Privacy Policy

Crestwell Private Office Limited (we, us, our) complies with the New Zealand Privacy Act 2020 (the Act) when dealing with personal information. Personal information is information about an identifiable individual (a natural person). This policy sets out how we collect, use, disclose, and protect your personal information. This policy does not limit or exclude any of your rights under the Act. If you wish to seek further information on the Act, you can contact our Privacy Officer at privacy@crestwell.co.nz or visit privacy.org.nz.

We may change this policy by uploading a revised policy onto this website. The change will apply from the date that we upload the revised policy.

Personal information is information about an identifiable individual. Depending on how you interact with us and the work, if any, we agree to do together, it may include your name, address, contact details, date of birth, occupation, payment details, employment information, financial information, feedback, evidence of source of funds or source of wealth where relevant, and other information you provide or we are permitted to collect. Website-use information may also be collected through cookies or similar technologies.

Where we collect your personal information from someone other than you, we will take reasonable steps to notify you that we have collected your information, the purpose of collection, the intended recipients, the name and address of the agency collecting and holding the information, whether collection is authorised or required by law and, if so, the relevant law, and your right to access and request correction of the information, unless an exception applies under the Privacy Act 2020. Depending on the work you authorise, this information may come from product providers, professional advisers, publicly available sources, or other relevant parties.

• to verify your identity where this is reasonably required for an enquiry, agreed service, or legal obligation;
• to respond to communications from you, including an enquiry, request, concern, or complaint;
• to provide services and information that you ask us to provide, including arranging a first conversation or carrying out agreed work;
• to meet applicable legal, regulatory, compliance, record-keeping, and risk-management obligations;
• to improve the services and information that we provide, and to maintain and protect our website and systems;
• to contact you electronically about information you have asked to receive or services that are relevant to an agreed relationship, where permitted by law;
• to protect and/or enforce our legal rights and interests, including defending any claim; and
• for any other purpose authorised by you or the Act.

We do not sell your personal information. We may disclose your personal information to the following parties where reasonably necessary for the purpose for which it was collected, where you authorise us to do so, or where disclosure is permitted or required by law:

• other companies or individuals who assist us in providing services or performing functions on our behalf, including website hosting, data storage, owner-notification, communications, security, specialist-consultant, and legal-adviser providers;
• product providers, such as lenders, insurers, investment providers, or KiwiSaver providers, where this is relevant to work you have authorised;
• financial advisers, financial advice providers, accountants, lawyers, tax advisers, or other specialist advisers where you ask us to coordinate with them or their input is relevant;
• other companies or individuals who perform compliance reviews, audits, identity checks, or other checks that are necessary or desirable under the law or for an agreed service;
• courts, tribunals, regulatory authorities, government agencies, dispute-resolution bodies, or any person or agency we believe could assist in responding to a serious privacy breach; and
• anyone else to whom you authorise us to disclose it.

We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse. Access to personal information is limited to the people and service providers who need it for the purposes described in this policy. Crestwell’s current website contact form is hosted within the Manus application, where enquiries are validated, stored in the project database, and an owner notification is generated. We cannot guarantee the security of information transmitted over the internet, but we take reasonable steps to maintain secure website connections and business processes.

We will retain personal information only for as long as it is required for the purposes for which it may lawfully be used, including applicable legal, regulatory, compliance, dispute, and record-keeping requirements. Crestwell currently uses Manus-managed website hosting, contact-enquiry database storage, and owner-notification functionality. Service providers used to support our systems may process information in or from locations outside New Zealand. Where this is relevant, we will take reasonable steps to ensure the information is handled in a manner consistent with the Privacy Act 2020 and this policy.

Subject to certain grounds for refusal set out in the Act, you have the right to access readily retrievable personal information that we hold and to request a correction to your personal information. Before you exercise this right, we may need evidence to confirm that you are the individual to whom the information relates. If we think a requested correction is reasonable and we are reasonably able to make it, we will do so. If we do not make a correction, we will take reasonable steps to note the correction you requested. To make a request, email privacy@crestwell.co.nz with evidence of who you are and the details of the information or correction you are requesting.

Our Privacy Officer has processes to respond to a privacy breach. If a breach occurs, we will promptly identify, contain, assess, and examine it. Where a breach is notifiable under the Privacy Act 2020, we will notify affected people and the Office of the Privacy Commissioner as required.

While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is at your own risk. If you follow a link on our website to another site, the owner of that site will have its own privacy policy. We suggest you review that policy before you provide personal information. Our website uses cookies and similar technologies to monitor website use, understand key journeys, and improve the site. Crestwell currently uses lightweight, non-identifying event tracking; we do not intentionally include enquiry-message content in those events. You may disable cookies by changing your browser settings, although this may mean that you cannot use all website features. Our booking path uses Calendly, which has its own privacy practices. We may also use third-party suppliers to monitor website or system use for security and operational purposes; those suppliers may have access to relevant monitoring and logging information.