This privacy policy sets out how Johnston Associates Chartered Accountants Limited uses and protects any information that you give Johnston Associates when you use this website or their Services.

Johnston Associates Chartered Accountants Limited (the “Company”) is committed to protecting the privacy of its users in accordance with the Privacy Act 2020 (“Privacy Act”). This Privacy Policy (“Privacy Policy”) is designed to help you understand what information we gather, how we use it, what we do to protect it, and to assist you in making informed decisions when using our Services. This Privacy Policy applies to all of our related and independent member entities, any website that references this Privacy Policy, any Company website, as well as any data the Company may collect.

For purposes of this Privacy Policy, “Services” refer to the Company’s accountancy and related services and our website at www.jacal.co.nz. The terms “we,” “us,” and “our” refer to the Company. “You” refers to you, as a user of our Services.

Consent
By accessing and using our website or our Services, you accept our Privacy Policy and Terms of Use, and consent to the collection, use, storage and disclosure of your personal information in accordance with this Privacy Policy. Each time you visit our website, or use our Services, and any time you voluntarily provide us with information, you agree that you are consenting to our collection, use and disclosure of the information that you provide, and you are consenting to receive emails or otherwise be contacted, as described in this Privacy Policy.

If you do not consent, then we may not be able to answer your enquiry, complete the transaction you have entered into or provide the Services you have engaged us to provide.

What personal information will we collect and hold?
The kinds of personal information we collect from you or about you depend on the transaction you have entered into with us, the services you or your organisation have contracted us to provide, and the services you or your organisation are interested in.

We may collect personal information directly from you when you:

• register to use our Services on the website;
• engage us to provide the Services; or
• communicate or interact with us, whether by email, telephone or otherwise.

We may collect the following information from you:

• personal information, which is information about an identifiable individual such as your name, telephone number and email address; and
• aggregated information generated by our system, which tracks your use of our Services but does not identify you personally.

Generally, the types of personal information that we may collect and hold, will include individuals’ names, residential addresses, email addresses, phone numbers, banking details, dates of birth, investment details, payroll details, taxation details and other related accounting and financial services information. The information we collect also includes details of your communications and interactions with us in relation to our Services.

Collection
We aim to collect personal information only directly from you, unless it is unreasonable or impracticable to do so. For example, we may collect personal information from you or about you from correspondence that you submit to us, telephone calls and face-to-face meetings with us, emails, hardcopy forms, information you provide us through paper-based and electronic client surveys and from your activity on our website. In some instances, we may also receive personal information about you from third parties, such as associated businesses and / or government departments.

On all occasions, your personal information will be collected, held, used and disclosed by us in accordance with this Privacy Policy and the Privacy Act (or any replacement legislation).

Use of information
We use the personal information that we collect from you:

• to identity you, so we can ensure that your account is secure;
• to communicate with you;
• to provide Services to you or your organisation;
• for administrative purposes and accounting functions;
• to carry out credit checks and process your payments;
• to obtain product registrations and approvals;
• to answer your questions and deal with any issues regarding our Services;
• to provide you with information about other Services provided by us;
• for training purposes;
• to conduct market research and client satisfaction surveys;
• to comply with applicable laws and regulations; and
• for any related purpose in connection with the above.

We may also use your personal information for marketing and promotional activities, and for maintaining your online subscription/s to our newsletters. Where we use your personal information for marketing and promotional communications, you can opt-out at any time by following the unsubscribe link contained within our marketing communications.

We may use any information that we collect from you that is not personal information (so no individual can be personally identified from it) for our business purposes, including:

• to assess how our customers use our Services;
• to improve our Services; and
• for marketing and promotional purposes.

Disclosure of information
We generally do not share your personal information with others unless this is necessary for the purpose for which you gave us the information. While it is unlikely, we may be required to disclose your information to comply with legal or regulatory requirements. We will use reasonable endeavours to notify you before we do this, unless we are legally restricted from doing so.

From time to time, we may need to disclose your personal information to third party service providers, located both inside and outside New Zealand. For example, we may disclose your personal information to:

• Our professional advisors;
• Other Johnston Associates member firms or Johnston Associates International firms;
• Other CAANZ member firms;
• Our agents, contractors and external service providers;
• Law enforcement and Government agencies or regulatory bodies, as part of an engagement, (for example, the Inland Revenue Department).

Where we disclose your personal information to third party service providers, we will at all times remain accountable for their handling of that information. This includes taking steps to ensure that those recipients protect that information from unlawful access, modification or disclosure, and from misuse, interference and loss.

