Privacy Policy

Revision: 2

Last updated: 22 October 2026

1. Introduction and scope

GWAITH DEVELOPMENT LIMITED (NZBN 9429053840806) of Mosgiel, New Zealand ("Gwaith", "we", "us", "our") develops and operates business management software, including desktop, web, and mobile applications, and the API integrations that connect them.

Gwaith is the agency responsible for the personal information it holds in its own right, and is accountable for that information under the Privacy Act 2020. For some information Gwaith processes on a client's instructions, Gwaith acts on that client's behalf rather than as the responsible agency; the United States subsection of section 13 explains how that affects a request about information of that kind. This policy explains what personal information Gwaith collects, why it is collected, how it is used, who it is shared with, where it is stored, how long it is kept, and what rights you have in relation to it.

This policy applies to:

• this website at gwaith.co.nz;
• the Gwaith API (also known as the "Boost API" or "Boost Management API");
• the Boost Management Portal;
• Boost for RFMS;
• Boost Auto-AP;
• Boost AI features (such as AI report analysis, AI document processing, and AI chat);
• Camu;
• any other client applications that Gwaith develops and operates, including modules, apps, websites, programs, and APIs.

These applications are, in some cases, made available to end users under a reseller's own branding and on a reseller's own domain. This policy covers the information Gwaith holds in them; the reseller's own privacy policy covers the information the reseller holds.

Gwaith's software reaches end users through reseller partners. If you are an end user, your commercial relationship and your support relationship are with the reseller that licenses the software from Gwaith. Depending on the arrangement between Gwaith and that reseller, the reseller will ordinarily be a separate agency responsible for the personal information it holds about you, and in that case its own privacy policy applies to that information. This policy governs the personal information held by Gwaith in the systems Gwaith operates.

This policy does not cover third-party systems that connect to Gwaith software. Information held in those systems is governed by the privacy policy of the organisation that operates them.

2. Information we collect

The information Gwaith holds depends on which applications a client uses and how those applications are configured. It may include:

• Contact and identity information: names, postal addresses, physical addresses, phone numbers and email addresses of users, and of a client's own customers, suppliers and contacts where those records are entered into or processed by the applications.
• Authentication credentials: account passwords, and credentials a client provides so that Gwaith software can connect to a system the client controls, such as an RFMS API key or a database login. Account passwords are stored only as one-way hashes and cannot be recovered. Credentials that must be presented to another system in their original form cannot be hashed, and are held encrypted instead.
• Organisation and licensing data: the organisation a user belongs to, the licences held, licence entitlements, activation records and the reseller through which the licence was issued.
• User account data: usernames, roles, permissions, preferences, and records of activity within the applications such as sign-in times and changes made to records.
• Inventory and pricing data: product, stock, supplier and price list information held by a client in the applications or processed by the applications.
• Financial performance data: sales, purchase, job costing and reporting data generated by a client's use of the applications.
• Uploaded documents and attachments: invoices, price lists and similar business documents that a user uploads for processing, together with the information extracted from them; and files that a user attaches to records in the applications, such as scanned documents, correspondence files and other supporting material. Attached files may contain personal information about people other than the user, including a client's own customers, suppliers and contacts.
• Bank account details: the bank account numbers a client records against its own organisation and against its suppliers, so that payments can be made by electronic transfer and so that the client's own account details can be printed on its quotes, invoices, and statements.
• Tax identifiers: tax identification numbers a client records against a supplier or contractor where its obligations require it, such as a New Zealand IRD or GST number or an Australian TFN or ABN. Where the supplier or contractor is a sole trader, these numbers identify an individual.
• Photographs: images captured through a device's camera from within the applications and attached to a record, such as a photograph of damaged stock attached to a stocktake record. A photograph may incidentally include a person who is present when it is taken.
• Documents and messages sent to a client's customers: where a client uses Camu to send a document such as a quote or sample docket to one of its customers by email or text message, the customer's email address or mobile number, the content of the messages sent, delivery status, whether the document has been opened, the customer's responses, whether submitted through the document or by replying to an email, any reply sent to a text message, the record of the customer's agreement to receive text messages, including which staff member recorded it and when, and records of any text message opt-out. Section 18 describes this in more detail.
• Feedback and defect reports: the reports users submit through the applications or by email, including any screenshots, log extracts or other attachments provided with them.
• Diagnostic logs: technical records generated automatically by the applications and the API. These include user or account identifiers, IP addresses, timestamps and error information, and, in the detailed API logs, the content of the requests and responses themselves, which can include the client's own business data.
• Correspondence: the content of enquiries sent to Gwaith, including submissions through the contact form on this website.

