Privacy Policy.

IwiConnect Limited (“IwiConnect”, “we”, “our”, “us”) operates a secure, auditable engagement platform connecting iwi, hapū, councils, developers, and agencies.

This Privacy Policy explains how we collect, use, store, retain, and protect personal information in connection with the IwiConnect platform.

This Policy must be read alongside:

• Iwi and Hapū Terms of Use
• Customer Terms of Use

If there is any inconsistency between this Policy and the applicable Terms of Use, the Terms prevail to the extent of that inconsistency.

We comply with the Privacy Act 2020 and its Information Privacy Principles.

IwiConnect operates as a software as a service platform.

Depending on the context, we may act as:

• A service provider processing engagement and project information on behalf of customers and iwi
• An organisation collecting and using account, billing, security, and platform administration information for our own operational purposes

We provide digital infrastructure to enable engagement.

We do not determine iwi decisions, control engagement outcomes, or provide legal, cultural, planning, or professional advice.

Each party remains responsible for the accuracy, lawfulness, and appropriateness of the information it uploads or submits through the platform.

We collect only the information necessary to operate, secure, and support the platform.

Information is collected directly from users when accounts are created, projects are submitted, documents are uploaded, or communications occur through the platform.

We collect and use personal information to:

• Operate and maintain the IwiConnect platform
• Enable secure engagement notifications and communications
• Maintain an auditable record of engagement activity
• Provide onboarding, training, and support
• Improve platform performance and security
• Comply with legal and regulatory obligations

We do not sell personal information.

We do not use engagement data for advertising purposes.

Information submitted through the platform is shared only:

• With the relevant iwi, hapū, council, developer, or agency involved in the specific engagement
• With secure third party service providers necessary to operate the platform, such as cloud hosting and payment providers
• Where required by law

Third party providers operate under their own contractual and legal obligations. We take reasonable steps to ensure appropriate safeguards are in place.

We do not disclose engagement information for unrelated commercial use.

IwiConnect recognises and upholds Māori data sovereignty.

Iwi and hapū retain ownership and control of responses, assessments, and cultural information they submit.

Iwi intellectual property remains with the iwi or hapū.

Engagement records remain subject to the governance and retention provisions set out in the Iwi and Hapū Terms of Use.

IwiConnect does not claim ownership of iwi generated content.

Retention differs by category of information and mirrors the applicable Terms of Use.

Where deletion cannot occur, information will remain subject to appropriate security safeguards.

We implement reasonable and appropriate technical and organisational safeguards, including:

• Encryption of data in transit and at rest
• Role based access controls
• Authentication mechanisms
• System monitoring and access logging

The platform is hosted on secure cloud infrastructure.

No online platform can guarantee uninterrupted or error free operation or absolute security.

If a notifiable privacy breach occurs, we will notify affected parties as soon as practicable in accordance with the Privacy Act 2020.

Where required, we will notify the Office of the Privacy Commissioner.

Individuals may request access to, or correction of, personal information we hold about them.

Requests should be directed to: info@iwiconnect.com.

Where information forms part of a shared engagement record, requests will be assessed in accordance with contractual, legal, and audit integrity obligations.

The platform uses secure cloud infrastructure which may involve storage or processing outside New Zealand.

Where this occurs, we take reasonable steps to ensure appropriate safeguards consistent with the Privacy Act 2020.

If IwiConnect undergoes a corporate restructure, merger, assignment, or sale, core data protection and data sovereignty commitments will continue to apply in accordance with the Terms of Use.

We may update this Privacy Policy from time to time.

Where changes are material, we will notify users through the platform.

The latest version will always be available on the IwiConnect website.