Privacy Policy

01Who we are

Atlas is an IT consultancy based in Auckland, New Zealand. Our registered office is Level 2, 106 Customs Street West, Auckland Central, Auckland, 1010, New Zealand.

In this policy, “we”, “us”, and “our” mean Atlas. “You” means anyone whose personal information we hold, including visitors to this website, people who contact us, our clients, and the staff of our clients whose devices and accounts we administer.

We are subject to the Privacy Act 2020 in New Zealand. Where we handle personal information about people in Australia, the Australian Privacy Act 1988 and the Australian Privacy Principles may also apply, and where we handle personal information about people in the European Union or the United Kingdom, the relevant data protection law there may also apply.

02What we collect

We collect different information depending on how you deal with us.

When you use this website: Your IP address, browser and device type, the pages you visit, how you arrived, and how you interact with the page. This is collected through analytics and session recording tools described below. Some of it may be personal information under the Privacy Act, either on its own or combined with other information.
When you contact us: Your name, email address, phone number, organisation, and whatever you choose to write in your message. You give us this directly and you decide how much of it to provide, although we cannot answer an enquiry without a way to reply to it.
When you become a client: Contact and billing details for your organisation and its people, the information needed to deliver the services you have engaged us for, and records of the work we do. This is set out in your agreement with us.
When we administer your systems: In delivering managed services we may hold administrative access to systems containing your organisation’s information, including personal information about your staff and, in some cases, your own customers. We access it to deliver the service and for no other purpose. Where we hold it on your behalf, you remain the agency or entity responsible for it and we act on your instructions.
When you apply for a role: Your CV, contact details, work history, and anything else you send us. We keep unsuccessful applications for a limited period in case a suitable role comes up, and you can ask us to delete them sooner.

We do not knowingly collect personal information from children, and this website is not directed at them.

03Cookies, analytics, and session recording

This website uses cookies and similar technologies. A cookie is a small file a site stores in your browser so it can recognise your browser on a later visit. Some are needed for the site to work at all. Others exist so we can understand how the site is used.

We use two third-party tools, and we would rather name them than describe them vaguely.

Google Analytics: Provided by Google. It tells us which pages are visited, how people arrive, roughly where in the world they are, and what device they use. It sets cookies in your browser and sends that information to Google, which processes it outside New Zealand. We use it to understand which parts of the site are useful and which are not.
Microsoft Clarity: Provided by Microsoft. Clarity records how people interact with pages, including mouse movement, clicks, scrolling, and the sequence of pages visited, and produces session replays and heatmaps from it. This is more detailed than page-view analytics and we think you should know it is happening. Clarity is configured to mask text entered into form fields, so what you type into our contact form should not appear in a recording, and we do not use it to identify individuals.

New Zealand does not have a law equivalent to the European cookie rules, and there is no statutory requirement here for a banner that blocks the site until you choose. Rather than imply otherwise, we have set out plainly what runs on this site and what you can do about it. If you would prefer not to be included in either tool, any of the following works.

Turn on your browser’s “Do Not Track” or tracking prevention setting. Both tools are configured to respect it where the browser sends it.
Install the Google Analytics opt-out browser add-on, published by Google.
Block cookies for this site in your browser settings, or use a private or incognito window.
Use a content blocker. We do not attempt to detect or defeat one.

None of these will stop the website working. If you are reading this from the European Union or the United Kingdom, where prior consent is required before non-essential cookies are set, contact us and we will tell you what we currently do about that rather than making a claim here we have not verified for your jurisdiction.

04Why we use it

We use personal information to:

answer your enquiry and, where relevant, prepare a quote or proposal;
deliver the services you or your organisation have engaged us for;
administer and support the systems we manage on your behalf;
invoice and keep the financial records we are required to keep;
meet legal, regulatory, and contractual obligations, including in regulated sectors we work in;
understand how this website is used, so we can improve it; and
send you information about our services where you have asked for it or where we are permitted to.

We do not sell personal information. We do not use it for automated decision-making that produces legal or similarly significant effects for you.

05Who we share it with

We share personal information only where there is a reason to. In practice that means:

service providers who help us operate, including our email, hosting, analytics, accounting, and support platforms, each of which is bound to use the information only to provide that service;
vendors and distributors, where supplying or licensing a product for you requires it, such as registering a licence in your organisation’s name;
professional advisers, where we need legal, accounting, or insurance advice;
a purchaser or successor, if our business or part of it is sold or restructured; and
anyone else where you have asked us to, or where the law requires or permits it.

Where we engage a provider outside New Zealand, we take reasonable steps to satisfy ourselves that the information will be protected by comparable safeguards, as the Privacy Act requires of us. Several of the platforms we rely on, including those named above, process information overseas.

06How we protect it

We take reasonable steps to protect personal information against loss, misuse, and unauthorised access. Those steps include multi-factor authentication on our accounts, access granted by role rather than broadly, encryption of devices, logging and review of administrative access, endpoint protection, backups, and staff training. This is the same standard of work we sell, and it would be an awkward position to be in otherwise.

No system is completely secure, and we will not claim ours is. If we have a privacy breach that has caused or is likely to cause serious harm, we are required under the Privacy Act 2020 to notify the Office of the Privacy Commissioner and the people affected, and we will do so as soon as practicable. Where the Australian notifiable data breach scheme applies, we will notify the Office of the Australian Information Commissioner as required.

07How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as we are required to by law. In practice:

Enquiries that do not become work: Kept for a reasonable period in case you come back to us, then deleted. You can ask us to delete an enquiry sooner.
Client records: Kept for the life of the engagement and afterwards for the period required by tax, company, and limitation law, and by any obligation in your sector.
Website analytics: Retained according to the settings of the tool concerned. Session recordings in Clarity are retained for a limited period and then deleted by Microsoft.
Job applications: Kept for a limited period after the role is filled, unless you ask us to delete them earlier.

08Your rights

Under the Privacy Act 2020 you have the right to ask us for the personal information we hold about you, and to ask us to correct it if it is wrong. These are real rights, not a formality, and we will not make you work to use them.

You can ask us to:

confirm whether we hold personal information about you, and give you a copy of it;
correct anything that is wrong, or attach a statement of correction if we disagree;
delete information we no longer have a reason to hold;
stop sending you marketing, which you can also do from the link in any message; and
explain anything in this policy that is not clear.

We will respond as soon as we reasonably can and, for a request for access or correction, within twenty working days as the Privacy Act requires. We may need to verify who you are first, which protects you rather than us. There is no charge for a request in normal circumstances.

09Contact and complaints

For any privacy request, question, or complaint, contact our privacy officer:

Email: compliance@newconsulting.co.nz
Post: Privacy Officer, Atlas, Level 2, 106 Customs Street West, Auckland Central, Auckland, 1010, New Zealand
Phone: 0800 639 255

If you are not satisfied with how we have handled your complaint, you can take it to the Office of the Privacy Commissioner in New Zealand at privacy.org.nz, or to the Office of the Australian Information Commissioner at oaic.gov.au if the Australian Privacy Act applies to you. You do not need our permission to do that, and we would rather you did than stayed unhappy.

10Changes to this policy

We update this policy when what we do changes, or when the law does. The date at the top of this page is when it was last reviewed. Where a change is significant we will say so rather than quietly reissuing it.