Gwaith does not collect or process payment card details. No Gwaith system stores card numbers, card expiry dates or card verification values. Where a client's own processes involve taking a payment, that payment is handled by the client, the reseller, or a third-party provider outside the Gwaith software.

3. How we collect information

Gwaith collects personal information in five ways:

• Directly from users. Information that users enter into the applications, provide when an account is created, upload for processing, or send to Gwaith by email or through the contact form on this website.
• From resellers. Reseller partners provide the account, organisation and licensing information needed to provision and support a client's environment, including the contact details of the people who will administer it.
• Automatically through use of the applications and the API. Diagnostic logs, authentication records and operational telemetry are generated as a by-product of the software running. This information is produced by the systems themselves rather than supplied by a user.
• From systems a client connects to the Software. Where a client connects a third-party system such as its RFMS installation, the applications read data from that system to perform the functions the client asks of them. For some functions that data is processed on the client's own device; for others it is transmitted to the Gwaith API for processing and returned to the client.
• From a client's customers. Where a client uses Camu to send a document to one of its customers, the customer may respond to the client through the document itself or, if the document was sent by email, by replying to that email. The customer may also reply to a text message, including to opt out. Gwaith receives this information on the client's behalf. The people who provide it are not users of the applications.

4. How we use information

Gwaith uses personal information only for the following purposes:

• Service delivery. Operating, hosting and providing the applications and the API, and performing the functions a user asks the software to perform.
• Authentication and licence validation. Verifying who a user is, confirming that an organisation holds a valid licence, and enforcing the entitlements attached to that licence.
• Support and debugging. Investigating faults reported by a client or a reseller, reproducing and diagnosing errors, and restoring service.
• Product improvement. Understanding how the software behaves in production so that defects can be corrected and functionality improved. Where information is used for this purpose it is used in aggregate or in the narrowest form that answers the engineering question.
• Legal obligations. Meeting Gwaith's obligations under applicable law, responding to lawful requests, and establishing, exercising or defending legal claims.

Gwaith does not sell personal information. Gwaith does not trade, rent or license personal information to any third party for that party's own marketing purposes, does not disclose personal information in exchange for money or other valuable consideration, and does not use personal information for behavioural advertising.

The contact details of a client's customers, and the messages sent to and received from them, are used only to deliver the documents and messages the client sends, to record the customer's responses, to respond automatically to replies to text messages, to honour opt-outs, and for the support, legal and other purposes listed above. Gwaith does not use them for marketing.

5. The Gwaith API

The Gwaith API is internal. It is used by and between Gwaith applications and services to exchange data within the platform, and it is not exposed to third parties. Gwaith does not publish it, does not operate a public developer program for it, and does not issue credentials for it to organisations outside Gwaith.

This is separate from the third-party APIs that Gwaith software connects to, such as the RFMS, Xero and MYOB APIs. Those are operated by the third parties named in section 7 and are governed by those parties' own terms, including, in the case of Xero and MYOB, the requirements of their developer programs.

6. Artificial intelligence features

Some Gwaith applications include features that use artificial intelligence. For example, in Boost, AI answers questions about a client's own data, extracts structured information from uploaded invoices for automated processing, and extracts information from supplier or buying group price lists to update the client's product catalogue. The commitments below apply to every one of these features.

