Legal
Privacy Policy
How Compleation Limited collects, uses, stores and protects your personal information - in plain English.
We keep this page short on jargon and long on detail, so you can see exactly what happens to your information and what you can ask us to do about it.
The short version
Four things to know.
The detail is below. If you read nothing else, read these.
Only what we need
We keep collection small.
We ask for the information we need to reply, book, deliver and invoice - and nothing more.
Never sold
We do not sell your information.
It is shared only with the tools and providers that help us run the business, or where the law requires it.
Your rights
You can ask to see or correct it.
Ask for a copy of what we hold, or for a correction, any time. We reply within 20 working days.
Easy to reach
One person, one contact form.
Every privacy question goes to Kirsten Winter, our Privacy Officer, through the contact form.
On this page
Find what you're looking for.
01Who we are
Who we are and what this policy covers.
Compleation Limited ("we", "us" or "our"), is committed to protecting your privacy. We are a New Zealand company based in Te Puke, Bay of Plenty, providing independent governance, compliance, financial administration and business admin support to businesses, committees, trusts, incorporated societies and boards.
This policy explains how we collect, use, store, share and protect your personal information, in accordance with the New Zealand Privacy Act 2020 and its information privacy principles. It applies to all websites and digital services owned and operated by Compleation Limited, including the two below and any associated sales or funnel pages and domains, as well as our forms, bookings, communications and services.
Website one
workingwithkirstenwinter.com
Our governance, compliance and admin services site, for established businesses, committees, societies and boards.
Our Privacy Officer is Kirsten Winter. Every privacy question or request comes to her directly.
02What we collect
The information you give us.
Most of what we hold comes straight from you. Here is what, and where.
Enquiries and bookings
Getting in touch
Your name, email, phone number, organisation name and what you need help with, from our contact form and book-a-call page.
Clients and onboarding
Starting work together
Billing address, organisation details and your answers on intake forms about your organisation and what you need.
Payments
Paying us
Billing details and payment confirmations. Card and bank details are collected by the payment provider, not by us.
Website visits
Using our sites
Device and browser details, IP address, pages viewed and how you arrived, collected through cookies and similar tools.
You do not have to give us any of this. If you choose not to, we may not be able to reply to you, book a call or deliver a service.
03Why we use it
What we use your information for.
- Replying to enquiries and arranging calls.
- Preparing for and delivering our services, including support for committees, societies and boards.
- Invoicing, taking payment and keeping the financial records the law requires.
- Sending updates or marketing, only where you have asked for them.
- Understanding how our websites are used so we can improve them.
- Meeting our legal and professional obligations.
We use personal information only for the purpose we collected it, or a directly related purpose, unless you agree otherwise or the law allows it.
04Information from others
When we collect information about you from someone else.
When this happens
Sometimes personal information reaches us from a source other than the person it is about. For example:
- A client gives us names, contact details or records for their staff, committee members, officers, members or families so we can do the work.
- We look up public registers, such as the Companies Office, charities and incorporated societies registers.
- A client's accountant, bank or other adviser shares information with us, with the client's authority.
- Someone refers you to us and passes on your contact details.
What we do about it
From 1 May 2026, the Privacy Act (information privacy principle 3A) requires organisations to take reasonable steps to tell people when they collect information about them from someone else. Where we collect your personal information from a source other than you, for our own purposes, we take reasonable steps to tell you as soon as reasonably practicable. We will tell you:
- that we have collected your information, and from whom where that is appropriate;
- who we are and how to contact us;
- why we collected it and what we will use it for;
- who we expect to share it with; and
- that you can ask to see and correct it.
We may not need to tell you where the law provides an exception - for example, you have already been told, the information is publicly available, or telling you would be impracticable or defeat the purpose of collecting it.
Information we hold for our clients. Where we handle personal information solely on a client's behalf, under their instructions and in their systems, it is generally treated as held by that client under the Privacy Act. The client is then responsible for telling its people about it, and we support our clients to do that as part of our work. If you want to know where we got your information, ask us through the contact form.
05Cookies and analytics
Cookies and website analytics.
Our websites use cookies and similar tools to make forms and bookings work, to understand how visitors use the sites (Google Analytics), and to measure our advertising (Meta Pixel). These tools may collect your IP address, device and browser details, the pages you view and how you found us.
Your choices
- Change your browser settings to block or delete cookies. Some parts of our forms and booking pages may not work properly if you do.
- Use Google's browser add-on to opt out of Google Analytics.
- Adjust your advertising preferences in your Meta account settings.
These providers handle information under their own privacy policies. We do not control how they do so.
06Payments
How payments are handled.
We take payments through Stripe, PayPal and GoCardless. These providers collect and process your card or bank details under their own security and privacy terms. We do not store full card numbers or online banking details.
We receive confirmation of the payment, the amount and your billing details so we can issue invoices and keep our financial records.
07Client information
Information we handle for clients.
