Privacy policy
As at 26 June 2026. Next scheduled review 26 June 2027.
This privacy policy explains how we collect, use, store, disclose and protect your personal information when you use Kāhu. We have written it to comply with the Privacy Act 2020 and its 13 information privacy principles. Please read it alongside our Cookie policy, Terms of service and Disclaimer.
Who we are
Kāhu is operated by Financial Advice NZ Limited, a licensed financial advice provider (FSP1009051). In this policy, “Kāhu”, “we”, “us” and “our” mean Financial Advice NZ Limited. Financial Advice NZ Limited is the agency responsible for the personal information collected through Kāhu.
You can contact our privacy officer at:
- Privacy officer: [insert name]
- Email: [insert privacy officer email]
- Postal address: [insert street address], Parnell, Auckland [insert postcode], New Zealand
What this policy covers
This policy covers personal information we collect through the Kāhu website, our KiwiSaver comparison and switching tools, our calculators and guides, and any related communications. Personal information is information about an identifiable individual.
What personal information we collect
We aim to collect only what we need for the purposes set out below. Depending on how you use Kāhu, we may collect:
- Identity and contact details, such as your name, email address, phone number and the region you live in.
- KiwiSaver and financial profile information you choose to provide, such as your current provider and fund, your approximate balance, your contribution rate, your prescribed investor rate (PIR), your age, your investment time horizon, your risk comfort, and your goals.
- Switching information needed to help you change provider or fund, which may include your IRD number and date of birth where a provider requires this to process a switch. We collect this only when you ask us to help you switch.
- Records of your interactions with us, such as enquiries, messages, advice discussions, and the comparisons or shortlists you generate.
- Technical and usage information collected automatically when you visit the site, such as your device type, browser, IP address, pages viewed and referring source. Our Cookie policy explains the cookies and similar technologies we use.
You do not have to provide personal information to browse general information on Kāhu. If you choose not to provide certain information, we may be unable to give you personalised financial advice or help you switch.
How we collect personal information
We collect personal information directly from you wherever we can, for example when you use our tools, complete a form, contact us, or engage our adviser. We also collect technical information automatically through cookies and analytics. Where you ask us to help you switch, we may collect or confirm information with the KiwiSaver provider involved, acting on your instructions.
If we collect your personal information from a third party, or in a way that is not obvious, we will take reasonable steps to make sure you are aware of the collection and the matters set out in this policy, as required by information privacy principle 3.
Why we collect it and how we use it
We collect and use personal information for the following lawful purposes connected to our functions as a KiwiSaver comparison and switching platform and as a licensed financial advice provider:
- To provide the Kāhu comparison tools, calculators, guides and shortlists you request.
- To provide regulated financial advice through Financial Advice NZ Limited, including assessing suitability and helping you understand your options, where you ask for personalised advice.
- To help you switch KiwiSaver provider or fund where you instruct us to.
- To respond to your enquiries and provide customer support.
- To meet our legal and regulatory obligations as a financial advice provider, including record keeping and our duties under financial advice law.
- To maintain the security, integrity and performance of our website.
- With your consent, to send you marketing communications about Kāhu, which you can opt out of at any time.
We will not use your personal information for a materially different purpose without your authorisation, unless an exception in the Privacy Act applies.
When we disclose personal information
We do not sell your personal information. We may disclose it in the following circumstances:
- To KiwiSaver providers, where you ask us to help you switch or to act on your instructions.
- To service providers who process information on our behalf for the purposes above. These act on our instructions and are bound to protect your information. The categories are set out in the table below.
- To our professional advisers, such as our lawyers, auditors or compliance advisers, where reasonably necessary.
- To regulators, dispute resolution schemes or other authorities, where required or authorised by law.
- To a purchaser or successor of our business, in connection with a sale or restructure, subject to appropriate protections.
