Privacy Policy

Optimyze Ltd ("Optimyze", "we", "us", "our") is committed to protecting your personal information in accordance with the Privacy Act 2020 (NZ) and its Information Privacy Principles ("IPPs").

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and how you can access or correct it. It applies to our website (optimyze.co.nz), our managed services platform, and all other services we provide.

By using our website or engaging our services, you agree to this policy. If you do not agree, please stop using our services and contact us to discuss alternatives.

Optimyze Ltd
Auckland, New Zealand
Email: privacy@optimyze.co.nz

Optimyze is a New Zealand-owned managed IT services provider. We act as a data controller for the personal information we collect directly, and as a data processor for personal information we handle on behalf of our clients under our managed services agreements.

We collect personal information that is reasonably necessary to provide our services, including:

• Identity information: full name, job title, company name.
• Contact information: email address, phone number, business address.
• Billing information: invoice details, payment method information (processed by our payment gateway; we do not store card numbers).
• Technical information: IP address, browser type, device identifiers, logs from managed devices and systems we support.
• Communication records: emails, support tickets, chat transcripts, and call logs related to your service requests.
• Service usage data: software inventory, endpoint status, and security event data generated by our managed IT tools (e.g. RMM, SIEM, EDR platforms).

We do not intentionally collect sensitive information (such as health data or financial account details) unless it is strictly required and you have consented.

We collect personal information:

• Directly from you when you complete a contact form, request a quote, sign a service agreement, or contact our helpdesk.
• From your devices and systems as part of our managed IT services (e.g. monitoring agents, log collectors).
• Through our website using cookies and analytics tools (see Section 10).
• From third parties, such as referral partners or publicly available business directories, only where lawful and relevant.

Where practicable, we collect information directly from you and notify you of the purpose at the point of collection.

We use your personal information to:

• Provide, manage and improve our managed IT, cloud, cyber security and consulting services.
• Respond to enquiries, support requests, and provide technical assistance.
• Enter into and administer service contracts and billing.
• Monitor, protect and maintain your IT systems under our managed service obligations.
• Comply with legal obligations (e.g. tax, audit, regulatory requirements).
• Send service communications, security alerts, and — where you have consented — marketing communications.
• Improve our products, services, and website through aggregated analytics.

We will not use personal information for purposes that are incompatible with the purpose for which it was collected without your consent.

We may share your personal information with:

• Technology vendors and subprocessors necessary to deliver our services (e.g. Microsoft, SentinelOne, NinjaOne, Huntress, AWS). These are engaged under contracts that require them to protect your information.
• Payment processors for billing purposes.
• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• Government or regulatory bodies when required by law, a court order, or a legitimate law enforcement request.
• Successors in the event of a business sale or merger, subject to equivalent privacy protections.

We do not sell, rent or trade your personal information to third parties for marketing purposes.

Some of our technology vendors and subprocessors operate outside New Zealand (including in the United States, Australia and the European Union). Where personal information is transferred offshore, we take reasonable steps to ensure the recipient provides comparable privacy protections, including through contractual clauses, certifications, or adequacy decisions.

By using our services, you acknowledge that your information may be held or processed in these jurisdictions.

We implement industry-standard technical and organisational security measures to protect personal information from loss, unauthorised access, disclosure, alteration or destruction. These include:

• Encryption in transit (TLS) and at rest.
• Role-based access controls and multi-factor authentication for our systems.
• Regular security assessments, patching, and vulnerability management.
• Staff training on privacy and information security obligations.

Despite these measures, no method of data transmission or storage is completely secure. If you have concerns about a specific risk, please contact us.

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by law. In general:

• Client account and service records — 7 years from end of contract (consistent with Inland Revenue and tax obligations).
• Support and incident logs — 2 years.
• Marketing consent records — until consent is withdrawn plus 2 years.
• Website analytics data — 26 months (rolling).

When retention periods expire, we securely delete or anonymise personal information.

Our website uses cookies and similar technologies to operate correctly and to understand how visitors use it. These may include:

• Essential cookies: required for the site to function (e.g. session management).
• Analytics cookies: to understand traffic and usage patterns (e.g. Google Analytics, aggregated and anonymised).

You can control cookie preferences through your browser settings. Disabling essential cookies may affect site functionality.

Under the Privacy Act 2020, you have the right to:

• Access personal information we hold about you (IPP 6).
• Correct personal information that is inaccurate, incomplete, misleading or not up to date (IPP 7).
• Request deletion of your information where we no longer have a lawful basis to retain it.
• Withdraw consent to marketing communications at any time.
• Complain to the Office of the Privacy Commissioner (privacy.org.nz) if you believe we have breached the Privacy Act.

To exercise any of these rights, please contact our Privacy Officer at privacy@optimyze.co.nz. We will respond within 20 working days as required by the Privacy Act 2020.

In the event of a notifiable privacy breach (as defined in the Privacy Act 2020, Part 6), we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, and take all reasonable steps to contain and remediate the breach.

We may send you marketing communications about our services where you have provided consent or where we have a legitimate interest based on an existing business relationship, consistent with the Unsolicited Electronic Messages Act 2007. Every marketing email will include an unsubscribe link. You may also opt out at any time by contacting us.

Our services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

We may update this Privacy Policy from time to time to reflect changes in law, our services, or our practices. The updated version will be posted on our website with a revised "Last updated" date. For material changes, we will notify active clients by email. Continued use of our services after changes are posted constitutes acceptance of the updated policy.

For any privacy-related questions, access requests or complaints, please contact:
Privacy Officer, Optimyze Ltd
Email: privacy@optimyze.co.nz
Phone: +64 9 281 4142