1. WHO THIS POLICY APPLIES TO

1.1 This policy applies to personal information about our customers and their staff, people who use services we supply (such as members of a customer's household or guests using a customer's Wi-Fi), visitors to our website, our suppliers and contractors, and job applicants.

1.2 "Personal information" means information about an identifiable individual, as defined in the Privacy Act 2020. It does not include information about a company or organisation, except where that information is also about an individual.

1.3 This policy forms part of our Customer Terms, available at silverservice.co.nz/terms-and-conditions/.

2. THE PERSONAL INFORMATION WE COLLECT

2.1 Depending on the services you use, we may collect:

(a) Contact and identity information: your name, position, business name, phone numbers, email addresses, and physical and postal addresses;

(b) Account and billing information: service and installation addresses, account numbers, invoices, payment history, and the bank account details you provide for direct debit;

(c) Service and technical information: the services and equipment you have, router and device details, IP addresses, connection identifiers (such as ONT serial numbers), configuration settings, fault and support records, and the logins or access details you give us to provide the services;

(d) Broadband and voice information: usage data, connection logs, phone numbers, information about your previous provider needed to port numbers, and call records (numbers called, date, time and duration), which we need for billing, fault resolution and fraud prevention;

(e) Domain registration information: registrant names and contact details, which the domain name registry rules require us to collect;

(f) Communications: emails, messages, notes of phone calls and, where we tell you in advance, call recordings;

(g) Website information: the time of your visit, your IP address, browser type and the pages you view, collected through server logs and cookies; and

(h) Supplier and job applicant information: contact details, CVs, qualifications and referee details.

2.2 We do not ask for sensitive information, such as health, religious or ethnic information, unless it is needed for a specific reason. For example, if a member of your household depends on a landline to call 111 for medical reasons, you may choose to tell us so that we can help. We only collect this with your agreement.

3. HOW WE COLLECT IT

3.1 We collect most personal information directly from you when you sign a Service Agreement, ask for a quote, contact us, use our services or visit our website.

3.2 We also collect some information from other sources, including:

(a) your employer or organisation, where it sets you up as a user or contact on its account;

(b) our wholesale network partner and your local fibre company, which provide connection, usage and fault information about your broadband and voice services;

(c) your previous telecommunications provider, when your numbers or services are transferred to us; and

(d) our domain registrar and the domain name registries.

3.3 When we collect personal information about you from someone else, we will take reasonable steps to let you know, as required by information privacy principle 3A of the Privacy Act 2020, unless an exception applies. In many cases, this Privacy Policy provides that information. Where an organisation gives us information about its staff or users, we rely on it to tell those people about this policy.

3.4 When we work on your devices, systems or hosted accounts, our technicians may see personal information stored on them, including information about other people. We only access what we need to carry out the work, and we treat everything we see as confidential.

4. HOW WE USE YOUR INFORMATION

4.1 We use personal information to:

(a) provide, install, support, maintain and repair the services and equipment you request;

(b) set up and manage your account, and process orders, connections, number ports and domain registrations;

(c) invoice you and collect payments, including by direct debit;

(d) diagnose and resolve faults, and monitor our network and systems for security and performance;

(e) detect and prevent fraud, misuse of our services and breaches of our Customer Terms;

(f) communicate with you about your services, including planned maintenance, changes to our terms and pricing, and renewal reminders;

(g) tell you about other SSIT products and services that may interest you, unless you ask us not to;

(h) improve our services, using information that has been combined and de-identified where possible;

(i) assess job applications and manage our suppliers; and

(j) comply with our legal obligations.

4.2 We do not use automated decision-making or profiling that has legal or similarly significant effects on you.

5. WHO WE SHARE IT WITH

5.1 We do not sell, rent or trade your personal information. We share it only where necessary for the purposes in section 4, with:

(a) our wholesale network partner and other carriers, to provide, maintain and bill broadband and voice services;

(b) local fibre companies, such as Tuatahi First Fibre, to arrange installations, connections and fault repairs at your premises;

(c) your previous or next telecommunications provider, to transfer services and port numbers at your request;

(d) our domain registrar, Dreamscape Networks, and the relevant domain name registries, to register and manage domain names. Some registrant details may be published in public domain lookup services, in line with each registry's rules;

(e) technology suppliers that help us run our business, such as accounting, payment, email, cloud storage and remote support providers, who may only use the information to provide services to us;

(f) manufacturers and distributors, to process warranty claims on Goods we supply to you;

(g) our professional advisers, insurers and, where an account remains unpaid, a debt collection agency; and

(h) government agencies, the Police, courts and other authorities, where we are required or permitted by law to do so, including under the Telecommunications (Interception Capability and Security) Act 2013, or where necessary to prevent or lessen a serious threat to someone's life, health or safety.

5.2 We require our suppliers to protect personal information and use it only for the purpose for which we provided it.

5.3 We do not carry out credit checks and do not share your information with credit reporting agencies.

6. BROADBAND AND VOICE INFORMATION

6.1 When we supply broadband or voice services, we are a telecommunications agency for the purposes of the Telecommunications Information Privacy Code 2020. The Code sets additional rules for information such as call records, connection logs and location information.