When we work with a client, we may need to see organisational and personal records, such as staff and payroll details, meeting minutes, financial records and registers. For early learning centres this can include attendance and parent invoice information held in the centre's systems.
- Wherever possible we work inside your own systems, such as Xero and Microsoft 365, so your information stays where you keep it.
- You keep ownership of your records at all times.
- We use client information only to deliver the agreed services and keep it confidential.
Intake forms
Pre-engagement intake forms collect information about your organisation and what you need. We use them only to prepare for and deliver your engagement.
Your engagement terms may set out extra data-handling arrangements. This policy works alongside them.
08Who we share with
We do not sell your information.
We share only what is needed, with the providers that help us run the business.
Website and CRM
FG Funnels
Hosts our websites, forms, bookings, contact records and email.
Analytics and advertising
Google and Meta
Website analytics and advertising measurement, as described in section 05.
Payments
Stripe, PayPal, GoCardless
Process payments and direct debits, as described in section 06.
Client work
Xero and Microsoft 365
Where we work inside your accounting and document systems.
Meetings and messaging
Whatever you prefer
Zoom, Microsoft Teams or Google Meet for calls, and email, Voxer, chat or direct messages for day-to-day communication, depending on what each client prefers.
The law
When required
We may disclose information where the law requires it, or where you have asked us to.
We choose providers with established security and confidentiality commitments, and we give them only the information they need to do their job. Where you ask us to use a communication tool of your choice, that tool's own privacy terms apply to your messages.
09Overseas storage
When information is stored overseas.
Many of the tools listed above store or process information outside New Zealand, including in the United States. Before we send personal information overseas, we take reasonable steps to make sure it will be protected to a standard comparable to the New Zealand Privacy Act, for example by using established providers with published security and privacy commitments.
If we cannot be satisfied of that, we will tell you and ask for your permission first.
10Security and breaches
Keeping your information safe.
We take reasonable steps to protect personal information from loss, misuse and unauthorised access or disclosure. Your information is kept in secure platforms, and access is limited to the person doing the work and the tools needed to do it. Nothing is farmed out to a stranger.
If something goes wrong
If a privacy breach is likely to cause serious harm, the Privacy Act 2020 requires us to notify the Office of the Privacy Commissioner and the people affected as soon as practicable. We will do that, and we will tell you what happened and what you can do about it.
Nothing is farmed out to a stranger, and nothing is left half-done.
Compleation Limited · Since 200811How long we keep it
How long we keep information.
We keep personal information only for as long as we need it for the purpose it was collected, or as the law requires.
- Financial records: at least seven years, as New Zealand tax and record-keeping law requires.
- Client records: for the length of the engagement, and after it as the law or good record-keeping requires.
- Intake forms: during the engagement and for a reasonable period afterwards.
- Enquiries that do not go ahead: for a reasonable period, then deleted.
- Marketing details: until you unsubscribe.
When we no longer need information, we delete it or remove anything that identifies you.
12Your rights
You are in control of your information.
Under the Privacy Act 2020 you have the right to:
Access
See what we hold
Ask us to confirm whether we hold personal information about you, and to give you a copy.
Correction
Fix what is wrong
Ask us to correct information that is inaccurate, or to attach your statement if we do not agree it is wrong.
Marketing
Say no thanks
Unsubscribe from marketing at any time using the link in any message, or by asking us.
Complaint
Take it further
Tell us first so we can put it right. You can also complain to the Privacy Commissioner.
How to make a request. Use our contact form and put “Privacy request” at the start of your message. We may ask you to confirm who you are before we release or change information. We will respond as soon as reasonably practicable, and within 20 working days.
Privacy Commissioner. You can contact the Office of the Privacy Commissioner at www.privacy.org.nz or on 0800 803 909.
13Marketing emails
Marketing is always optional.
We send marketing emails only to people who have asked for them or have otherwise agreed, in line with the Unsolicited Electronic Messages Act 2007. Every marketing message includes a way to unsubscribe. Messages about work you have engaged us for are service messages and continue as needed.
14AI tools
How we use AI tools.
We use AI tools in some of our work. How we use them, and how we protect personal and client information when we do, is set out in our AI Use Policy. Please read it alongside this policy.
15Changes to this policy
When this policy changes.
We review this policy from time to time and when the law or our tools change. The current version is always on this page, with the date it was last updated at the top. If we make a significant change to how we use your information, we will make that clear.
This policy sits alongside our Terms and Conditions and AI Use Policy.
16Contact us
Questions about your privacy?
Send us a message through our contact form and start it with “Query on Privacy Policy”, so it reaches the right place straight away.
Privacy Officer: Kirsten Winter
Company: Compleation Limited
Location: Te Puke, Bay of Plenty, New Zealand
Still have questions?
We are happy to explain.
If anything on this page is unclear, ask. A plain answer is part of the service.
Work with Kirsten
Hand it off. Consider it done.
Governance, compliance and admin support for businesses, committees, societies and boards - done by me, never handed off. Book a call and we will talk it through.