Privacy Policy

We use the personal information we collect for the following purposes:

• Service delivery: To provide cybersecurity assessments, managed security services, compliance guidance, and other consultancy services you have engaged us for.
• Communication: To respond to your enquiries, provide project updates, send engagement reports, and share relevant security advisories.
• Service improvement: To understand how clients use our website and services so we can improve our offerings, user experience, and content.
• Legal compliance: To meet our obligations under New Zealand law, including the Privacy Act 2020, and to comply with any applicable regulatory requirements.
• Business operations: To manage our client relationships, process invoices, and maintain accurate business records.

We will not use your personal information for purposes other than those described above without first obtaining your consent, unless otherwise permitted by law.

Good Security does not sell, rent, or trade your personal information to third parties. We may share your information in the following limited circumstances:

• Service providers: We use trusted third-party providers for website hosting, email communications, analytics, and cloud infrastructure. These providers are contractually required to protect your information and use it only for the services they provide to us.
• Legal requirements: We may disclose your information if required to do so by law, regulation, or legal process, or if we believe disclosure is reasonably necessary to protect the rights, property, or safety of Good Security, our clients, or others.
• Professional obligations: In the course of delivering security assessments, we may need to share findings with your nominated personnel or with regulatory bodies at your direction.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction, subject to the same privacy protections described in this policy.

Your personal information is processed and stored in New Zealand and Australia, using data centres operated by reputable cloud infrastructure providers. We take the security of your information seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit and at rest using industry-standard protocols.
• Access controls that limit who within our organisation can view or process personal information, based on the principle of least privilege.
• Regular security assessments of our own systems and processes.
• Secure disposal of personal information when it is no longer required for the purposes for which it was collected.

While we take all reasonable steps to protect your information, no method of transmission or storage is completely secure. If you have concerns about the security of your information, please contact us using the details provided below.

Under the Privacy Act 2020, you have the following rights in relation to your personal information held by Good Security:

• Right of access: You may request access to the personal information we hold about you. We will respond to your request within 20 working days, as required by the Act.
• Right of correction: If you believe any personal information we hold about you is inaccurate, incomplete, or misleading, you may request that we correct it.
• Right to request deletion: You may request that we delete your personal information where it is no longer necessary for the purposes for which it was collected, subject to any legal obligations requiring us to retain it.

To exercise any of these rights, please contact our Privacy Officer using the details in the Contact Us section below. We may need to verify your identity before processing your request.

If you are not satisfied with our response to your privacy request, you have the right to lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.

Our website uses cookies and similar technologies to enhance your browsing experience and to help us understand how our site is used. The types of cookies we use include:

• Essential cookies: These are necessary for the website to function correctly, such as maintaining your session state and security preferences. They cannot be disabled.
• Analytics cookies: We use analytics tools to collect anonymised data about website usage, including page views, visit duration, and traffic sources. This helps us improve our website content and user experience.

We do not use cookies for advertising or behavioural tracking purposes. You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, though this may affect the functionality of some parts of our website.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically to stay informed about how we collect, use, and protect your personal information. Your continued use of our website and services after any changes to this policy constitutes your acceptance of the updated terms.

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how we have handled your personal information, please contact us:

• Company: Good Security
• Status: Independently registered in New Zealand
• Privacy Officer: Darren Castelyn
• Email: privacy@goodsecurity.co.nz
• Website: goodsecurity.co.nz/contact

We aim to respond to all privacy-related enquiries within 10 working days.