Last updated June 2023
We may review and revise this policy from time to time, and may notify you about any changes to it by uploading a revised version on our website. Any changes will apply from the time we upload the revised policy.
We take the protection of your privacy and confidentiality seriously. We understand that all visitors to our website are entitled to know that their personal data will not be used for any purpose unintended by them, and will not accidentally fall into the hands of a third party.
We undertake to preserve the confidentiality of all information you provide to us.
The law requires us to tell you about your rights and our obligations to you regarding the processing and control of your personal data. To comply with this law, we therefore request that you read the information provided at www.knowyourprivacyrights.org.
Except as set out below, we do not share, sell, or disclose to a third party, any information collected through our website.
The types of personal information we collect depends on the nature of your interaction with us, and may include:
When you become (or apply to become) a customer, we collect a range of information to assess your application and manage your account(s). This may include:
If you choose not to provide any of this information to us, we may not be able to provide our products or services to you (or only provide them to you on a limited or restricted basis).
We also collect information about the way you use our products and services. This includes information about:
We collect information directly from you (where possible) and indirectly from our related companies, agents, service providers and other third parties. We may collect this information:
When you apply to become our customer, we may ask you to consent to us collecting information from particular third parties. We will only collect personal information from those parties if you consent. If you do not consent, we may not be able to provide the product or service you require. In some cases, we may be authorised to collect some personal information from third parties by law.
We also handle any unsolicited personal information we receive from you in accordance with our obligations under the Act.
We use personal information for a variety of legitimate business purposes, including:
We may disclose personal information to our related companies, and to a range of third party agents, service providers and partners who we engage in relation to our products and services. These may include:
We may also disclose personal information to:
Some of the businesses that support our products and services may be located overseas, which means your personal information may be transferred to, or accessed from, countries other than New Zealand. We take reasonable steps to ensure that we only disclose personal information to an overseas person or entity if we believe, on reasonable grounds, that the overseas recipient is subject to privacy laws (or is otherwise required to protect the information in a way) that, overall, provide(s) comparable safeguards to those in the Act. The Act also provides other limited grounds for us to disclose personal information overseas.
We recognise the importance of protecting your personal information, and ensuring that it is complete, accurate, up-to-date and relevant.
When you call us in relation to your account or service, we complete an ID check to verify your identity and to check the details we hold about you are correct and to update them if required. For some safety critical information (e.g. medical information required to maintain secure power supply or ensure priority assistance) we initiate checks on a regular basis.
We have processes for verifying personal information collected for particular transactions, such as proof of occupancy, change of occupier and priority assistance. Our staff are trained to properly handle the different types of information they receive, particularly sensitive information. We have quality assurance measures in place to monitor calls to ensure that our processes are being followed.
While some of the personal information we collect is held in hardcopy form, most personal information is stored in electronic databases.
We have extensive security safeguards in place to ensure that our information systems and files are protected from loss, unauthorised access, use, modification or disclosure, or other misuse. We also have documented procedures governing our response in the event of an actual or suspected privacy breach.
In the event of a data breach, Orcacom is required to notify it Customers without undue delay after becoming aware of the breach. We are also required to cooperate with our customers to investigate and remediate the breach, cooperate with any supervisory authorities and law enforcement, and assist with any notifications as required.
You have the right to request access to your readily retrievable personal information and to request a correction to your personal information. Before you exercise this right, we will need evidence to confirm that you are the individual the personal information relates to.
We generally respond to access/correction requests within 20 working days but will let you know if we expect the process to take longer than that. If we have justifiable grounds under the Act for refusing your request, we will tell you what those grounds are. For correction requests, if we think the correction is reasonable and we are reasonably able to change the personal information, we will make the correction. If we do not make the correction, we will take reasonable steps to note on the personal information that you requested the correction.
We may charge you our reasonable costs of providing you copies of your personal information or correcting that information.
Except as otherwise mentioned in this privacy notice, we keep your personal information only for as long as required by us:
to provide you with the services you have requested;
to comply with other laws, including for the period demanded by tax authorities (this will typically be a period of 7 years);
to support a claim or defence in court.
If you have not purchased or otherwise used any of our services, your personal information may be deleted by deleting your account.
All of OrcaCom's customer data and infrastructure is hosted and based in New Zealand, primarily at our data centres in Auckland. This includes our databases, web services and payment systems. All backups are also hosted in New Zealand so personal customer data will not be transferred overseas. OrcaCom also operate a voice proxy service in Australia - so some phone specific data may be transferred to this facility as required, however this does not include account information or personal data but rather only data required for phone connectivity and authentication.
For any services that OrcaCom offers that originate overseas such as the provision of International phone numbers (such as UK and United States phone numbers for example), then OrcaCom may be required to transfer customer data outside of New Zealand at the request of the authorities in those juristictions such as the USA, UK and European Economic Area (the “EEA”). In order to fulfill our contractual obligations to you, we may transfer, and share your information in any country in which OrcaCom or its affiliates, subsidiaries, suppliers or agents maintain these facilities. Information collected within the EEA may, for example, be transferred to and processed in a country outside of the EEA which may not provide the same level of protection for personal data as within the EEA. By using our International Products and Services, you consent to any such transfer of your information outside your country.
As part of the service, we may send you messages relating to your account and the services you are using, such as invoices, payment receipts, low balance alerts, technical notifications and other issues. These messages comprise a mandatory part of the services. If you wish to stop them, you must cancel your services. When you contact us, whether by telephone, through our website or by email, we collect the data you have given to us in order to reply with the information you need. We record your request and our reply in order to increase the efficiency of our business. We keep personally identifiable information associated with your message, such as your name and email address so as to be able to track our communications with you to provide a high quality service. If you contact our sales or support teams, we will respond to your communications by means of live chat, email or telephone. We may contact you from time to time to keep you up to date with news about our services, including new products, campaigns, promotions and payment methods. You can stop receiving promotional messages by following the instructions included in such messages.
While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is at your own risk.
If you post your personal information on a public area of our websites or social media pages, you acknowledge and agree that the information you post is publicly available.
We may also use:
When you are signing up to products or services on our digital platforms and add items to your cart, we may store this data locally in your browser’s local storage. This is used both to help complete the transaction and, in some cases, to allow you to resume your order where you had left off. This data may include the item(s) you had added to your cart and any selections you have made during the sign-up process. It can also be used for remarketing activity, which might include contacting you with a specific offer, offering assistance to complete our sign-up process, or to allow us to target specific digital advertising to you on other websites you visit.
If you are dissatisfied with our Privacy Notice or if you have any complaint, then you should inform us by email at firstname.lastname@example.org
If a dispute is not settled, then we hope you will agree to attempt to resolve it by engaging in good faith with us in a process of mediation or arbitration.
If you are in any way dissatisfied about how we process your personal information, you have a right to lodge a complaint with the Data Protection Commissioner.