Your information.
Handled responsibly.

Changeable is a New Zealand AI consultancy providing AI strategy, advisory, process improvement, automation, software development and training services.

This Policy covers personal information we handle in New Zealand when you:

• Visit or interact with our websites, forms or chat widgets.
• Contact us, download content, or book workshops or meetings.
• Engage our services, including AI readiness, workflow automation, training and governance.
• Receive our emails, advertisements or surveys.

This Policy does not apply to third-party websites or platforms that we do not control. Those organisations are responsible for their own privacy practices.

3.1 Information you provide directly

• Contact and business details: name, email, phone, company, role and region.
• Enquiry and project information: business goals, challenges, requirements, files and data you choose to share.
• Workshop and training registrations: attendee names and dietary or accessibility needs you choose to provide.
• Billing: billing contacts, company information and high-level payment transaction details. Where payment providers are used, we do not store card numbers.
• Consent preferences: choices to opt in or opt out of communications.

3.2 Information collected automatically

• Device and usage data: IP address, browser type, pages visited, time spent on pages and links clicked.
• Cookies and tracking technologies: as explained in Section 8.
• Error and performance logs: website performance, diagnostic and security information.

3.3 Information from third parties

• Analytics and advertising platforms: aggregated website metrics and campaign performance.
• Public and professional sources: LinkedIn or company websites used to verify business details.
• Referrers and partners: information provided when you engage with us through another organisation.

We collect the minimum personal information necessary for the purposes described in this Policy.

We handle personal information in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles.

We use information for purposes including:

• Providing services: scoping, delivery, support and invoicing.
• Responding to enquiries: answering questions and providing requested information.
• Scheduling: organising meetings, workshops and training.
• Improving our website and services: analytics, diagnostics and quality assurance.
• Communications: newsletters, event invitations and updates you choose to receive.
• Legal and compliance: record-keeping, fraud prevention and risk management.
• Security: identifying and responding to threats affecting our systems or users.

Because we specialise in artificial intelligence, we want to be particularly clear about how information is handled when AI tools are involved.

• No training on confidential client data without consent. We will not use your confidential client or operational data to train third-party foundation models without your explicit written approval.
• Human-in-the-loop. When AI is used in our work, including drafting, summarisation or workflow automation, we maintain human oversight for quality and safety.
• Data minimisation. We use the least information necessary and prefer redaction, pseudonymisation and sandboxing wherever feasible.
• Secure environments. We use vetted platforms and access controls. When using third-party AI services, we assess their terms, privacy practices and security posture.
• Customer-controlled options. Where possible, AI tools can be configured to exclude data from model training or use private or on-premises endpoints.

We may share personal information with:

• Service providers and contractors: including website hosting, email, calendar, CRM, analytics, marketing, security and accounting providers, for work performed on our behalf under confidentiality obligations.
• Professional advisers: including legal, accounting and insurance advisers where necessary.
• Authorities: where required by law or necessary to protect rights, safety or security.
• Business successors: in the event of restructuring or a transfer of our business.

Some service providers may operate or store data outside New Zealand, including in Australia, the European Union, the United Kingdom or the United States.

Where information is transferred overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under New Zealand law. This may include contractual protections and selecting reputable providers with robust security practices.

We do not permit providers to sell your data.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected or to meet applicable legal and contractual obligations.

Our typical retention periods are:

• Sales and marketing leads: up to 24 months from the last meaningful interaction, unless you opt out earlier.
• Client and project files: generally seven years after project closure for legal and tax purposes, unless otherwise agreed or required.
• Operational logs and analytics: typically six to 24 months in aggregated or de-identified form.

When information is no longer required, we take reasonable steps to securely delete or anonymise it.

We use cookies and similar technologies to operate and improve our website.

Types of cookies

• Strictly necessary: supporting site security, load balancing and session management.
• Performance and analytics: helping us understand website usage, page views and time spent on pages.
• Functionality: remembering your preferences.
• Advertising and retargeting, if enabled: measuring campaigns and displaying relevant content.

Your choices

• You can manage cookies through your browser settings or our on-site cookie controls, where provided.
• Blocking certain cookies may affect website functionality.
• You can opt out of marketing emails using the unsubscribe link or by contacting us.

Under the New Zealand Privacy Act 2020, you have the right to:

• Request access to personal information we hold about you.
• Request correction where you believe information is inaccurate or incomplete.

We aim to respond within 20 working days. To exercise these rights, email hello@changeable.co.nz with the subject line Privacy Request.

We may need to verify your identity before processing a request. If we refuse a request because a lawful exception applies, we will explain the reason and how you can complain.

We take reasonable steps to protect personal information from loss, unauthorised access, modification and disclosure.

Our safeguards include:

• Access controls and least-privilege practices.
• Secure passwords and multi-factor authentication where appropriate.
• Vetted technology providers and encrypted data transport.
• Standard backup and recovery processes.
• Staff and contractor confidentiality obligations.

No system or method of transmission is completely secure. If you suspect a security issue, please contact us immediately at hello@changeable.co.nz.

If a privacy breach occurs that is likely to cause serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required under the Privacy Act 2020.

Further information is available from the Office of the Privacy Commissioner .

Our services are intended for businesses and adult professionals. We do not knowingly collect personal information from children under 16.

If you believe a child has provided personal information to us, please contact us to request its deletion.

We send marketing communications only where permitted by law, such as with your consent or where an applicable existing relationship permits us to contact you.

You can opt out at any time by using the unsubscribe link in our communications or contacting hello@changeable.co.nz.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page indicates the latest published version.

Significant changes will be highlighted on our website or communicated directly where appropriate.

If you are concerned about how we handle your personal information, please contact us first so we can investigate and attempt to resolve the matter.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner in New Zealand.

• Personal information: information about an identifiable individual.
• De-identified: information that does not identify an individual and cannot reasonably be re-identified.
• Cookies: small files stored on your device that help a website operate and measure usage.
• Notifiable privacy breach: a breach likely to cause serious harm to affected individuals, as defined by the Privacy Act 2020.

Tagmade is a WooCommerce product photography and listing plugin developed by Changeable. It operates on the store owner’s own WordPress website and connects to third-party services using the store’s own API credentials.