Privacy Policy

Who We Are

Tahi Wealth Limited ("Tahi", "we", "us") is a New Zealand registered company providing a personal finance platform. We are the controller of the personal and financial data you provide to us or that is retrieved on your behalf. Our registered address and contact details are at the bottom of this policy.

What Data We Collect

Account data

• •Your name and email address, collected at registration via Auth0
• •Your profile details (date of birth, employment type, salary, mortgage balance) that you choose to provide

Bank and transaction data

• •Bank account names, numbers, and current balances, retrieved via Akahu
• •Transaction history including dates, amounts, descriptions, and merchant information
• •Running balance snapshots over time

KiwiSaver and investment data

• •KiwiSaver provider, fund name, current balance, and contribution rate
• •Investment holdings, fund names, and values from connected providers such as InvestNow and SmartShares

Insurance data

• •Insurance policy details (insurer, policy number, status, premiums, and benefit types) recorded by a connected adviser on your behalf

Goals and plans

• •Financial goals and targets you set within the Platform
• •Statements of Advice (SOAs) recorded by connected advisers, including your approval or decline of that advice

Usage data

• •Log data including IP address, browser type, and pages accessed
• •Cookie and session data (see our Cookie Policy)

How We Collect Your Data

• •Directly from you when you register, set up your profile, or enter information in the Platform
• •Via Akahu when you link a bank account. Akahu retrieves your data from your bank using open banking connectivity and passes it to Tahi
• •Via your connected financial adviser, who may record insurance policies, advice notes, and Statements of Advice on your behalf
• •Automatically through your use of the Platform (log files, session data)

How We Use Your Data

• •To display your financial position in one place across all connected accounts
• •To power calculators, projections, and insights within the Platform
• •To enable your connected financial adviser to view your data (only with your explicit consent)
• •To send you service notifications, including advice documents sent by your adviser
• •To maintain the security and integrity of the Platform
• •To comply with our legal obligations

We do not use your financial data to train machine learning models for sale to third parties, nor do we sell your data in any form.

Who We Share Your Data With

We do not sell, rent, or trade your personal information. We share your data only in the following circumstances:

Service providers

• •Akahu Limited: to retrieve your bank account and transaction data on your behalf
• •Auth0 (Okta): to manage authentication and identity verification
• •Amazon Web Services (AWS): to host the Platform and store your data securely
• •Resend: to deliver transactional emails (such as advice notifications)

Your financial adviser

If you connect a financial adviser to your account, your financial data will be shared with that adviser. This is done only with your explicit consent. See our Adviser Data Sharing Disclosure for the full scope of what advisers can see. You can revoke an adviser's access at any time.

CRM systems (optional)

If you give optional consent during adviser onboarding, your adviser may sync a snapshot of your Tahi financial data to their practice management software (such as Xplan or Wealthplan). This consent is separate from the core adviser access consent and can be withheld without affecting your adviser relationship.

Legal requirements

We may disclose your information if required to do so by law or in response to a valid request by a public authority (such as a court or government agency).

How Long We Keep Your Data

We retain your personal and financial data for as long as your account is active. If you close your account:

• •We will delete your personal profile and financial data within 30 days of account closure
• •Statements of Advice and compliance records created by a connected adviser may be retained by your adviser under their own regulatory obligations
• •Anonymised or aggregated data (not linked to you) may be retained for analytical purposes

Data Security

We take the security of your financial data seriously. Our security measures include:

• •All data is encrypted in transit (TLS) and at rest
• •Bank account access tokens are stored in encrypted form and never exposed in plaintext
• •Access to production systems is restricted and logged
• •Authentication is handled by Auth0, which provides industry-standard security including multi-factor authentication support

No method of electronic transmission or storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

Cookies

We use cookies and similar tracking technologies to maintain your session and understand how the Platform is used. You can learn more in our Cookie Policy.

Your Rights Under the Privacy Act 2020

Under the Privacy Act 2020 (New Zealand), you have the right to:

• •Access the personal information we hold about you
• •Request correction of any inaccurate or incomplete information
• •Ask us to stop using your information for direct marketing
• •Withdraw your consent and close your account at any time
• •Make a complaint to the Office of the Privacy Commissioner if you believe your privacy rights have been breached

To exercise any of these rights, contact us at support@tahiwealth.co.nz. If you believe your privacy has been breached, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

Data Stored Outside New Zealand

Some of your data is processed and stored by our service providers outside New Zealand, including in Australia and the United States (AWS and Auth0). These providers operate under their own privacy frameworks. Where data is transferred internationally, we take reasonable steps to ensure it is protected to a standard comparable to the New Zealand Privacy Act 2020.

Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or by a prominent notice within the Platform before the changes take effect. Your continued use of the Platform after that point constitutes acceptance of the updated policy.

Contact Us

For any questions about this Privacy Policy or to exercise your rights, please contact us at support@tahiwealth.co.nz.