• Processing occurs entirely within Microsoft Azure, using Azure OpenAI Service and Azure AI Document Intelligence.
• The public ChatGPT product and the open OpenAI API are not used. No data is sent to either.
• Processing occurs within dedicated Gwaith resources. The Azure OpenAI Service and Azure AI Document Intelligence resources used are provisioned to and controlled by Gwaith.
• Client data is never used to train AI models. No client information is used to train or fine-tune the Azure OpenAI Service or Azure AI Document Intelligence models, or any other third-party model.
• Content is not shared with OpenAI, is not used by Microsoft to improve any model, and is not made available to other Microsoft customers.
• Data is used only to perform the requested task, and for no other purpose.
• All communication is encrypted using HTTPS/TLS, between the applications, the API and the Azure AI services.
• Access credentials are held in Azure Key Vault and are never embedded in the application.
• Boost AI assistant conversations are permanently deleted 24 hours after the last activity in the conversation. The deletion window is measured from the most recent message in a conversation, not from when the conversation began, and it restarts each time the conversation is continued.
• Uploaded invoices and price lists are deleted within 90 days. The information extracted from them remains available in the Auto-AP records and in the client's accounting system.
• Data exported from the Boost AI assistant is deleted within 90 days.

Gwaith's document extraction may improve over time from the corrections users make. Where a user corrects information extracted from a supplier's document, Gwaith's own tooling may retain what that correction indicates about the supplier's invoice or price list format. For example, how and where a particular field is labelled and positioned on that supplier's documents. What is retained by this process does not reveal the contents of the document. This information is held by Gwaith, is not sent to any third party, and is not used to train or fine-tune any model. Because it describes a supplier's documents rather than client data, it may be applied across the Gwaith platform, so every client receiving documents from that supplier benefits from the corrections made by others. It may be retained for as long as the extraction features are offered, which may be after the document a correction was made against has been deleted.

7. Third-party services and subprocessors

Gwaith uses the services listed below to host, operate and integrate its software.

Where information is transmitted to a third party listed above, that third party's own privacy policy governs its handling of the transmitted data. This applies in particular to the integration rows: information sent to the RFMS, Xero or MYOB APIs at a client's direction is thereafter held by the third party under their own terms and privacy policies, and Gwaith does not control its retention or use in those systems.

8. Non-affiliation

Gwaith Development Limited is an independent company. Where Gwaith software integrates with a third-party system, that integration does not create, and should not be read as creating, any partnership, endorsement or joint venture between Gwaith and the operator of that system.

All product names, brand names and trademarks referred to in this policy or in Gwaith software are the property of their respective owners, and are used only to identify the systems concerned.

9. Data storage and location

Gwaith applications and APIs store client data in Microsoft Azure, in either Australian or United States datacentres.

This website and its API run in the Azure West US 2 region.

Gwaith also operates its own development infrastructure in New Zealand and the United States. This infrastructure hosts internal engineering tooling only, such as integrated development environments, source control, build and other internal tooling. This infrastructure does not hold end-user personal information.

The statements above describe deployments hosted by Gwaith. Where software developed by Gwaith is deployed on infrastructure that a client owns or controls, whether self-hosted by the client (on a third party platform) or run on-premises, the data held in that deployment resides on the client's own infrastructure and not on infrastructure operated by Gwaith. Gwaith does not hold or store that data, and the client is the agency responsible for it.

More generally, the statements in this section are confined to infrastructure that Gwaith itself operates. A reseller's own systems, separate from that infrastructure, are covered by the reseller's own privacy policy.

10. Data security

Gwaith applies the following measures to protect the personal information it holds in the systems it operates. Where software developed by Gwaith is deployed on infrastructure that a client owns or controls, the client is responsible for the security of that infrastructure and of the data held on it.

