Privacy policy.

Kiwi Rewards Club Privacy Policy

Effective date: Not yet in effect. Awaiting final approval

1. Who is responsible

Kiwi Rewards Club Limited, trading as Kiwi Rewards Club (“KRC”, “we”, “us” or “our”), is responsible for personal information collected through the New Zealand KRC service. Our NZBN is 9429053934307 and our registered office is Private Box Limited, Unit A Level G, 26 Hobson Street, Suite 1377, Auckland 1010, New Zealand.

KRC is a subsidiary of South Nadus Holdings Pty Ltd in Australia. The parent or authorised group personnel may provide technology, administration, finance, security, legal or management services, subject to privacy safeguards and access limits.

Contact: privacy@kiwirewards.club.

2. What this policy covers

This policy covers KRC accounts, the Founding 100 claim and waitlist, membership benefits, customer support, partner/affiliate interactions, the KRC store if launched, service communications, marketing, fraud/security controls and any separately approved promotion. A more specific collection notice or promotion rule may add information for a particular interaction.

3. Information we may collect

Depending on use, KRC may collect:

• identity and eligibility data: name, age/date-of-birth information, New Zealand residence/region evidence and proportionate verification material;
• contact and account data: email, phone, delivery address, account ID, login/verification status, security settings and communication preferences;
• Founding data: claim/queue/cohort number, status, acceptance wording/version/timestamps, review and closure records;
• membership/benefit data: tier/status, benefit eligibility, redemption and support records;
• academy learning data: course progress, completion records, certificates and Academy Stamp history;
• transaction data if paid services launch: Stripe/customer/checkout/subscription/invoice identifiers, amount, currency, status, refund/dispute and limited payment-method metadata supplied by the processor; KRC does not intend to store full card numbers or card security codes;
• store data if merchandise launches: order, product, discount, delivery, fulfilment, return and complaint details;
• partner data: partner-account contact details, business profile, address and website, offer facts and conditions, uploaded logo, terms acceptance, publication/moderation status, review notes, link attribution, requested benefit and redemption confirmation;
• affiliate data: link attribution and commission attribution from third-party brand links;
• future promotion data only if separately approved: eligibility, entry, draw, winner verification, prize delivery and optional publicity consent;
• device/security data: IP address, device/browser/operating system, session/authentication/audit logs, cookies/identifiers, rate-limit, bot, duplicate-account and fraud signals; and
• communications: support messages, complaints, access/correction requests, consent, delivery, bounce and unsubscribe/suppression records.

KRC will not collect identity documents or precise birth/residence evidence by default where a lower-intrusion method is sufficient.

4. How information is collected

KRC may collect information directly from the person, their device/browser, KRC's service providers acting for KRC, a payment/fulfilment/benefit partner involved in the requested transaction, fraud/security sources, or another person who contacts KRC.

Where a provider processes only as KRC's agent and does not use the data for its own purposes, KRC remains responsible for that processing.

5. Why KRC uses information

KRC uses personal information where reasonably necessary to:

• create, authenticate and secure accounts;
• check age, residence, uniqueness and eligibility;
• allocate the Founding cohort fairly and preserve the acceptance record;
• provide and support current membership benefits;
• administer a free waitlist and send requested status/service messages;
• process an expressly accepted future payment, order, refund or cancellation;
• authenticate a requested partner benefit or fulfil an order;
• validate, screen, publish and administer partner business profiles and member offers, including detecting unsafe content, suspicious links, duplicate businesses and unsuitable imagery;
• prevent bots, duplicate claims, fraud, payment abuse and security incidents;
• respond to support, complaints and privacy requests;
• keep accounting, tax, company, contract and audit records;
• meet legal/regulatory obligations and establish, exercise or defend legal rights;
• operate, troubleshoot and improve the service using proportionate data; and
• send optional marketing only with the applicable consent or other lawful basis.

KRC will not use personal information for a materially different incompatible purpose without a lawful basis and any notice/consent required by the Privacy Act 2020.