6.2 We use call records and connection information only for billing, fault resolution, network management, fraud prevention and the other purposes permitted by the Code. We disclose them only as permitted by the Code or required by law.

6.3 We do not list your phone numbers in any public directory without your agreement.

6.4 We do not monitor the content of your internet traffic or calls. We and our suppliers may monitor network usage, bandwidth and transmissions to operate the services and protect our network, as described in our Customer Terms.

7. HOW WE STORE AND PROTECT IT

7.1 We take reasonable steps to protect personal information from loss, unauthorised access, use, modification and disclosure. These steps include access controls and multi-factor authentication on our systems, encryption where appropriate, restricting access to staff who need it, and secure disposal of devices and media.

7.2 Every website and email hosting account is backed up daily, with daily backups kept for 14 days, and monthly backups taken on the 1st of each month kept for 3 months. Backups are stored off-site and are overwritten after these periods.

7.3 If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as required by the Privacy Act 2020.

8. SENDING INFORMATION OVERSEAS

8.1 Some of our suppliers store or process information outside New Zealand. For example, our domain registrar operates from Australia, and cloud software we use may store data in Australia, the United States or other countries.

8.2 Where we disclose personal information to an organisation overseas, we will do so only in accordance with information privacy principle 12 of the Privacy Act 2020, which requires the recipient to be subject to comparable privacy safeguards, or to have agreed to protect the information in a way that provides comparable safeguards.

9. HOW LONG WE KEEP IT

9.1 We keep personal information only for as long as we need it for the purposes in section 4, or as required by law. For example, we keep invoices and accounting records for 7 years to meet our tax obligations.

9.2 When we no longer need personal information, we securely delete or destroy it. Devices left with us are securely erased before disposal.

10. ACCESSING AND CORRECTING YOUR INFORMATION

10.1 You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if you believe it is wrong.

10.2 To make a request, contact our Privacy Officer using the details in section 14. We will need to verify your identity before releasing or changing any information.

10.3 We will respond as soon as reasonably practicable, and no later than 20 working days after receiving your request. We do not charge for access or correction requests.

10.4 If we decline a request, we will explain why. If we decline to correct information, you may ask us to attach a statement of the correction you requested to your information.

11. MARKETING, COOKIES AND OUR WEBSITE

11.1 We send marketing emails only in line with the Unsolicited Electronic Messages Act 2007. Every marketing email includes a simple way to unsubscribe, and you can also ask us at any time to stop sending you marketing. We will still send you messages about your services, accounts and invoices.

11.2 Our website uses cookies to make it work properly and to help us understand how it is used. You can block or delete cookies in your browser settings, although some parts of the website may then not work as intended.

11.3 Our website may link to other websites. We are not responsible for the content or privacy practices of those websites.

12. INFORMATION FOR PEOPLE IN THE EUROPEAN UNION OR UNITED KINGDOM

12.1 This section replaces our previous GDPR Statement. It applies if you are located in the European Union, the European Economic Area or the United Kingdom, and we collect your personal information in connection with offering services to you or monitoring your behaviour there, so that the EU General Data Protection Regulation or UK GDPR applies.

12.2 Our legal bases: We process your personal information where it is necessary to perform our contract with you, to comply with a legal obligation, for our legitimate interests in running and improving our business (where those interests are not overridden by your rights), or with your consent, which you may withdraw at any time.

12.3 Your rights: Subject to verification of your identity and to certain legal exceptions, you have the right to:

(a) access your personal information and receive information about how it is processed;

(b) have inaccurate information corrected;

(c) have your information deleted when it is no longer needed, or where you withdraw consent, subject to our legal obligations to keep records;

(d) restrict our processing of your information in certain circumstances;

(e) receive your information in a structured, commonly used and machine-readable format, or have it transferred to another organisation;

(f) object to processing based on our legitimate interests, and to direct marketing at any time; and

(g) lodge a complaint with the data protection authority in the country where you live or work.

12.4 Processing for business customers: Where we process personal information on behalf of a business customer, for example when supporting its systems or hosting its email, we act on that customer's instructions under our Service Agreement, and the customer is responsible for having a lawful basis for the processing. We will agree specific data processing terms with a business customer on request.

12.5 Transfers: The European Commission has recognised New Zealand as providing an adequate level of protection for personal data. Where we transfer information onward from New Zealand, we use the safeguards described in section 8.

12.6 To exercise these rights, contact our Privacy Officer using the details in section 14.

13. CHILDREN

13.1 Our services are intended for adults and businesses. We do not knowingly collect personal information directly from children. Residential customers are responsible for the use of their services by members of their household, as set out in our Customer Terms.

14. CONTACT US AND COMPLAINTS

14.1 If you have a question or concern about privacy, or wish to make a request under this policy, please contact our Privacy Officer:

Antoon Moonen, Director and Privacy Officer
Silver Service IT Limited
PO Box 137, Tauranga 3144
admin@silverservice.co.nz
(07) 262 1000

14.2 We will acknowledge a privacy complaint within 2 working days and aim to resolve it within 20 working days.

14.3 If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

15. CHANGES TO THIS POLICY

15.1 We may update this Privacy Policy from time to time. The current version will always be available at silverservice.co.nz/privacy-policy/, showing the date it was last updated. Where a change materially affects how we handle your personal information, we will let our customers know by email.