• Encryption in transit. All traffic between users, the applications, the Gwaith API and the underlying Azure services is encrypted using TLS.
• Encryption at rest. Databases, storage accounts and backups are encrypted at rest.
• Organisation-scoped access control. Data is logically partitioned by organisation, and application requests are authorised against the requesting user's organisation and role so that a user can reach only the data belonging to their own organisation.
• Secrets management. Connection strings, API keys and service credentials are held in Azure Key Vault. They are not embedded in application code, configuration files or source control.
• Restricted personnel access. Access to production systems and client data is limited to the Gwaith personnel who require it to operate and support the software, and is granted only for as long as that need exists.
• Reseller support access. Gwaith's licensing system allows a reseller's support staff to be issued a temporary password that lets them sign in to a customer's environment as the end user. The issue and use of that password is logged, and it expires automatically after 24 hours.
• Password and token handling. Account passwords are stored only as one-way hashes and cannot be recovered. Credentials that Gwaith holds on a client's behalf in order to connect to a system the client controls, such as an RFMS API key or a database login, must be presented to that system in their original form and therefore cannot be hashed. They are held encrypted rather than hashed, and are used only to make the connections the client has configured. In cases where a third-party system allows the use of OAuth tokens for API access, this is used instead.

No system can be guaranteed to be completely secure. Gwaith maintains these controls and reviews them, but cannot warrant that a security incident will never occur. If a privacy breach occurs that is likely to cause serious harm, Gwaith will notify the Office of the Privacy Commissioner and the affected individuals as required by the Privacy Act 2020, and will also notify the affected client and its reseller without undue delay.

11. How long we keep information

This section describes how long Gwaith retains data in deployments it hosts; where software developed by Gwaith is deployed on infrastructure that a client owns or controls, retention of the data held on that infrastructure is the client's responsibility.

Retention depends on the category of information:

• Boost AI assistant conversations: permanently deleted 24 hours after the last activity in the conversation. The window is measured from the most recent message and restarts whenever the conversation is continued.
• Uploaded invoices and price lists: deleted within 90 days. The information extracted from them remains available in the Auto-AP records and in the client's accounting system.
• Data exported from the Boost AI assistant: deleted within 90 days.
• Supplier document-format information (described in section 6): retained for as long as the extraction features are offered.
• Account, organisation and licensing data: retained for as long as the account and licence remain active, and afterwards only for as long as needed to meet legal, accounting and audit obligations.
• Business data (eg: quotes, product catalogues, pricing data, inventory, customers, reporting, financial performance, and related data held in the applications): retained for as long as the client maintains an active account. Unless a different period is agreed with the client or its reseller, the data is deleted 30 days after the account is terminated. The 30-day window allows an account to be reactivated without loss of historical data.
• Documents sent to a client's customers, and their responses: emails and text messages sent through Camu, email replies, and questions and change requests submitted through a linked document are held with the quote or sample docket they relate to, as part of the client's business data, and are retained and deleted on the same basis. The messaging provider listed in section 7 deletes its own copy of text message content after 120 days.
• Replies to text messages: not passed to the business that sent the message and not stored in Camu. They are held only by the messaging provider listed in section 7, which deletes them after 120 days. A reply that opts out is kept as an opt-out record.
• Text message opt-in records: held with the client's customer records, as part of the client's business data, and retained and deleted on the same basis.
• Text message opt-out records: retained for as long as needed to continue honouring the opt-out, which may be after the account of the client that sent the message has ended.
• Data read from a connected third-party system for processing: held only for as long as needed to perform the requested function, and then discarded, subject to the diagnostic log retention described below. It is not added to the client's records in the applications unless the function the client has used stores it there.
• Diagnostic logs: detailed API logs, which include request and response content, are deleted on a rolling 30-day cycle. Metadata logs, such as session records and failed sign-in attempts, are retained for 90 days.
• Contact form submissions, correspondence, and feedback and defect reports: delivered by email and retained in the Gwaith inbox in accordance with normal correspondence retention. This includes any screenshots or other attachments provided with a feedback or defect report.
• Rate-limiting records for this website: a salted hash of the submitting IP address, held only for the short period needed to enforce the rate limit.

