Privacy Policy

Effective from 20 August 2026

1. Who we are

The Accounting Hub is a New Zealand chartered accounting practice providing accounting, taxation and advisory services.

For the purposes of the Privacy Act 2020, the agency that collects and holds the personal information described in this statement is:

The Accounting Hub
c/o BizDojo
Level 9, 4 Williamson Avenue
Ponsonby, Auckland 1021
New Zealand

Privacy Officer: Andrew Millington
Email: [email protected]
Telephone: 09 360 9917
Website: www.theaccountinghub.co.nz

2. Who this statement applies to

This statement applies to personal information we collect and hold about:

• Clients and prospective clients
• Directors, shareholders, partners and employees of our clients
• Trustees, beneficiaries, settlors and other people associated with trusts
• Family members and representatives of clients
• Suppliers, contractors and professional advisers
• People who contact us, visit our website or receive communications from us
• Job applicants and other people with whom we interact in the course of our business

Personal information means information about an identifiable individual.

3. Personal information we collect

The personal information we collect depends on our relationship with you and the services we provide. It may include:

• Your name, address, email address, telephone number and date of birth
• Copies or details of identity documents, such as a passport or driver licence
• IRD numbers, tax residency information, New Zealand Business Numbers and other government identifiers
• Financial, banking, accounting, investment and property information
• Tax returns, tax records and communications with Inland Revenue
• Company, partnership and trust information
• Payroll, employment and contractor information
• Information about directors, shareholders, trustees, beneficiaries, employees, family members, business partners and authorised representatives
• Information contained in correspondence, instructions, meetings, telephone calls, documents and records supplied to us
• Anti-Money Laundering and Countering Financing of Terrorism customer due diligence information, including identity-verification results and source-of-funds or source-of-wealth information where required
• Billing, payment and service information
• Complaints, enquiries and details of your interactions with us
• Information about your use of our website, client portal, electronic-signing service and other systems, including IP address, browser, device and security-log information
• Any other personal information reasonably necessary for the purposes described in this statement

We do not seek to collect personal information that is not reasonably necessary for our work or another lawful purpose.

4. How we collect personal information

We usually collect personal information directly from you, including when you:

• Contact or meet with us
• Complete an enquiry, onboarding or identity-verification process
• Engage us to provide services
• Give us access to an accounting, payroll or other business system
• Send us information by email, through a client portal or using an electronic-signing service
• Subscribe to an update or other communication
• Use our website

We may also collect personal information about you from:

• Your authorised representatives
• Directors, trustees, employers or other people connected with an engagement
• Clients who provide information about their employees, contractors, family members, beneficiaries or other related parties
• Inland Revenue and other government agencies
• Companies Office, New Zealand Business Number records and other public registers
• Banks and financial institutions
• Previous accountants and other professional advisers
• Anti-Money Laundering and Countering Financing of Terrorism identity-verification providers
• Accounting, payroll and other software systems to which we have been given access
• Publicly available sources
• Our technology and service providers

Where practicable, we collect personal information directly from the individual concerned. Where we collect information from another source, we will first ensure that we have a proper basis for collecting it indirectly.

We will take reasonable steps to make the individual aware of the collection and the matters required by Information Privacy Principle 3A as soon as reasonably practicable, unless the individual has already been appropriately informed or another exception under the Privacy Act applies.

In some circumstances, a client or another organisation may provide the required notice on our behalf. We remain responsible for ensuring that our obligations are met.

