Privacy Policy

NZF Sitelink is a digital site information and compliance platform operated by NZ Facilities Ltd, an Auckland-based facilities maintenance company. Our platform helps building owners and facilities managers manage site compliance, contractor sign-ins, and document access.

This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the New Zealand Privacy Act 2020.

We collect the following personal information:

• Account holders: Name, email address, and organisation details provided during signup.
• Site visitors and contractors: Name, email address, company name, phone number, and vehicle registration plate (optional) collected at the point of site sign-in.
• Sign-in records: Date, time, and purpose of each site visit, including sign-out time.
• Usage data: Standard server logs including IP addresses and browser type, used for security and performance monitoring.

We do not collect sensitive personal information such as health data, financial information, or government identifiers.

We use personal information to:

• Provide and operate the NZF Sitelink platform
• Maintain accurate site visitor and contractor sign-in records for compliance purposes
• Send transactional emails such as account confirmation, password resets, and compliance document expiry reminders
• Notify site managers of reported defects or safety issues
• Improve our platform and troubleshoot technical issues

We do not use personal information for marketing purposes without your explicit consent, and we do not sell personal information to third parties.

We share personal information only where necessary to operate the platform:

• Supabase: Our database and authentication provider, hosted in Sydney, Australia. Data is stored securely with encryption at rest and in transit.
• Resend: Our transactional email provider, used to send system-generated emails.
• Vercel: Our hosting provider, based in the United States. Standard server infrastructure only.
• Organisation administrators: Site managers and account owners within your organisation can view sign-in records and visitor information for sites they manage.

We retain personal information for as long as it is needed to fulfil the purposes described in this policy, or as required by law. Site visitor sign-in records are retained for a minimum of 7 years to comply with health and safety recordkeeping obligations under the Health and Safety at Work Act 2015. Account data is retained for the duration of the subscription and deleted within 90 days of account closure upon request.

Under the New Zealand Privacy Act 2020, you have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate personal information
• Ask us to delete your personal information (subject to legal retention obligations)
• Raise a concern or complaint about how we handle your information

To exercise any of these rights, contact us at hello@nzfsitelink.co.nz. We will respond within 20 working days as required by the Privacy Act.

We take reasonable steps to protect personal information from loss, unauthorised access, disclosure, or misuse. All data is encrypted in transit using TLS and encrypted at rest. Access to personal data is restricted to authorised personnel only.

We use a single session cookie (sitelink_visit) to remember a visitor's sign-in status on a site for up to 24 hours. This cookie is strictly necessary for sign-in and sign-out functionality and does not track you across other websites. We do not use advertising or analytics cookies.

We may update this Privacy Policy from time to time. We will notify account holders of material changes by email. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

For privacy enquiries, requests, or complaints:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner at privacy.org.nz.