Privacy Policy
1. What we collect
Depending on how you interact with us, we may collect:
- Contact details – name, email address, phone number, business name and address.
- Identity and verification information – copies of passport or driver licence, date of birth, proof of address, and information about company directors, shareholders, trustees and beneficial owners, as required under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act).
- Financial and tax information – IRD numbers, bank statements, invoices, payroll records, accounting software data (including Xero), prior financial statements and tax returns.
- Website information – enquiries submitted through our contact form, and technical data such as IP address, browser type and pages visited, collected through analytics and security tools.
We collect most of this information directly from you. We may also collect it from Inland Revenue (with your authority as your tax agent), your bank or software providers (where you have connected them), the Companies Office and other public registers, your previous accountant, or other parties you have authorised.
2. Why we collect it
We use personal information to:
- Provide accounting, taxation, bookkeeping, Xero and advisory services you have engaged us for.
- Act as your registered tax agent with Inland Revenue and file returns on your behalf.
- Meet our legal obligations, including under the Tax Administration Act 1994, the AML/CFT Act and the rules of Chartered Accountants Australia and New Zealand (CA ANZ).
- Respond to enquiries, manage our relationship with you, and issue invoices.
- Protect the security of our website and systems, including preventing spam and abuse.
- Send occasional updates about tax changes or our services, which you can opt out of at any time.
3. Who we share it with
We do not sell personal information. We share it only where necessary to deliver our services or where the law requires, including with:
- Inland Revenue, the Companies Office and other government agencies.
- Software and cloud providers we use to run our practice, such as Xero, document storage, email and practice-management tools. Some providers store data outside New Zealand (commonly Australia or the United States). We only use providers that apply comparable safeguards to those required by New Zealand law.
- Your bank, lawyer, financial adviser or other professionals, where you ask us to.
- Our professional body, insurers or legal advisers where required for quality review, complaints or claims.
- Regulators or law enforcement where we are legally obliged to, including suspicious activity reporting under the AML/CFT Act.
4. How we protect it
We take reasonable steps to keep personal information secure against loss, unauthorised access, use or disclosure. This includes two-factor authentication on our systems, encrypted cloud storage, restricted access within our team, and secure document portals rather than email attachments for sensitive files wherever practical. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
5. How long we keep it
Tax law requires us to retain business and tax records for at least seven years after the end of the relevant tax year. AML/CFT records are kept for at least five years after the relationship ends. We hold website enquiry details only as long as needed to respond and, if you become a client, for the life of the engagement. After these periods we securely delete or de-identify the information.
6. Cookies and analytics
Our website may use analytics tools (such as Google Analytics or Microsoft Clarity) to understand how visitors use the site. These tools use cookies and collect information such as pages visited, device type and approximate location. They do not identify you personally. Our contact form uses technical measures, and may use Cloudflare Turnstile, to block automated spam. You can disable cookies in your browser settings.
7. Your rights
Under the Privacy Act you may ask us to confirm whether we hold personal information about you, to give you access to it, and to correct it if it is wrong. To make a request, email us at zn.oc.acnb@olleh. We will respond within 20 working days. We may need to verify your identity first, and in limited circumstances the Act allows us to withhold information, in which case we will tell you why.
8. Complaints
If you have concerns about how we have handled your personal information, please contact us first so we can try to resolve it. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
9. Changes to this policy
We may update this policy from time to time. The current version will always be published on this page with the date it was last updated.
10. Contact
BNCA Limited
Kingsland, Auckland, New Zealand
zn.oc.acnb@olleh