Your personal information is not disclosed to third parties for the use of allowing them to send marketing material to you. However, we may share non-personal, de-identified or aggregated information with them for research, data analytics or promotional purposes.

Storage of your personal information
Your personal information is held and stored on paper, by electronic means or both. Electronic means include, physical servers located on premises, servers maintained by cloud services providers, laptops, desktop computers, tablets and other mobile devices. We have physical, electronic and procedural safeguards in place for personal information and we take reasonable steps to ensure that your personal information is protected from misuse, interference, loss and unauthorised access, modification and disclosure.

For example, our IT systems feature password protections, firewalls, and intrusion detection and site monitoring functionalities. Data held and stored “in the cloud” is protected by internal and external firewalls, limited access via file passwords, files designated read-only or no access. We also require our IT contractors and other third parties to implement privacy safeguards. Further, our staff members receive regular training on our strict privacy and confidentiality procedures in relation to all personal information stored by us electronically and in printed form.

We take reasonable steps to ensure that the personal information that we collect is accurate and up-to-date and is stored in a secure environment protected from unauthorised access, use, modification or disclosure.

Destruction and De-identification
We will retain your personal information whilst it is required for our business functions or any other lawful purpose. We use secure methods to destroy or permanently de-identify your personal information when it is no longer needed.

Overseas Disclosure
Our business is affiliated with other businesses located overseas. In the course of doing business with you, we may disclose some of your personal information to overseas recipients. However, we will only do so where:

• it is necessary to complete the transaction you have entered into or for us to complete the services we are providing; and
• we use our best endeavours to ensure overseas providers comply with our data handling policies and procedures under the Privacy Act (or replacement legislation); or
• it is otherwise required by law.

Currently, we (and our network entities) may disclose personal information to overseas recipients located in Samoa, Australia, Singapore, Unites States, India, Indonesia, Malaysia, Philippines and the European Economic Area.

Access and Correction of Personal Information
If you have any questions regarding this Privacy Policy or the practices of this Site or wish to access or correction the personal information held about you, please contact our Privacy Officer (our Privacy Officer’s contact details are set out below).

We do not generally charge for requests to access your personal information. However, we may charge a fee:

• If an extended amount of time is required to locate, retrieve, collate and prepare any necessary materials; and
• in relation to any costs for the services of any intermediaries required to retrieve the information.

We will advise you of the estimated timeframe and costs (if any) in connection with any request for access to, or the correction of, your personal information.

To assist us to keep our records up-to-date, please notify our Privacy Officer of any changes to your personal information.

Reporting privacy breaches
We work hard to keep all personal information safe. However, despite applying strict security measures and following industry standards to protect personal information, there is still a possibility that our security could be breached. If you are aware of a privacy breach, where there is a loss or unauthorised access or disclosure of personal information, whether you think it is likely to cause serious harm, you must notify the Privacy Officer as soon as you become aware of the breach.

Cookies
Our website uses server logs and web analytic tools (such as “cookies”). Cookies are small text files that are downloaded to your device by websites that you visit. When you use our website, these tools collect information such as the browser and operating system that you use, the internet protocol address of the device you use to access the site, search terms, your location and the content that you view when visiting the website.

You can set your browser to block all cookies, including cookies associated with our website, or to indicate when a cookie is being set by us. If you set your browser to reject cookies you may not be able to access all the features of the website.

Google Analytics
We use Google Analytics to analyse our website usage and create reports for internal use only.

Like many services, Google Analytics uses first-party cookies to track visitor interactions. These cookies are used to store information, such as what time the current visit occurred, whether the visitor has been to the site before, and what site referred the visitor to the web page. Browsers do not share first-party cookies across domains. To find out more about how Google treats personal information, please see: The Google Privacy Policy.

Privacy Policy Updates
This Privacy Policy is not a static document. We may, from time to time, make changes and updates to this Privacy Policy. The most current and up-to-date Privacy Policy will always appear on our website. If you have any questions about our Privacy Policy or any changes to it, you can contact our Privacy Officer by email.

Privacy Officer Contact Details
Johnston Associates Chartered Accountants Limited
Level 1, One Jervois Rd, Ponsonby, Auckland 1011
Phone: 09 361 6701
Email: privacyofficer@jacal.co.nz

Privacy Commissioner
Level 8,109 – 111 Featherston Street
PO Box 10 094, The Terrace, Wellington 6143
Phone: 0800 803 909
Fax: 04 474 7595
Website: www.privacy.org.nz

Issued: 11 August 2023