Where Gwaith no longer needs personal information for any purpose for which it may lawfully be used, it is deleted or de-identified.

12. Disclosure of personal information

Gwaith discloses personal information only in the following circumstances:

• To subprocessors. To the third parties listed in section 7, for the purposes stated there.
• To resellers. To the reseller partner responsible for a client's account, to the extent needed to provision, license and support that account.
• At a client's direction. To third-party systems that a client connects to Gwaith software, such as an accounting or ERP platform, where the client has configured that integration.
• Where required by law. Where disclosure is required or authorised by law, by a court order, or by a lawful request from a regulator or law enforcement agency, or where disclosure is necessary to prevent or lessen a serious threat to life, health or safety.
• On a business transfer. If Gwaith is involved in a merger, acquisition, reorganisation or sale of assets, personal information may be transferred as part of that transaction. Any recipient would be required to handle it in a manner consistent with this policy, and Gwaith would update this policy to reflect any change in the responsible agency.

13. Your rights

The rights available to you depend on where you are located. In every case, you may exercise your rights by emailing admin@gwaith.co.nz. Gwaith may need to verify your identity before acting on a request, and may ask for additional information for that purpose. If you are an end user of software supplied by a reseller, Gwaith may need to work with that reseller to locate and act on your information, and will tell you where your request has been directed.

New Zealand

Under the Privacy Act 2020 you have the right to ask whether Gwaith holds personal information about you, to request access to that information, and to request correction of it. If Gwaith declines a request, it will tell you the reasons to the extent the Privacy Act 2020 requires, and explain your right to complain. If correction is declined, you may ask that a statement of the correction sought be attached to the information.

If you are not satisfied with how Gwaith has handled your information or your request, you may complain to the Office of the Privacy Commissioner, which may investigate the matter.

Australia

Under the Privacy Act 1988 and the Australian Privacy Principles you have the right to request access to the personal information Gwaith holds about you, to request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading, and to be told how Gwaith handles your information. You may also deal with Gwaith anonymously or under a pseudonym where it is lawful and practicable to do so.

If you are not satisfied with Gwaith's response to a request or a complaint, you may complain to the Office of the Australian Information Commissioner.

United States

If you are a resident of a state with a comprehensive privacy statute, including California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Virginia under the Virginia Consumer Data Protection Act (VCDPA), and Colorado under the Colorado Privacy Act (CPA), you have the following rights:

• The right to know what categories of personal information Gwaith has collected about you, the purposes for which it is used, and the categories of third parties it is disclosed to. This information is available in this Privacy Policy.
• The right to access the specific pieces of personal information Gwaith holds about you, and to receive them in a portable form where required.
• The right to delete personal information Gwaith holds about you, subject to the exceptions the applicable statute allows, such as information Gwaith must retain to comply with a legal obligation or to complete a transaction requested by a client.
• The right to correct inaccurate personal information Gwaith holds about you.
• The right to opt out of the sale or sharing of personal information. Gwaith does not sell personal information and does not share it for cross-context behavioural advertising, so there is nothing to opt out of.
• The right to non-discrimination. Gwaith will not deny service, charge a different price, or provide a different level of service because you have exercised a privacy right.

Where Gwaith processes personal information on behalf of a client, Gwaith acts as a service provider or processor. In that case Gwaith will refer your request to the client responsible for the information, or act on that client's instructions, and will tell you where your request has been directed.

14. Cross-border transfer of information

Personal information held by Gwaith may be transferred to, stored in, and accessed from Australia, New Zealand and the United States, and, in the case of text messages, accessed from the European Union and the Philippines by the support personnel of the messaging provider listed in section 7. Section 9 describes where each part of the service is hosted, and section 7 states the location in which each subprocessor operates. The countries concerned may have data protection rules that differ from those of the country in which you are located, and in some cases those rules may offer a lower standard of protection.

