Privacy statement

The Platform complies with the Privacy Act 2020. This statement does not limit or exclude any of your rights under the Privacy Act.

If you want further information on those rights visit:

privacy.org.nz(external link) — Office of the Privacy Commissioner

Shared services

The Platform is currently delivered via a ‘shared services’ approach. The approach enables a one-to-one contractual relationship between a Host Agency (MBIE), who is responsible for contracting, hosting and maintaining the Platform, and the primary service provider (Datacom), who builds, hosts and maintains the Platform on behalf of the Host Agency.

The Host Agency then delivers platform-related services to Government Service Providers (GSPs), such as local councils and other Government agencies. The GSPs own the services being enabled via the Platform, and are responsible and liable under the Privacy Act for the collection and processing of personal information as part of those services.

The Host Agency enforces rights and obligations via their contract with the primary service provider (for example in relation to the management of personal information) on behalf of the GSPs.

What personal information will be collected?

We collect personal information about you from information you provide us (for example on forms, applications, subscriptions, and accounts). You do not have to provide us with information but not providing information may affect the services you can be provided through the Platform and by GSPs.

Some information is required for us to provide you with any services (for example, a valid RealMe login and a New Zealand Business Number). If you do not want to provide the Platform with this information you do not have to but you will not be able to access services, and will have to contact the local or central government agency concerned directly.

Who is in control of your personal information?

Who is in control of your personal information depends on the type of personal information being processed and the nature of the services being delivered, as set out below: 

Business Customer Profile Data

This is the information you provide in order to create your Business Connect account, such as your name, contact details and NZBN data. The Host Agency is in control of this information, and will use it to manage your account and deliver Business Connect features to you. 

Unsubmitted Application Data

This is the information you upload as part of a specific application, including draft forms and required documents, before you submit your application. You are in control of this information. Neither the Host Agency nor GSPs will access the information or use it in any way, except where privileged access system administrators require access in order to provide production support.

Submitted Application and Case Data

This is the information that relates to a specific application that has been submitted to a GSP, including completed forms and required documents, and any correspondence between you and the GSP that takes place via the Platform. The relevant GSP is in control of this information, and will use it to manage and deliver the service (and in other ways outlined in the GSP’s privacy statement). 

Platform Usage Data

This is the information that relates to the way you have used and interacted with the Platform, and includes device data and cookie data. The Host Agency is in control of this information, and will use it to manage and deliver the Platform. For more information, see below at “What Platform Usage Data does the Host Agency collect?”. 

How is your personal information used?

Your personal information will generally only be used for the purpose you provided it (to provide you with a service). GSPs will use your personal information to manage and deliver the relevant service (and in other ways outlined in the GSP’s privacy statement). The Host Agency will use your personal information in the ways set out in this privacy statement. 

Both GSPs and the Host Agency may also use personal information for other reasons permitted under the Privacy Act but we will only do so when it is reasonable to do so (for example, when the law requires us).

How will your personal information be disclosed?

We will disclose information when you authorise us to share it (for example, to a GSP for the purpose of an application). We will not otherwise disclose personal information unless it is lawful and reasonable. We may be required to disclose information under the Official Information Act 1982 or in response to a Parliamentary Question.

For more information about the ways a GSP may disclose Submitted Application and Case Data, please see the GSP’s privacy statement. 

How can you access or correct your personal information?

Requests related to Business Customer Profile Data and Platform Usage Data

Generally, most of your personal information will be readily available to you through the Platform. If you cannot access your information, but want to request a copy, you can contact us at:

hello@businessconnect.govt.nz

Alternatively, write to us at:

Privacy Officer
Ministry of Business Innovation and Employment
15 Stout Street, Wellington 6011
PO Box 1473, Wellington 6140

It is important that the Platform contains accurate information. In most instances, you can update the information yourself, through the Platform. If you cannot, you can contact us to request a correction of your information. If we have a good reason for refusing a request for correction (for example because we hold a different opinion) we will attach to the information a statement that you sought a correction and what you believe the information should say.

