Introduction
9 Yards Financial Group Limited (we, us, our) complies with the New Zealand Privacy Act 2020 (the Act) when dealing with personal information. Personal information is information about an identifiable individual (a natural person). This policy sets out how we will collect, use, disclose, and protect your personal information.
This policy does not limit or exclude any of your rights under the Act. If you wish to seek further information on the Act, you can contact our Privacy Officer, Jonathan Liong, by email at Email us. Or visit www.privacy.org.nz for further information.
Changes to this policy
We may change this policy by uploading a revised policy onto the website. The change will apply from the date that we upload the revised policy.
What is personal information?
Personal information is information about an identifiable individual. It includes (but is not limited to) name, address, contact details, date of birth, occupations, payment details, employment history and/or details, education and qualifications, financial information, testimonials and feedback, evidence of source of funds or source of wealth (in some cases) and other information.
Third party collection of information
Where we collect your personal information from someone other than you, we will take reasonable steps to notify you that we have collected your personal information, the purpose of the collection, the intended recipients of the information, the name and address of the agency collecting and holding the information, whether the collection is authorised or required by law and, if so, the law that authorises or requires the collection, and your right to access and request correction of that information, unless an exception applies under the Privacy Act 2020.
We will use your personal information:
- to verify your identity
- to provide services and products to you
- to market our services and products to you, including contacting you electronically (e.g. by call, text, or email for this purpose)
- to improve the services and products that we provide to you
- to measure and improve our website and advertising, including working out which ads and campaigns lead to enquiries and clients
- to respond to communications from you, including a complaint
- to protect and/or enforce our legal rights and interests, including defending any claim
- for any other purpose authorised by you or the Act.
Disclosing your personal information
We may disclose your personal information to:
- Other companies or individuals who assist us in providing services or who perform functions on our behalf (such as mailing houses, hosting and data storage providers, specialist consultants, and legal advisers);
- Website, analytics and advertising providers, listed under Our website, analytics and advertising;
- Product providers (such as but not limited to lenders and insurance companies);
- Financial advisers and financial advice providers who may use our services;
- Other companies or individuals who perform checks (such as but not limited to compliance reviews and audits) that are necessary or desirable under the law on our behalf;
- Other companies, agencies, or individuals that maintain databases against which your identity may be verified, which may include (but are not limited to) the New Zealand Department of Internal Affairs, and New Zealand Transport Agency;
- Social media sites on which we may have a presence;
- Courts, tribunals, and regulatory authorities (such as the Financial Markets Authority, and the Ministry of Justice in New Zealand);
- Office of the Ombudsman, where a complaint relates to official information;
- Any person or agency we believe could assist in responding to a serious privacy breach;
- Office of the New Zealand Privacy Commissioner, where a complaint relates to breach of the Privacy Act 2020;
- Human Rights Commission, where a complaint relates to discrimination;
- CERT NZ, where appropriate to assist with the management of a voluntarily notified privacy breach;
- Overseas privacy regulator, where a complaint relates to the actions of an overseas agency; and
- Anyone else to whom you authorise us to disclose it.
Except as described above, we will not disclose your personal information without your written or oral consent, unless we are required to do so by applicable law.
Our website, analytics and advertising
When you visit 9yardsfs.co.nz we collect information about how you use it: pages viewed, links and buttons clicked, where on a page people click and scroll (heatmaps), device and browser type, approximate location (city level), the website or ad that referred you, and campaign codes in the link you followed (for example utm codes and Google or Meta click IDs). We use this to see which pages and marketing work and to improve the site. We don't use it to make decisions about your financial advice.
We use these providers for our website, analytics and advertising:
- Cloudflare hosts this website, stores enquiries sent through it in our website database, and helps protect the site and its forms from attacks and spam.
- Resend delivers the emails that pass your enquiry to our team.
- PostHog (its EU service, hosted in Frankfurt, Germany) provides our website analytics and heatmaps. PostHog uses your IP address to work out your approximate city, then discards it.
- Google provides Google Analytics (how the site is used), Google Ads conversion tracking (which of our Google ads lead to enquiries) and the Google tag (the script that loads them on the site).
- Meta provides the Meta pixel, which measures our Facebook and Instagram advertising.
- GitHub stores the content of this website so our team can edit it. It doesn't receive information about visitors or enquiries.
These providers use cookies or similar browser storage, listed under Cookies and browser storage below.
When you send us an enquiry
Your enquiry is stored in our website database (Cloudflare) and emailed to our team (Resend), together with the page you sent it from, the campaign codes from your visit and your browser type. We use your details to respond to you. Giving us your details is voluntary, but we need your name and a way to contact you to respond to your enquiry.
We also record your name, email address and phone number in our analytics (PostHog), linked to your earlier visits to this website in the same browser. This helps us follow up your enquiry and understand how people find us. If you have turned analytics off, we don't send your enquiry to PostHog.
To measure our Google advertising, we may give Google a scrambled (hashed) copy of your email address and phone number, with the ad click ID if you came from a Google ad. Google uses it to match your enquiry to an ad click and report the result to us. It is not a readable copy of your details.
We never send your financial details, your message or your answers to our questions to analytics or advertising providers.