Where information is transferred, Gwaith takes reasonable steps to ensure that it remains subject to protections comparable to those required by the Privacy Act 2020, including through the contractual terms Gwaith holds with the subprocessors listed in section 7.

Where a subprocessor offers a choice of datacentre location for a service, Gwaith prefers an Australian or New Zealand datacentre. Where a service is not available in those regions, or cannot be provisioned there, a United States region is used.

15. Sensitive information

The Gwaith applications are business management tools. Except as described below, they are not designed to hold sensitive information, and you must not submit sensitive information to Gwaith or enter it into the applications. Sensitive information means information of a kind treated as sensitive under the applicable statutes, including health and medical information, biometric and genetic information, racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, trade union membership, sexual orientation, criminal records, precise geolocation, and government identifiers such as passport, driver licence or social security numbers.

The applications do provide fields for tax identification numbers and bank account details, because a client cannot pay a supplier or contractor, or meet its own tax reporting obligations, without recording them. Where a supplier or contractor is a sole trader, those numbers identify an individual. Gwaith holds this information on the client's instructions and for no other purpose. It is the client's responsibility to ensure it is entitled to collect the information, to record only what its obligations require, and to comply with the rules governing tax identifiers in its jurisdiction, including the Privacy (Tax File Number) Rule 2015 in Australia. Gwaith does not use tax identifiers or bank account details to identify or match individuals, and does not disclose them other than as described in section 12.

If sensitive information of a kind described in the first paragraph is submitted despite this, Gwaith will delete it once it becomes aware of it, unless it is required by law to retain it. Gwaith does not seek, request or knowingly process that information.

16. Use by minors

The Gwaith applications, the Gwaith API, and this website are business tools directed at organisations and their staff. They are not directed at minors, and Gwaith does not knowingly collect personal information from them. Accounts are created for and by the staff of client organisations.

If you believe that a minor has provided personal information to Gwaith, contact admin@gwaith.co.nz and it will be deleted.

17. This website

This website collects personal information in one way only: through the contact form. The information collected is the name, email address, optional company name and message that you enter.

This website sets no cookies. It runs no analytics, no tracking, no advertising, no session recording and no third-party scripts, and it does not build a profile of visitors. Nothing on this website is loaded from an external origin.

This is a statement about gwaith.co.nz only. Applications served on reseller-branded domains use cookies for authentication and session management, which is a different matter from this website.

Contact form submissions are delivered by email to Gwaith and are retained in the Gwaith inbox in accordance with normal correspondence retention. The IP address from which a submission was made is recorded in the body of that message so that abuse can be traced, and a salted hash of the same address is held briefly for the sole purpose of enforcing a submission rate limit. The hash is not reversible and is not used to identify or track visitors.

18. Documents and messages sent to a client's customers

Camu allows the businesses that use it to send documents, such as quotes and sample dockets, to their own customers by email or text message. This section explains how that works and how Gwaith handles the information involved. It applies to you if you have received a document or message of that kind.

Each message is sent by the business named in it, using Camu. Your relationship is with that business: it decided to send the message, and it is responsible for the information it holds about you. Gwaith operates the software and the services used to deliver the message, and handles the information involved on that business's behalf.

Shared documents

• Access by link. A message may contain a link to a quote or sample docket. Anyone who has the link can open the document without signing in, so treat the link as you would the document itself. The link stops working if the business deletes the document.
• Responding to the business. Through the link you can submit a question or change request to the business. It is stored with the document, together with the business's response.
• Viewing records. Camu records whether the document has been opened. Requests made through the link are also subject to the diagnostic logging described in section 2.