Requests related to Submitted Application and Case Data

Requests related to an application that has been submitted to a GSP should be directed to the relevant GSP. 

What Platform Usage Data does the Host Agency collect?

Cookies

We use cookies to improve functionality, improve security and measure the performance of the Platform. Cookies are small files that are sent by a website and stored on your computer.

You can manually disable cookies at any time. Please check your browser’s ‘Help’ to find out how. This will however affect the functionality of certain features on the Platform (including login access).

Google Analytics

We use Google Analytics to collect cookie information to help us improve this Platform. This information is aggregated to show how the Platform performs. The information includes browsing characteristics, for example:

• Search terms
• Pages viewed
• Date, time and duration.

This information also includes technical characteristics, for example:

• Screen resolution
• Language settings
• Operating system
• The type of web browser.

The statistical information does not identify you or your individual browsing behaviour.

You can read Google’s privacy statement or opt-out, at:

Privacy and terms(external link) — Google

MouseFlow

We use MouseFlow to better understand our users’ needs and to optimise this service and experience. MouseFlow is an analytics platform that helps us better understand our users’ behaviour (for example, how much time they spend on which pages, which links they choose to click, and their pain points) and this enables us to improve and maintain our service with user feedback.

MouseFlow uses cookies to collect data on our users’ behaviour and their devices. This includes data about interaction with form fields, common friction points and where users are succeeding or failing in submitting an application.

We do not collect any personal information using MouseFlow. You can disable Mouseflow on your browser to prevent yourself from being recorded with the option to opt-out at:

Opt out of Mouseflow(external link) — MouseFlow

This setting will place a cookie in the browser, which will prevent you from being tracked by tools like Mouseflow, across multiple websites. To find out more about this, please visit:

How do I disable Mouseflow tracking on my browser?(external link) — Mouseflow

For further details, please see the 'About MouseFlow' section of MouseFlow’s site:

About MouseFlow (external link)— MouseFlow

RealMe^®

The Platform is accessible using your RealMe log in. RealMe is managed by the Department of Internal Affairs and was set up to make it easier for New Zealanders to get things done online. RealMe provides a privacy-centric, secure method of authentication for people who want to use the Platform. RealMe does not store personal information and is designed to protect personal information.

For more information, please refer to the RealMe terms of use.

Terms of use(external link) — RealMe

Akahu

Akahu is a New Zealand-based open finance platform that securely connects your financial accounts to third parties, such as government agencies. We use Akahu to request a one-time access through them for the sole purpose of confirming information held on the Companies Register. For further details, please refer to the Akahu privacy notice and end user terms or visit akahu.nz for general information.

Akahu privacy notice(external link) — Akahu

End user terms(external link) — Akahu

How will we store your information?

We will take reasonable steps to store your information securely. The information you provide us may be accessed on our behalf by staff, contractors and authorised service providers where access is necessary to use the information or to administer the Platform.

We will only retain personal information for as long as it is required for the purposes for which it may lawfully be used or it is a public record. We store public records (which can include personal information) in accordance with the Public Records Act 2005.

Public Records Act 2005(external link) — New Zealand Legislation

How do we keep information secure?

MBIE has security measures in place to prevent the loss, misuse and alteration of information. In order to maintain the cyber security of the Platform, systems are subject to ongoing monitoring (including activity logging), analysis and auditing.

We may use information about your use of our websites and other IT systems to prevent unauthorised access or attacks on these systems or to resolve such events. We may use this information even if you are not involved in such activity.

MBIE may utilise services from one or more third party suppliers to monitor or maintain the cyber security of its systems and information. These third party suppliers will have access to monitoring and logging information as well as information processed on MBIE websites and other IT systems.

Changes

From time to time we may change this policy. This statement will apply from 29 August 2024.