Your choices
You can turn our analytics off for your browser on our privacy preferences page. This also turns off Google and Meta measurement on this website: we don't load their tags, keep the campaign codes from your visit or give Google a scrambled copy of your details. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as turned off unless you turn it back on there. You can also block or delete cookies in your browser settings, manage Google ads at My Ad Center, and manage Meta ads in your Facebook or Instagram ad preferences.
Cookies and browser storage
| Name | Provider | Type | Purpose | How long |
|---|---|---|---|---|
nyfs_consent_v1 | 9 Yards | Local storage | Remembers your analytics choice, once you make one on our privacy preferences page | Until you clear it |
nyfs_attr_v1, nyfs_vid | 9 Yards | Local storage | Remembers how you found our website (the referring site, campaign codes and, for advertising measurement, ad click IDs) and a random visit ID, so we can tell which pages and ads lead to enquiries. Not kept when analytics is off | 90 days |
nyfs_lead_pending | 9 Yards | Session storage | After you send an enquiry, lets the thank-you page count it once for our advertising measurement. Holds the enquiry reference and scrambled (hashed) copies of your email address and phone number | Until the thank-you page loads, or you close the tab |
ph_<key>_posthog | PostHog | Local storage | Analytics: a random ID that tells repeat visits apart, and your visit's settings | Until you clear it |
__ph_opt_in_out_<key> | PostHog | Local storage | Remembers that you turned analytics off or back on | Until you clear it |
ph_<key>_window_id, ph_<key>_primary_window_exists | PostHog | Session storage | Analytics: tells browser tabs apart within a visit | Until you close the tab |
_ga, _ga_<ID> | Google Analytics | Cookie | Analytics: tells visitors and visits apart | Up to 2 years |
_gcl_au, _gcl_aw, _gcl_gb | Google Ads | Cookie | Advertising measurement: links an enquiry to the Google ad click that brought you here | 90 days |
_fbp, _fbc | Meta | Cookie | Advertising measurement: links visits to our Facebook and Instagram ads | 90 days |
__Host-cms_session | 9 Yards | Cookie | Staff sign-in to the website editor only; never set for visitors | 24 hours |
In the names above, <key> is our PostHog project key and <ID> is our Google Analytics ID. Google and Meta cookies are set only on 9yardsfs.co.nz.
Our home loan and KiwiSaver websites
Our home loan site (mortgage.9yardsfs.co.nz) and KiwiSaver site (kiwisaver.9yardsfs.co.nz) are 9 Yards services, and this privacy statement covers them too. When you follow a link from this website to one of them, the link may carry campaign codes so that site can tell which of our pages or ads you came through.
Where your information is stored
Some of the providers we use store or process information outside New Zealand, including in the United States and the European Union. Where a provider holds information only to provide a service to us (Cloudflare, Resend, PostHog, and Google for our analytics and advertising measurement), we remain responsible for it under the Privacy Act. Meta also uses information it receives through its advertising tag for its own purposes. Meta may not be required to protect your information in a way that, overall, provides comparable safeguards to those in the Privacy Act. You can limit what Meta receives through your browser's cookie settings and your Facebook or Instagram ad preferences.
Protecting your personal information
We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse. Our software is subject to audits to ensure it is continuing to meet security requirements. All data handled in our software is encrypted in transit and during storage and can only be accessed over secure network connections.
Storing your personal information
We will only retain personal information as long as it is required for the purposes for which the information may lawfully be used. All data stored online is backed up and can be retrieved in the event of data loss or corruption. Data will sometimes be held on-premise at 4/31 Carlyle Street, Sydenham, Christchurch if it is provided to us outside of our software.
We keep enquiries sent through this website in our website database for up to 24 months. If your enquiry leads to us providing advice or services to you, we keep your information with your client records for as long as we are required to.
Accessing and correcting your personal information
Subject to certain grounds for refusal set out in the Act, you have the right to access your readily retrievable personal information that we hold and to request a correction to your personal information. Before you exercise this right, we will need evidence to confirm that you are the individual to whom the personal information relates.
In respect of a request for correction, if we think the correction is reasonable and we are reasonably able to change the personal information, we will make the correction. If we do not make the correction, we will take reasonable steps to note the personal information that you requested the correction.
If you want to exercise either of the above rights, email us at Email us. Your email should provide evidence of who you are and set out the details of your request (e.g. the personal information, or the correction, that you are requesting).
If you are not satisfied with our response to a request or with how we have handled your personal information, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.
Data Breaches
Our Privacy Officer has processes and systems in place in the unfortunate event of a data breach. If such an event occurs, we will promptly identify, report and examine a personal data breach.
Internet use
While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is at your own risk.
If you follow a link on our website to another site, the owner of that site will have its own privacy policy relating to your personal information. We suggest you review that site's privacy policy before you provide personal information.
We use cookies and similar browser storage to run this website and to measure how it and our advertising are used. They are described under Our website, analytics and advertising, with a full list under Cookies and browser storage. You may disable cookies by changing the settings on your browser, although this may mean that you cannot use all of the features of the website.
We may use information about your use of our websites and other IT systems to prevent unauthorised access or attacks on our software. We may utilise services from one or more third-party suppliers to monitor the use of our systems. These third-party suppliers will have access to monitoring and logging information as well as information processed on our websites and other IT systems.