5. Why we collect and use personal information

We may collect and use personal information to:

• Respond to enquiries from prospective clients
• Assess and accept clients and engagements, including completing conflict, risk and client-acceptance checks
• Verify identity and complete customer due diligence
• Comply with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and other legal and regulatory obligations
• Provide agreed accounting, taxation, advisory, payroll, company secretarial and related services
• Act as tax agent and communicate with Inland Revenue and other authorities
• Prepare accounts, tax returns, reports, budgets, forecasts and advice
• Administer our client relationships and communicate with clients and their representatives
• Issue invoices, receive payment and recover overdue amounts
• Maintain business and professional records
• Manage the quality of our work and meet professional review requirements
• Obtain legal, accounting, insurance, information technology or other professional advice
• Respond to complaints, disputes, investigations and legal claims
• Protect our systems and information
• Detect and respond to fraud, unauthorised activity, security incidents and privacy breaches
• Maintain backups, business continuity and disaster-recovery capability
• Recruit and manage employees and contractors
• Improve our systems, services and client experience
• Send relevant accounting, tax or service information where permitted by law
• Carry out another purpose authorised by you or permitted or required by law

We will not use personal information for an unrelated purpose unless you authorise that use or it is otherwise permitted by law.

6. Whether you are required to provide information

Providing personal information to us is generally voluntary. However, some information is required by law or is necessary for us to provide the services you request.

We are required to collect and verify certain identity and customer due diligence information under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. Where that Act applies, providing the required information is mandatory if you want us to establish or continue the relevant business relationship or carry out the relevant activity.

If the required information is not provided, we may be legally required to delay, decline or discontinue the engagement.

IRD numbers, financial records, tax residency information and other tax information may be necessary for us to act as your tax agent and provide tax services, including under the Tax Administration Act 1994 and other applicable tax legislation. If the necessary information is not provided, we may be unable to provide those services or complete required returns and filings.

We will explain any other mandatory collection, the relevant law and the consequences of not providing the information at or before the time of collection.

7. Who may receive personal information

Where authorised or permitted, we may disclose personal information to:

• Our directors, employees, contractors and subcontractors who require it to perform their roles
• Inland Revenue
• Companies Office and the Ministry of Business, Innovation and Employment
• The Department of Internal Affairs and other Anti-Money Laundering and Countering Financing of Terrorism supervisors
• Courts, law enforcement agencies, regulators and other public authorities
• Banks and financial institutions
• Chartered Accountants Australia and New Zealand, including practice reviewers and disciplinary bodies
• Our insurers, auditors, lawyers and other professional advisers
• Identity-verification and customer due diligence providers
• Accounting, payroll, tax, practice-management and workflow providers
• Electronic-signing and client-portal providers
• Cloud storage, email, backup, information technology support and security providers
• Another accountant or professional adviser authorised by you
• Debt-recovery providers where reasonably necessary
• A prospective purchaser or successor if our business is sold or restructured, subject to appropriate confidentiality and privacy protections
• Any other recipient authorised by you or permitted or required by law

We do not sell personal information.

We require employees, contractors and service providers to protect personal information and only use it for authorised purposes.

8. Service providers and information held outside New Zealand

We use cloud-based and other technology providers to operate our practice and deliver services. These may include accounting, tax, workflow, document storage, email, backup, electronic-signing, identity-verification, information technology support and security providers.

Some providers may store, process or allow support access to personal information outside New Zealand.

Where a provider holds or processes information solely on our behalf, we remain responsible for that information as provided by the Privacy Act. Where an arrangement involves disclosure to an overseas person or organisation, we assess the arrangement under Information Privacy Principle 12.

This may include confirming that:

• The recipient is subject to the New Zealand Privacy Act
• The recipient is subject to privacy laws providing comparable safeguards
• Contractual protections require the recipient to provide comparable safeguards
• Another basis permitted by Information Privacy Principle 12 applies

If we rely on your authorisation to disclose information to an overseas recipient that may not provide comparable safeguards, we will expressly inform you of that fact before seeking your authorisation.

9. Information we process for clients

In some engagements, we process personal information solely on behalf of a client. Examples include payroll or employee information supplied by an employer and information about beneficiaries or related parties supplied by a trust or company.

In those circumstances, we may act as the client’s agent for the purposes of the Privacy Act. The client may remain responsible for decisions about how that information is collected, used and disclosed.