Service providers and where your information is held
We use the following categories of service provider. Some may store or process information outside New Zealand. Where information is held overseas, we take reasonable steps to ensure it is protected by comparable safeguards, consistent with information privacy principle 12.
| Purpose | Provider or category | Location of storage or processing |
|---|---|---|
| Website hosting | [confirm host, e.g. Netlify / Ploy] | [confirm, e.g. United States] |
| Website analytics | [confirm provider, e.g. Google Analytics / Plausible] | [confirm location] |
| Email and communications | [confirm provider] | [confirm location] |
| Customer relationship and advice records | [confirm provider] | [confirm location] |
| Any AI assisted tools | [confirm provider, or state none] | [confirm location] |
| Payments, if any | [confirm provider, or state none] | [confirm location] |
If a service provider is located in, or stores information in, a country that does not have comparable privacy safeguards, we will only disclose your information to it on a basis permitted by information privacy principle 12, such as your authorisation or contractual protections that require comparable safeguards.
How long we keep it
We keep personal information only for as long as we need it for the purposes above, or for as long as the law requires. As a financial advice provider, we are required to keep certain records, including advice records, for minimum periods set by financial advice law. Our standard retention periods are [insert retention schedule, for example: advice and switching records for at least seven years from the end of the engagement; enquiry records for [insert]; marketing records until you opt out plus [insert]]. When we no longer need information, we will securely destroy or de-identify it.
How we keep it safe
We take reasonable security safeguards to protect personal information against loss, unauthorised access, use, modification or disclosure, as required by information privacy principle 5. These include [insert measures, for example: access controls, encryption in transit, restricted staff access, vendor due diligence, and secure disposal]. No system can be guaranteed completely secure, so we cannot promise absolute security, but we work to protect your information and to keep our safeguards current.
Cookies and analytics
We use cookies and similar technologies to operate the site, understand how it is used and, where you consent, to support marketing. Our Cookie policy explains what we use, why, and how you can manage your preferences. Where cookies collect personal information, this privacy policy applies to that information.
Marketing and your choices
We will only send you marketing emails or messages where you have consented, or where the law otherwise allows. Every marketing message will identify us and include a working unsubscribe option, consistent with the Unsolicited Electronic Messages Act 2007. You can opt out at any time by using the unsubscribe link or by contacting our privacy officer. Opting out of marketing does not stop service messages that we need to send you about a switch or your engagement.
Your right to access and correct your information
You have the right to ask us for access to the personal information we hold about you, and to ask us to correct it if it is wrong, under information privacy principles 6 and 7. To make a request, contact our privacy officer using the details above. We may need to verify your identity. We will respond within the timeframes required by the Privacy Act. If we decline a request, we will tell you why and explain how you can take the matter further. If we cannot agree to a correction, you may ask us to attach a statement of the correction you sought.
How we handle privacy breaches
If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by the Privacy Act 2020. We maintain an internal process to assess and respond to breaches.
How to make a complaint
If you have a concern about how we have handled your personal information, please contact our privacy officer first so we can try to resolve it. You also have the right to complain to the Office of the Privacy Commissioner:
- Website: privacy.org.nz
- Phone: 0800 803 909
For complaints about our financial advice service more generally, see the complaints and dispute resolution process in our Terms of service.
Children
Kāhu is intended for New Zealand adults. We do not knowingly collect personal information from people under 18 without appropriate involvement of a parent or guardian. [Confirm position if under-18 KiwiSaver members are in scope.]
Changes to this policy
We may update this policy from time to time. The version date appears at the top. Where changes are significant, we will take reasonable steps to bring them to your attention. Please check this page for the current version.
Reviewer note
This is a draft for human review. It is not legal advice. Please have the licensed adviser and a qualified New Zealand solicitor review and sign off before publication.
Assumptions and placeholders to confirm:
- Privacy officer name, email, postal address and postcode.
- The service provider table: confirm each named processor, whether any data is stored or processed offshore, and the IPP 12 basis relied on for any offshore disclosure. This is a lawyer escalation item under the project rules (cross-border data transfer).
- Retention periods, including the minimum record keeping period for advice records under financial advice law. Verify the current statutory minimum before publishing.
- Whether IRD number and date of birth are in fact collected during switching, and at what point, so the description matches actual data flows.
- Whether any AI assisted processing or payment processing occurs, and where.
- Whether under-18 KiwiSaver members are in scope.
- Confirm Financial Advice NZ Limited licence status (FSP1009051) on the Financial Service Providers Register before publishing.
Items flagged for legal sign off: cross-border disclosure basis (IPP 12) and the breach notification wording. Verify current Privacy Act 2020 requirements and any OPC guidance, as the law and guidance can change.