Legal

Privacy Policy

Effective date: 29 September 2026

Applies to: All visitors to www.weavhr.com and all users of the WeavHR web application and the WeavHR iOS and Android mobile apps.

1. Introduction

WeavHR Limited (‘WeavHR’, ‘we’, ‘us’, or ‘our’) is committed to protecting the privacy of all customers, clients and other individuals that interact with us, whether through our services, website, communications, transactions or other dealings.

WeavHR provides a cross-sector workforce-management platform, which is available through our website and our iOS and Android mobile apps (Service).

We collect and store personal information about you to allow us to provide you with our services. Our collection of personal information is subject to the New Zealand Privacy Act 2020 and all regulations and subordinate legislation implemented under it (Act). This privacy policy (Policy) explains how we may collect, use, disclose and protect your personal information in accordance with our obligations under the Act.

Nothing in this Policy alters your rights under the Act. If you would like to learn more about these rights, please visit www.privacy.org.nz.

Please read this Policy carefully. If you have any questions, contact us at privacy@weavhr.com.

2. Purposes of collection

We may collect and use your personal information for the following purposes:

To verify your identity.
To provide our services to you.
To communicate with you (including for marketing purposes) and respond to communications from you.
To improve the services that we provide to you.
To undertake credit checks of you (if necessary).
To bill you and to collect money that you owe us.
To conduct research and statistical analysis (on an anonymised basis where possible).
To protect and/or enforce our legal rights and interests, including defending any claim.
For any other purposes authorised by you or the Act,

(the Purposes).

We only collect and use your personal information for reasons associated with these Purposes.

3. Types of personal information we may collect

The personal information that we will collect about you depends on the Purpose for which it is collected, the context of our interaction, and the means by which that interaction occurs.

Examples of personal information that we may collect include the information listed below:

Examples of personal information we may collect
Nature of interaction	Personal information that may be collected
General enquiries or communications	Name. Contact details (such as your email address and phone number). The content of your enquiry or correspondence.
Customer representative details	Name. Job title and role. Business contact details (such as email address and phone number). Organisation name and details. Billing and account information.
Users of our service	Name. Work email address and other contact details. Login credentials and account details. Job title and role. Usage data and activity logs (including features accessed, actions taken, and session information).
Users of our mobile app	Sign-in tokens, held in your device’s encrypted secure storage. Device model, operating-system version and app version, sent with requests for support and security. Cached profile pictures and organisation logos, which are cleared on sign-out. Temporary copies of documents you open. Your location when you check in to and out of a shift, including automatic check-in when you arrive at the work site while the app is open (location is never collected in the background). Photos and files you upload for compliance documents, health and safety reports and messages.
Individuals supported by our customers	Name and contact details. Information about the support or services provided to them.
Details of employees and other personnel of our customers	Name and employee identifier. Contact details (such as work email address, phone number, and work address). Employment details (such as job title, department, employment type, and start date). Payroll and remuneration information (where entered by the employer). Other HR information entered into the platform by the employer (such as performance records, leave records, and other workforce data). Workforce health and safety and compliance information (such as compliance documents and health and safety reports).
Marketing and promotional interactions	Names of recipients of marketing materials. Contact details to which marketing materials are to be sent. Marketing preferences.
Feedback, surveys or research activities	Names of respondents/participants (where not completed on an anonymous basis). Preferences, opinions, and other feedback provided to us.
Website use and interactions	IP address. Device and browser information. Cookie data (see our Cookie Policy for more detail on how we use cookies and similar technologies).
General compliance matters	Other information we are required to collect to meet a legal, regulatory or compliance obligation (where applicable).

Some personal information (such as your account details and website usage data) is collected and controlled by WeavHR in its own right. Other information (such as HR and employee records entered by your employer) is held and processed by WeavHR on behalf of the employer customer. Where an employer customer controls the information, the employer is responsible for determining how it is collected, used, disclosed and retained, and WeavHR acts on the employer’s instructions.

4. How we collect personal information

We may collect your personal information directly from you, from third parties, or from other sources where the information is publicly available.

Where practicable in the circumstances, we will collect personal information directly from you.

Where it is impracticable in the circumstances to collect personal information directly from you, or where we have reasonable grounds to believe that an exception to Information Privacy Principle 2 applies, we may collect your personal information from a source other than you.

For the purposes of Information Privacy Principles 2 and 3, where we collect your personal information directly or indirectly:

that collection will only occur as necessary to further any of the Purposes;
the personal information will be held by us and will only be disclosed to third parties in accordance with this Policy; and
you have the right to access and to request correction of the personal information that we hold about you, as further detailed in clause 9.

5. Sharing Your Information

We may disclose your personal information to:

Any business that supports our services and products, including any person that hosts or maintains any underlying IT system or data centre that we use to provide the website or any of our other services (such as Microsoft Azure), authentication providers (such as Kinde), email delivery, push notification and app distribution providers (such as Microsoft, Google and Apple), any fraud detection partners, and customer support partners (such as Atlassian).
Any credit reference agency for the purpose of credit checking you.
Other third parties (for anonymised statistical information).
A person who can require us to supply your personal information (such as a regulatory or government authority).
Any other person authorised by the Act or another law (such as a law enforcement agency).
Any other person authorised by you.