If we receive an access, correction or privacy request relating to information that we hold solely for a client, we may refer the request to that client or consult the client before responding.

10. Website, enquiries and cookies

When you visit our website, we or our service providers may collect technical information such as:

• Your IP address
• Browser and device type
• The pages you visit
• The website or link that referred you to us
• The date and time of your visit
• Information about how you use the website

We use this information to operate and secure the website, understand how it is used and improve its performance and content.

Our website may use cookies and analytics services. Cookies are small files stored on your device. You can control cookies through your browser or any cookie controls provided on our website. Disabling certain cookies may affect website functionality.

If you submit an enquiry through our website, we collect the contact information and message you provide so that we can respond. If you subsequently become a client, that information may form part of your client record.

Our website may contain links to websites operated by other organisations. Those organisations are responsible for their own privacy practices, and we recommend reviewing their privacy statements.

11. Marketing communications

We may send clients and other contacts information about accounting and tax developments, our services, events or other matters we reasonably believe may be relevant to them, where permitted by law.

You may unsubscribe from marketing emails at any time by using the unsubscribe facility in the email or contacting us.

Unsubscribing from marketing does not prevent us from sending communications necessary for an engagement, required by law or otherwise related to services we provide to you.

12. Security

We use safeguards appropriate to the nature and sensitivity of the personal information we hold. These include:

• Access controls based on role and business need
• Multi-factor authentication
• Managed work devices
• Password-management controls
• Encryption
• Antivirus and endpoint protection
• Security monitoring and managed updates
• Backups and recovery procedures
• Restrictions on the use of personal devices
• Confidentiality obligations
• Staff training
• Incident-management procedures

We regularly review our security arrangements. However, no method of electronic storage or transmission is completely secure.

If you become aware of a security concern involving information held by us, please contact our Privacy Officer immediately.

13. Privacy breaches

A privacy breach may include the loss, accidental disclosure, unauthorised access, alteration or destruction of personal information, or an event that prevents us from accessing the information.

We investigate suspected privacy breaches and take appropriate steps to contain them and reduce the risk of harm.

If a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, unless an exception under the Privacy Act applies.

14. Retention and disposal

We retain personal information only for as long as it is reasonably required for the purposes for which it may lawfully be used.

The period for which we retain particular information depends on applicable:

• Tax and accounting requirements
• Anti-Money Laundering and Countering Financing of Terrorism requirements
• Professional and quality-management obligations
• Contractual and insurance requirements
• Limitation periods
• Complaint, investigation and legal requirements
• Business and record-keeping needs

Client accounting and tax records are generally retained for at least seven years. Particular records may be retained for a longer or shorter period where appropriate.

When personal information is no longer required for a lawful purpose, we securely delete, destroy or permanently de-identify it where reasonably practicable.

15. Access and correction

You may ask for access to personal information we hold about you and ask us to correct it if you believe it is inaccurate, incomplete, out of date or misleading.

Please contact:

Andrew Millington
Privacy Officer
Email: [email protected]
Telephone: 09 360 9917
Address: c/o BizDojo, Level 9, 4 Williamson Avenue, Ponsonby, Auckland 1021, New Zealand

We may need to verify your identity or authority before responding.

We will make a decision on your request as soon as reasonably practicable and generally within 20 working days, subject to any extension permitted by the Privacy Act.

If we decline an access or correction request, we will explain the applicable grounds and advise you of your right to complain. If we decline to make a requested correction, you may ask us to attach a statement of correction to the information.

16. Privacy questions and complaints

If you have a question or concern about how we have handled personal information, please contact Andrew Millington, Privacy Officer, using the details above.

We will acknowledge and investigate privacy complaints and will keep you informed where a response requires additional time.

If you are dissatisfied with our response, you may complain to:

Office of the Privacy Commissioner
Website: www.privacy.org.nz
Telephone: 0800 803 909

17. Changes to this statement

We may update this statement when our business practices, systems or legal obligations change.

The current version will be published on our website and will show its effective date.