Privacy Statement

NanoTech IT Ltd
Version: 2.0
Effective date: 13 September 2026
Last reviewed: 13 September 2026

1. Our commitment to privacy

NanoTech IT Ltd (“NanoTech IT”, “we”, “us” or “our”) respects the privacy of the individuals, clients, organisations and communities we work with.

We are committed to collecting, using, storing and protecting personal information responsibly, transparently and securely.

This Privacy Statement explains how NanoTech IT handles personal information when you interact with us through our websites, online tools and assessments, enquiries, consultations, cybersecurity services, managed services, professional services and other business activities.

Our handling of personal information is governed primarily by the Privacy Act 2020, including the Information Privacy Principles (IPPs), as amended from time to time.

Where another New Zealand privacy code or legal requirement applies to particular information or services, we will also apply those requirements as appropriate.

Our information security practices are informed by recognised New Zealand and international cybersecurity guidance, including the New Zealand Information Security Manual (NZISM), National Cyber Security Centre (NCSC) guidance and other security frameworks appropriate to the services we provide.

2. What is personal information?

Personal information is information about an identifiable individual.

Depending on your relationship with NanoTech IT, this may include your name, email address, telephone number, job title, organisation, billing or transaction details, correspondence with us, service and support information, information supplied through assessments or forms, and other information reasonably necessary for us to provide our services.

Technical information may also constitute personal information where it can reasonably be connected with an identifiable individual. This may include IP addresses, device information, browser information, log information and other online identifiers.

We aim to collect only the personal information reasonably necessary for a lawful business purpose.

3. How we collect personal information

We may collect personal information directly from you when you contact us, complete a website form, request a quote, book a consultation, undertake an online assessment, subscribe to communications, purchase or use a service, communicate with our team, or otherwise interact with NanoTech IT.

We may also automatically collect limited technical information when you access our websites or online services, including information necessary for website functionality, security, troubleshooting and analytics.

Where practical, we collect personal information directly from the individual concerned.

4. Information collected from other sources

In some circumstances NanoTech IT may receive personal information about you from another source.

This may include information supplied by your employer or organisation, an authorised representative, an existing client, a business referral, a professional adviser, a service provider, a publicly available source, a cybersecurity or technology platform, or another party involved in providing or supporting a service.

Where the Privacy Act requires us to do so, we will take reasonable steps to make you aware that the information has been collected, the purposes for which we collected it, the intended recipients, who is collecting and holding it, and your rights to request access to and correction of the information.

We will normally do this as soon as reasonably practicable after collecting the information unless an exception under the Privacy Act applies.

5. Why we collect and use personal information

NanoTech IT may use personal information to communicate with you; respond to enquiries; prepare proposals, quotations and agreements; deliver IT, cybersecurity, governance, advisory, software, assessment and related services; provide technical or client support; administer client relationships; process transactions and maintain financial records; generate requested assessments, reports or recommendations; manage security risks; detect or investigate misuse, fraud or cybersecurity incidents; maintain and improve our websites and services; meet contractual, regulatory and legal obligations; and protect NanoTech IT, our clients and other affected parties.

We will not use personal information for a materially different purpose unless that use is permitted by law or we have obtained appropriate authorisation.

6. Information handled on behalf of clients

As an IT, cybersecurity and advisory services provider, NanoTech IT may sometimes access or process personal information held by a client as part of delivering an agreed service.

Where we process information solely on behalf of a client, we will handle that information according to our contractual obligations, the client’s authorised instructions, applicable privacy requirements and appropriate information security controls.

Access to client information is limited to what is reasonably necessary to perform the authorised service.

7. Website information, cookies and analytics

Our websites and online services may use cookies and similar technologies required to provide website functionality, maintain security, remember preferences and understand how our digital services are being used.

We may use aggregated or analytical information to improve website performance, understand visitor interactions and improve our services.

Where third-party analytics or similar services process personal information, we will take reasonable steps to ensure that their use is appropriate and consistent with our privacy obligations.

You can control or disable many cookies through your browser settings. Disabling some cookies may affect the functionality of parts of our websites.

8. Artificial intelligence and automated technologies

NanoTech IT may use approved artificial intelligence or automated technologies to support appropriate business, cybersecurity, analytical or administrative activities.

Where personal information is processed using an AI-enabled service, the Privacy Act continues to apply.

We will consider the purpose of the processing, the information involved, privacy and security risks, access controls, third-party processing arrangements and the appropriateness of the technology before using personal information in an AI-assisted workflow.

The use of AI does not remove NanoTech IT’s responsibility for protecting personal information or complying with applicable privacy requirements.

9. When we may share personal information

NanoTech IT does not sell personal information.

