Privacy policy

1. Who this policy covers

This policy applies to people who visit our website, contact us, work with us, receive a proposal or invoice, supply services to us, or whose information is included in a client engagement.

Mad Orbit Limited (New Zealand company number 9454754, NZBN 9429053916785) is the agency collecting and holding the information described here. Our registered office and physical address is 482 Pinnacle Hill Road, RD 1, Bombay 2675, New Zealand. Contact our privacy officer at Andrew Kirk is the contact for technical and general enquiries. Email [email protected] or phone 021 240 7942.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• your name, role, organisation, email address, phone number and other contact details;
• enquiries, meeting notes, correspondence, feedback and support records;
• project requirements, approvals, account details and information you provide so we can deliver services;
• commercial records such as proposals, contracts, invoices and payment status;
• technical information connected with services we operate or support, such as account identifiers, access records, device details and incident logs; and
• basic website request information processed by our hosting and security providers, such as IP address, browser type, requested page, time and security signals.

Please do not send sensitive personal information or live credentials unless we have agreed a secure way to receive them and they are necessary for the work.

3. How we collect information

We usually collect personal information directly from you when you email, call, meet with us, approve work, pay an invoice or use a service we provide. Providing information is generally voluntary, but we may be unable to respond or provide the requested service without information that is necessary for it.

We may also receive information from your organisation, an authorised colleague, a referral, a service provider involved in an engagement, or a public business source. When we collect personal information indirectly, we will take reasonable steps to notify the person where required by the Privacy Act, unless an exception applies.

4. How we use information

We use personal information when reasonably necessary to:

• respond to an enquiry and communicate with you;
• scope, quote, contract for, deliver, host, support and improve services;
• manage access, security, backups, incidents and service continuity;
• administer our business, suppliers, invoices, payments and required records;
• protect our rights, investigate misuse and meet legal obligations; and
• use information for another purpose you authorise or that the law permits.

We do not sell personal information. We do not use website visitors’ information for behavioural advertising or automated decisions that have legal or similarly significant effects.

5. Who we share information with

We may share relevant information with:

• people in your organisation who are authorised for the engagement;
• carefully selected contractors and providers that help us deliver hosting, security, communications, billing, development or other agreed services;
• professional advisers, insurers, auditors or prospective business successors under appropriate confidentiality obligations; and
• regulators, courts, law enforcement or other people when required or permitted by law, or when reasonably necessary to protect people, systems or legal rights.

Some providers may process information outside New Zealand. Where the Privacy Act treats this as an overseas disclosure, we will take reasonable steps to use a recipient that is subject to comparable safeguards, contract for appropriate protection, or obtain authorisation where required.

We will not submit client personal information to an artificial intelligence service unless it is necessary for agreed work and appropriate privacy, security and overseas processing arrangements are in place.

A project involving material personal information may have a separate data-processing agreement that records the parties’ roles and adds project-specific safeguards.

6. This website and cookies

This website does not currently set analytics or advertising cookies and does not contain a contact form. If you select “Contact us”, your email application opens and any message you send is handled by your email provider and ours.

Our network, hosting and security providers may process technical request data to deliver and protect the site, detect abuse and maintain reliability. Their essential security features may change as threats and infrastructure change. If we add optional analytics or other tracking, we will update this policy and provide any choice or notice required by law.

7. Security and retention

We use reasonable technical and organisational safeguards appropriate to the information and service. These may include access controls, least-privilege accounts, protected credentials, encryption in transit, backups, logging, updates and incident response practices. No system can be guaranteed completely secure.

We keep personal information only while it is reasonably needed for the purpose it was collected, to provide and support services, resolve disputes, maintain legitimate business records or meet legal obligations. We then delete, anonymise or securely isolate it, subject to backup cycles and required record retention.

If a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless an exception applies.

8. Access and correction

You may ask whether we hold personal information about you and request access to it. You may also ask us to correct information you believe is wrong. We will respond in line with the Privacy Act and may need to verify your identity first.

If we do not make a requested correction, you may ask us to attach a statement of the correction sought. Some lawful grounds allow or require us to withhold information; if one applies, we will explain it where permitted.

9. Contact and complaints

Send access, correction, privacy or complaint requests to our privacy officer at [email protected]. Please explain what happened and how we can contact you. We will acknowledge and investigate the matter.

You can also write to Mad Orbit Limited at 482 Pinnacle Hill Road, RD 1, Bombay 2675, New Zealand.

If we cannot resolve your concern, you may contact the Office of the Privacy Commissioner.