminal activity is suspected;
Where appropriate, notify any individuals who are affected by the breach (where possible, directly);
Where appropriate, put a notice on our website advising our clients of the breach; and
Notify the Privacy Commissioner.

All employees receive training to enable them to identify a privacy breach, how to reduce the risk of a privacy breach occurring and how to respond to a privacy breach if one does occur.

We keep a register of all privacy breaches, whether or not they pose a risk of serious harm. When a breach is notifiable, we report it to the Privacy Commissioner as soon as practicable after we become aware of it.

We also may be required to notify any affected individuals or the public depending on the circumstances. Failure to notify affected persons may be a further interference with their privacy under the Act and may result in a complaint.

Resolving privacy concerns and complaints

If an individual is concerned about how their personal information is being handled or if they have a complaint about a breach by Visory, they can contact Visory using the details under “Key Contact”.

Visory will acknowledge the complaint as soon as practical after receipt of the individual’s complaint. Visory will let the individual know if they need any further information from the individual to resolve their complaint.

We aim to resolve complaints as quickly as possible. We strive to resolve complaints within five business days however, some complaints can take longer to resolve. If a complaint is taking longer, we will let the individual know what is happening and a date by which they can reasonably expect a response.

If the individual is unhappy with our response, there are other bodies they can go to.
Under the Privacy Act, an individual may complain to the New Zealand Privacy Commissioner about the way Visory handled their personal information.

The Commissioner can be contacted at:
Office of the Privacy Commissioner
PO Box 10 094
Wellington 6140
Phone: 0800 803 909
Online: privacy.org.nz

Key Contact

The individual can contact Visory by:
• emailing hello@visory.com.au

Visory can be contacted in relation to privacy concerns by writing to: Disputes Manager, Visory (NZ) Limited, Level 42, 600 Bourke Street, Melbourne VIC 3000, Australia.

Changes to the Privacy Policy

We may change the way we handle personal information from time to time for any reason. If so, we will update this Privacy Policy.

Updated 12 November 2026. Previous version 6 October 2026.