Privacy Policy

1. Overview

Weta Security Ltd ("Weta Security", "we", "us", or "our") is committed to protecting the privacy and security of personal information we collect in the course of providing cyber security services. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information in accordance with the New Zealand Privacy Act 2020 and applicable data protection legislation.

By engaging our services or using our website at wetasecurity.nz, you acknowledge that you have read and understood this policy.

2. Information We Collect

We may collect the following categories of personal information:

• Contact information — name, email address, phone number, and business address provided when you enquire or engage our services.
• Business information — organisation name, job title, industry sector, and information about your IT environment relevant to scoping an engagement.
• Technical data — IP addresses, system logs, network topology, and vulnerability data collected solely for the purpose of conducting authorised security assessments.
• Website usage data — browser type, pages visited, referral source, and session duration collected via cookies and analytics tools.
• Communications — records of correspondence, meeting notes, and contractual documentation.

We do not knowingly collect personal information from individuals under the age of 18. We do not collect sensitive information (as defined under the Privacy Act 2020) unless it is strictly necessary for an engagement and with your explicit consent.

3. How We Use Your Information

We use collected information for the following purposes:

• Delivering contracted vulnerability scanning, penetration testing, and security advisory services.
• Scoping, planning, and conducting authorised security assessments of your systems and infrastructure.
• Communicating assessment findings, remediation advice, and follow-up re-test results.
• Managing our business relationship, invoicing, and contractual obligations.
• Improving our services, website, and internal security practices.
• Complying with legal obligations and responding to lawful requests from authorities.
• Sending service-related updates and, where you have opted in, relevant security advisories or company news.

4. Data Handling in Security Engagements

Given the sensitive nature of our work, we apply heightened controls to data collected during security engagements:

• All engagement data is handled under a signed confidentiality agreement (NDA) prior to commencement.
• Vulnerability data, credentials, and system information are stored in encrypted, access-controlled repositories accessible only to the assigned engagement team.
• Raw technical findings are retained only for the period required to complete the engagement and deliver the final report, unless a longer retention period is agreed in writing.
• Data is stored within New Zealand jurisdiction except where a client expressly requires otherwise.
• Engagement data is securely destroyed at end-of-life using NIST SP 800-88 guidelines.

We do not use client system data, vulnerability findings, or proprietary technical information for any purpose other than delivering the agreed engagement.

5. Disclosure of Personal Information

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

• Service partners — trusted subcontractors or specialist consultants engaged under NDA to assist with specific technical work, bound by equivalent data protection obligations.
• Legal compliance — where we are required to disclose information by law, court order, or lawful request from a New Zealand government authority.
• Incident response — where disclosure is necessary to prevent or respond to an active security threat that poses serious risk to life or safety.
• Business transfer — in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections being maintained.

We will notify you of any required disclosure to the extent permitted by law.

6. Cookies and Website Analytics

Our website uses cookies and similar technologies to operate correctly and improve user experience. These include:

• Essential cookies — required for the website to function and cannot be disabled.
• Analytics cookies — used to understand how visitors interact with our site. Data is aggregated and anonymised.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.

7. Security of Your Information

As a cyber security company, we hold ourselves to a high standard in protecting the information entrusted to us. Our controls include:

• AES-256 encryption for data at rest and TLS 1.3 for data in transit.
• Role-based access controls with multi-factor authentication enforced for all staff systems.
• Regular internal security reviews and penetration testing of our own infrastructure.
• Staff training on data handling, phishing awareness, and secure development practices.
• An incident response plan with defined notification procedures in the event of a data breach.

8. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request that inaccurate or incomplete information be corrected.
• Deletion — request deletion of your personal information where we no longer have a lawful basis to retain it.
• Objection — object to the processing of your personal information for direct marketing purposes.
• Complaint — lodge a complaint with the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

To exercise any of these rights, please contact us at privacy@wetasecurity.nz. We will respond within 20 working days as required by law.

9. Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Client engagement records are retained for a minimum of seven years for legal and compliance purposes. Website analytics data is retained for up to 24 months. You may request earlier deletion subject to any overriding legal obligations.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The date at the top of this page indicates when it was last revised. We encourage you to review this policy periodically. Continued use of our services after a material change constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, access requests, or complaints, please contact our Privacy Officer:

• Email: privacy@wetasecurity.nz
• Post: Privacy Officer, Weta Security Ltd, Auckland, New Zealand
• Phone: +64 9 000 0000