Email

• Replying to an email. If a business sends you a document by email, you can reply to that email as well as responding through the link. Your reply is received by Camu through the email provider listed in section 7 and is stored with the document, rather than being delivered to an email inbox.
• Content. Most emails sent from Camu use a set template, but a business can also write its own. The business is responsible for what it sends.
• No tracking. Emails sent from Camu do not contain tracking images, and the links in them are not redirected through a tracking service.

Text messages

• What the messages are for. Text messages sent through Camu are transactional and one-way. Camu sends a message only from a set template, which names the business, may name the staff member dealing with you, and tells you how to opt out. It does so to send you a quote or sample docket, or to let you know that the business has responded to a question or change request you submitted. A business cannot write its own text messages in Camu, and Camu's text messages are not used for marketing or promotion.
• How you came to receive them. A business sends text messages through Camu only after dealing with you directly, such as when you request a quote or borrow a sample, and only after it has recorded in Camu that you agreed to receive text messages from it. Camu records which staff member recorded your agreement, and when. Providing a mobile number, or agreeing to receive text messages, is not a condition of requesting a quote or borrowing a sample.
• Replying to a message. Replies to these messages are not passed to the business. To ask a question or request a change, use the link in the message or contact the business directly. If you reply with anything other than an opt-out or a request for help, you will receive an automatic response asking you to contact the business directly. A reply asking for messages to stop is treated as an opt-out.
• How often. Message frequency varies. You receive one message for each quote or sample docket a business sends you, and a message when the business responds to a question or change request you submit. If the business posts several responses within a short period, you receive a single message about them. Messages are not sent overnight: a message that would otherwise be sent overnight, in the business's local time, is held until the following morning.
• Cost. Message and data rates may apply, depending on your mobile plan.
• Opting out. Reply STOP to any message to stop receiving text messages. You may receive one final message confirming that you have opted out. The numbers used to send these messages are shared by the businesses that use Camu, so replying STOP may also stop text messages to you from other businesses that send through Camu from the same number. You can also ask the business that messaged you to stop texting you, by any reasonable means, and it must do so. To receive messages again, reply START to the same number.
• Help. Reply HELP to any message for help, contact the business that sent it, or email Camu support at support@camusolutions.com. For a privacy enquiry, you can also contact Gwaith using the details in section 20.

Your information

• What Gwaith holds. Your email address or mobile number, the content of the messages sent to you, their delivery status, whether the linked document has been opened, the questions, change requests and email replies you send, any reply you send to a text message, the record of your agreement to receive text messages, and any opt-out.
• Who it is shared with. To deliver a message, Gwaith passes your contact details and the message content to the email or messaging provider listed in section 7. Text messages are then passed to the mobile network operators that carry them. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, other than the messaging provider and mobile network operators that deliver the messages.
• How long it is kept. Section 11 sets out how long documents, messages, replies and opt-out records are retained.
• Your rights. To access or correct information about you in these documents and messages, contact the business that sent them in the first instance. You may also contact Gwaith, and section 13 explains how Gwaith will handle your request.

19. Changes to this policy

Gwaith may update this policy from time to time to reflect changes to the software, to the subprocessors it uses, or to the law. When it does, the revised policy is published at this address and the "Last updated" date at the top of the page is changed. Where a change materially affects how personal information is handled, Gwaith will take reasonable steps to notify affected clients and resellers.

This policy is effective from 22 October 2026. Your continued use of the applications, the Gwaith API or this website after a change is published constitutes acceptance of the updated policy. If you do not accept a change, stop using the services and contact Gwaith or your reseller.

20. Contact

For any privacy enquiry, access or correction request, or complaint about how Gwaith has handled personal information, contact:

GWAITH DEVELOPMENT LIMITED
NZBN: 9429053840806
2 Victoria Street
Mosgiel, 9024, New Zealand
+64 21 668 418
admin@gwaith.co.nz

Gwaith will acknowledge your enquiry and respond within the time frame required by the law that applies to you.