We may disclose personal information where reasonably necessary to provide an authorised service, including to technology, cloud, hosting, communications, security, accounting, payment, professional or other service providers supporting our operations.

We may also disclose information where you have authorised us to do so, where disclosure is required or permitted by law, where necessary to enforce or administer an agreement, or where reasonably necessary to prevent or respond to fraud, cybersecurity incidents, serious threats or other circumstances permitted by the Privacy Act.

We take reasonable steps to ensure third parties handling personal information on our behalf apply appropriate privacy and security protections.

10. Overseas processing and disclosure

Some technology and cloud service providers used by NanoTech IT may store or process information outside New Zealand.

Where personal information is disclosed to an overseas person or organisation in circumstances covered by Information Privacy Principle 12, we will take reasonable steps to ensure the disclosure complies with the Privacy Act 2020.

This may include establishing that the overseas recipient is subject to comparable privacy safeguards, is subject to the New Zealand Privacy Act, or is contractually required to provide appropriate privacy protections.

Where an overseas disclosure requires your express authorisation because comparable safeguards may not apply, we will provide the information required by the Privacy Act before seeking that authorisation.

11. How we protect personal information

Protecting information is fundamental to the services NanoTech IT provides.

We use security safeguards that are reasonable and appropriate to the nature, sensitivity and risk associated with the information we hold.

These safeguards may include identity and access controls, multi-factor authentication, least-privilege access, encryption where appropriate, secure configuration, vulnerability and patch management, logging and monitoring, endpoint and network protection, backup and recovery controls, staff security practices, incident response processes and supplier security assessment.

No technology environment can be guaranteed to be completely secure. We therefore apply a risk-based and continuous-improvement approach to information security.

12. Privacy and security incidents

NanoTech IT maintains processes for identifying, assessing, containing and responding to suspected privacy and security incidents.

If a privacy breach is reasonably believed to have caused, or be likely to cause, serious harm to an affected individual, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

Notifications will be made as soon as practicable once the applicable notification threshold has been identified, subject to any lawful exception or permitted delay.

13. How long we keep personal information

We will not retain personal information for longer than it is required for the purposes for which it may lawfully be used.

Retention periods vary depending on the type of information, the service provided, contractual requirements, security requirements and applicable legal or financial record-keeping obligations.

When personal information is no longer reasonably required, we will take appropriate steps to securely delete, destroy or de-identify it.

14. Accessing and correcting your personal information

Under the Privacy Act 2020, you have the right to request access to personal information that NanoTech IT holds about you and to request correction of that information where you believe it is inaccurate.

We may need to verify your identity before providing access to personal information.

In some circumstances the Privacy Act permits or requires us to withhold information. If we cannot provide information you have requested, we will explain our decision where required by law.

You may also ask us to delete personal information. While New Zealand privacy law does not provide an unrestricted right to erasure in all circumstances, we will consider such requests and will delete or de-identify information where we no longer have a lawful or legitimate reason to retain it.

15. Marketing communications

We may send information about NanoTech IT services, cybersecurity information, events or other business communications where this is permitted under New Zealand law.

Commercial electronic messages will be managed in accordance with the Unsolicited Electronic Messages Act 2007.

Where required, we will obtain or rely upon appropriate consent, clearly identify NanoTech IT as the sender and provide an effective way to unsubscribe.

You may ask us to stop sending marketing communications at any time.

Operational, contractual, security or service-related communications may still be sent where they are necessary for an existing relationship or service.

16. Applicable privacy codes

Certain information may be subject to additional New Zealand privacy codes issued under the Privacy Act.

Where a New Zealand privacy code applies to information or processing undertaken by NanoTech IT, we will comply with the applicable requirements of that code, including where relevant the Health Information Privacy Code 2020, Biometric Processing Privacy Code 2025, and other codes issued under the Privacy Act 2020.

17. Privacy Officer

NanoTech IT maintains a Privacy Officer function in accordance with the Privacy Act 2020.

For questions about this Privacy Statement, requests to access or correct personal information, privacy concerns, or complaints, please contact:

Privacy Officer
NanoTech IT Ltd
Aotearoa New Zealand
Email: contact@nanotechit.co.nz
Phone: 0800 210 013

Please do not send passwords, authentication codes, private keys or other security credentials when making a privacy enquiry.

18. Privacy complaints

If you believe NanoTech IT has not handled your personal information appropriately, please contact our Privacy Officer first so we have an opportunity to investigate and resolve the matter.

If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner | Te Mana Mātāpono Matatapu.

19. Changes to this Privacy Statement

We may update this Privacy Statement where our services, technology, suppliers, legal obligations or privacy practices change.

The current version will be published on our website with its effective date and review date.

We intend to review this statement periodically and following any significant change affecting the way NanoTech IT collects, uses, stores or discloses personal information.