Privacy Policy | Common Law Services

1. Introduction

Common Law Services (“CLS”, “we”, “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. This policy applies to all users of the platform, including visitors, registered users, and subscribers.

2. Information We Collect

We may collect the following types of information:

Personal Information: Name, email address, postal address, phone number, and other details you provide during registration or when using our services.
Document Information: Data you enter into document templates, forms, and wizards (e.g., OIA requests, foundation documents, correspondence).
Account Information: Login credentials (hashed), role, preferences, consent records, and session data.
Usage Data: Information about how you interact with the platform, including pages visited, features used, and timestamps.
Device Information: Browser type, operating system, IP address (used for security purposes only, not tracking).

3. How We Use Your Information

We use your information to:

Provide and operate our services
Generate documents and process your requests
Communicate with you about your account and services
Improve and maintain our platform
Ensure security and prevent fraud
Comply with legal obligations

4. Data Storage and Security

Your data is stored securely using industry-standard practices. Personal information is encrypted at rest. We use secure cloud infrastructure with access controls, and all data transmissions are encrypted using TLS. Files and documents are stored in encrypted object storage (MinIO) and are accessible only through authenticated, time-limited presigned URLs.

5. Your Rights Under the Privacy Act 2020

Under the New Zealand Privacy Act 2020 and the Privacy Principles (IPPs), you have the right to:

Access your personal information held by us
Request correction of inaccurate information
Request deletion of your information (subject to legal retention requirements)
Know who we share your information with and why
Complain to the Privacy Commissioner if you believe your privacy has been breached

6. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

Service Providers: With trusted third parties who assist in operating our platform (e.g., email delivery, payment processing), bound by confidentiality agreements.
Legal Requirements: When required by law, court order, or regulatory authority.
With Your Consent: When you have explicitly consented to the sharing.

7. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party tracking cookies, advertising cookies, or analytics that profile users. Our platform does not embed social media tracking pixels or share browsing data with advertisers.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Upon account deletion, we remove or anonymise your personal data within 30 days, except where retention is required by law. Document generation records may be retained for longer periods as required by applicable regulations.

9. Children’s Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

10. International Transfers

Your data is primarily stored and processed in New Zealand/Aotearoa. In the event data is processed outside of New Zealand, we ensure appropriate safeguards are in place in accordance with the Privacy Act 2020.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will notify you through the platform and update the “Last updated” date. Continued use of the platform after changes constitutes acceptance of the updated policy. For significant changes, you will be prompted to acknowledge and accept the updated policy before continuing to use the service.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us.