6. Who receives information

KRC may disclose only the information reasonably needed to:

• South Nadus Holdings Pty Ltd and authorised group personnel providing documented services;
• hosting, database, authentication, security, analytics and communications providers;
• content and image-safety providers where needed to screen a submitted partner logo or offer for publication;
• Stripe and banking/acquiring providers only when an expressly accepted paid transaction exists;
• merchandise production, fulfilment and delivery providers if the store launches;
• a partner where needed to authenticate or provide a benefit requested by the member;
• a draw verifier, prize supplier or delivery provider only for a separately approved promotion;
• accountants, auditors, insurers and professional advisers under suitable obligations;
• a genuine purchaser/successor in a business transaction, with appropriate safeguards and notice; and
• a court, regulator, law-enforcement or other authority where authorised or required by law.

KRC does not sell personal information as a standalone product.

7. Overseas storage, processing and disclosure

Some group entities, providers or sub-processors may operate in Australia, the United States or other countries. KRC remains responsible for personal information it collects.

8. Cookies and analytics

KRC may use necessary cookies or similar technologies for login, security, session continuity, preferences and service operation. If analytics, attribution or advertising technologies are used, they will be identified and will not be described as “strictly necessary” when they are not.

9. Marketing and service messages

Account verification, security, benefit, terms and waitlist-status notices are service communications needed to administer the requested service. Optional marketing email/SMS is separate.

KRC will record the wording, channel, source and time of marketing consent; will not preselect consent; will identify the sender; and will provide a clear, functional and free unsubscribe method. Unsubscribing from marketing does not close the membership or stop essential service messages.

10. Automated signals and fair review

KRC may use rules and provider signals to identify bots, duplicated identities, suspicious claims, account takeover, payment risk, or potentially unsafe, adult, misleading, duplicative or inconsistent partner submissions. A shared address, device, network, phone, business name or website signal does not alone prove misconduct. A partner submission that raises a signal, or cannot be screened, is held from publication for a person to review. Where reasonably practicable, a trained person will review an adverse decision affecting Founding status or a partner listing, and the individual can ask KRC to reconsider it.

11. Retention

KRC keeps identifiable information only as long as it has a lawful operational, security, audit, tax, dispute or legal need. Default schedules (subject to legal holds) include: unverified registration (about 30 days); free waitlist records that never activate (about 12 months after that waitlist closes); active accounts while they remain active; closed-account profile content (normally within 24 months); Founding claim and acceptance records (seven years after membership/programme end, subject to Samuel confirming the basis); payment/tax records (at least seven years); routine technical logs (normally 12 months); support records (normally two years after resolution); and marketing consent/unsubscribe evidence for as long as needed to honour an opt-out.

12. Access and correction

A person may ask whether KRC holds their retrievable personal information, request access, or ask for correction by emailing privacy@kiwirewards.club. KRC may reasonably verify identity before release.

KRC will make the required decision as soon as reasonably practicable and within 20 working days, subject to a lawful extension or withholding ground. See the Office of the Privacy Commissioner's access guidance.

13. Security and privacy breaches

KRC uses safeguards proportionate to the information and risk, including least-privilege access, MFA for privileged systems, secret management, encryption in transit, secure provider configuration, logging, backups, dependency/patch management, rate limiting and incident response.

KRC will assess suspected loss, unauthorised access/disclosure or other privacy breach. Where the Privacy Act requires notification because serious harm has occurred or is likely, KRC will notify the Office of the Privacy Commissioner and affected people as soon as practicable.

14. Children

The Founding 100 and KRC adult membership are intended for people aged 18 or older. If KRC learns that an ineligible child supplied information, it will close the claim/account as appropriate and delete information not reasonably required for security or legal evidence.

15. Changes and complaints

KRC may update this policy to reflect actual service, provider or law changes. It will publish the effective date and provide reasonable notice of a material change where practicable. Silence is not consent to an unrelated payment or marketing use.

Privacy questions or complaints: privacy@kiwirewards.club. A person may also complain to the Office of the Privacy Commissioner.

16. Contact

Kiwi Rewards Club Limited NZ company number: 9455386 NZBN: 9429053934307 Registered office: Private Box Limited, Unit A Level G, 26 Hobson Street, Suite 1377, Auckland 1010, New Zealand Privacy Officer: privacy@kiwirewards.club Support: support@kiwirewards.club