We may disclose or store your personal information with service providers or other recipients located outside New Zealand. This may occur, for example, where we use overseas-based IT systems or cloud service providers. At the date of this Policy, personal information held within the Service is stored in Australia, and our business email is hosted in New Zealand. Some information may also be processed briefly in other countries, for example when web traffic is routed through our cloud provider’s global network, or when push notifications are delivered to your device through Apple or Google.

We may also disclose your personal information to any entity that we enter into any joint venture with or any other business that we are sold to or merged with.

We will only disclose personal information to the parties listed in this clause if it is necessary and appropriate to facilitate the Purposes for which your personal information was collected.

6. Storing Your Information

Your information is stored on secure servers, which may be located in New Zealand or overseas. At the date of this Policy, those servers are located in Australia (see clause 5).

We will ensure that your personal information is not retained for longer than is necessary to fulfil the Purpose for which it was collected, or any legal or regulatory requirement applicable to its retention. Once there is no longer a basis to hold your personal information, it will be securely deleted or de-identified. Where information is de-identified, we will ensure the de-identification is irreversible.

When an account is closed, it is deactivated immediately. On request, we will delete or de-identify your personal information within 90 days, except where we need to keep it to meet legal, audit or dispute-resolution obligations, or where an employer customer’s instructions require a different retention period. Deleted information may remain in secure, encrypted backups until those backups expire, which may be up to seven years, and is only restored for disaster recovery. Records of database activity are also kept for up to seven years.

7. Security

We take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, disclosure, or other misuse. These steps include:

Encrypting data in transit and at rest;
Using secure passwordless one-time codes for sign-in, and multi-factor authentication to protect administrative access to our infrastructure (with multi-factor authentication being introduced for sign-in to the WeavHR application);
Conducting regular security assessments (including independent security testing);
Limiting access to personal information to staff and contractors who need it;
Protecting personal information against unauthorised modification;
Securely disposing of or deleting personal information that is no longer required.

8. Privacy breaches

If we become aware of a privacy breach involving your personal information, we will:

assess the breach to determine whether it amounts to a notifiable privacy breach (as that phrase is defined in the Act);
investigate the cause and effects of the breach; and
take reasonable steps to prevent similar breaches from occurring again in the future.

Where the breach is assessed as being a notifiable privacy breach (that is, it is likely to cause serious harm), we will notify the Privacy Commissioner and (subject to any appropriate exceptions applying) the affected individuals of the breach in accordance with the requirements of the Act.

9. Your Rights

Under the Privacy Act 2020, you have the right to:

Ask us to confirm whether we hold personal information about you;
Request a copy of the personal information we hold about you;
Ask us to correct any inaccurate or incomplete information;
Complain to the Office of the Privacy Commissioner if you think we have not handled your information properly.

To exercise any of these rights, email us at privacy@weavhr.com. We will respond as soon as reasonably practicable and no later than 20 working days, subject to any lawful extension permitted by the Act. Access may be withheld only on grounds permitted by the Act. If you are given access to your personal information, we will advise you of your right to request correction.

If your request relates to HR or employee information held by WeavHR on behalf of an employer customer, we will allocate or transfer your request to the relevant employer, as the employer directs access to and correction of that information.

If we are unable to make a correction you have requested, you may provide a statement of the correction sought, and we will take reasonable steps to attach that statement to the information so that it is apparent to any person who subsequently accesses it. Where we make a correction or attach a statement of correction, we will, so far as reasonably practicable, notify any person to whom the information has previously been disclosed.

You can also use the Privacy Commissioner’s ‘About Me’ tool to make a request: www.privacy.org.nz.

10. Children

You must be at least 16 years old to establish or use a WeavHR account. If you believe that someone under 16 has established or is using their own account, please contact us and we will take appropriate steps. For the avoidance of doubt, our customers may lawfully hold personal information about individuals under 16 within the Service (for example, information about individuals they support). That information is held by WeavHR on behalf of the relevant customer (see clause 3).

11. Health Information

The Service is not intended to operate as a patient-management system or as a clinical record. However, our customers may configure the Service to hold workforce health and safety or compliance information, or health, disability and support-related information about individuals they support. Where they do so, that information is held by WeavHR on behalf of the relevant customer, who is responsible for ensuring that it is collected, used and disclosed lawfully. If you have any questions about health information held within the Service, please contact us at privacy@weavhr.com.

12. Links to Other Websites

Our website may contain links to third-party sites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing any personal information.

13. Changes to This Policy

We may update this Policy from time to time. If we make a significant change, we will tell you by email or by a prominent notice on our website. The date at the bottom of this page shows when the Policy was last updated.

14. Contact and Complaints

If you have questions or concerns about how we handle your personal information, please contact us:

Privacy Officer, WeavHR Limited
Email: privacy@weavhr.com
Website: www.weavhr.com

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner:

Website: www.privacy.org.nz
Phone: 0800 803 909

Last updated: 29 September 2026