Privacy Policy

This policy explains how asBuiltIQ collects, uses, shares and protects personal information, and the choices and rights you have. It applies to our website, our Vault and PayLab software (our “products”), our capture and consulting services, and our dealings with customers, suppliers and job applicants.

“asBuiltIQ”, “we” and “us” mean asBuiltIQ Limited and its subsidiaries asBuiltIQ NZ Ltd, asBuiltIQ Australia Pty Ltd and asBuiltIQ UK Limited. We handle personal information in line with:

• the New Zealand Privacy Act 2020 and its Information Privacy Principles;
• the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), including the Notifiable Data Breaches scheme; and
• the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When we decide how your information is used (for example, our website, enquiries, marketing, account administration, billing and recruitment), we are responsible for it. Under the UK GDPR we are the “controller”.

When our customers use our products, they decide what information is uploaded and how it is used, and we process it on their behalf under our customer agreement. Under the UK GDPR we are the “processor” for that information. If your information is held in a customer's Vault or PayLab project, please contact that customer first; we will help them respond to your request.

We do not intend to collect sensitive information (such as health information or information about racial or ethnic origin) and we ask customers not to upload it to our products. If it is collected incidentally, we protect it in the same way and delete it when it is no longer needed. You can deal with us anonymously or using a pseudonym where that is practical, for example for a general enquiry, but we need to identify you to give you access to our products.

We only use personal information for the purpose for which it was collected, a related purpose you would reasonably expect, or as permitted or required by law. We do not sell personal information. We do not use customer project data to train or improve artificial intelligence models. Where we use automated analysis in our products, it is applied to construction data for our customers and is not used to make decisions about individuals that have legal or similarly significant effects.

We share personal information only where needed for the purposes above:

• Service providers (subprocessors) who host or support our services, under contracts that require them to protect the information and use it only on our instructions;
• professional advisers, such as accountants, auditors, insurers and lawyers;
• the customer whose project the information belongs to; and
• authorities where required by law, or to protect the rights, property or safety of asBuiltIQ, our customers or others.

Our main subprocessors are:

A current list is available on request from our Privacy Officer.

We operate in New Zealand, Australia and the United Kingdom, and some of our service providers process information in the United States. Before personal information is sent overseas, we take reasonable steps to make sure it is protected to a standard comparable to the laws that apply to us:

• under the NZ Privacy Act (Information Privacy Principle 12), we rely on comparable safeguards or contractual protections;
• under the Australian Privacy Act (APP 8), we take reasonable steps to ensure overseas recipients handle it consistently with the APPs; and
• under the UK GDPR, transfers outside the UK rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

Customers can choose the Azure region (Australia or the United Kingdom) in which their product data is hosted.

• Customer project data is kept for the term of the customer agreement and returned or securely deleted within 90 days of the end of the agreement, unless the agreement requires otherwise.
• Account and security logs are kept for 90 days to protect our services and investigate incidents.
• Business, billing and contract records are kept for the periods required by tax and company law (generally 7 years).
• Enquiry and marketing records are kept while there is an active relationship, or until you ask us to stop contacting you.
• Unsuccessful job applications are kept for 12 months, unless you ask us to delete them sooner.

When information is no longer needed, we securely delete it or de-identify it.

We run an information security management system aligned with ISO/IEC 27001. Our safeguards include:

• encryption of data in transit and at rest;
• access limited to people who need it for their job, with multi-factor authentication, single sign-on and regular access reviews;
• security monitoring, vulnerability management and penetration testing;
• backups, business continuity planning and secure disposal of equipment;
• security and privacy training for staff, and confidentiality obligations for staff and suppliers; and
• on request, blurring of faces and signs in captured imagery.

If a privacy breach is likely to cause serious harm, we will notify the people affected and the relevant regulator as required: the Office of the Privacy Commissioner (New Zealand), the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and the Information Commissioner's Office (United Kingdom, within 72 hours where required). Where we act for a customer, we will notify that customer without undue delay so they can meet their obligations.

You can ask to access the personal information we hold about you and ask us to correct it. If you are in the United Kingdom, you also have the right to ask us to erase it, restrict or object to how we use it, to data portability, and to withdraw consent where we rely on consent.

To make a request, contact our Privacy Officer (section 12). We may need to confirm your identity. We will respond within the time required by law: as soon as reasonably practicable and within 20 working days in New Zealand, within 30 days in Australia, and within one month in the United Kingdom. We do not charge for making a request. If we refuse a request, we will explain why and how you can complain. If you ask us to correct information and we disagree, you can ask us to attach a statement of the correction sought.

Our website does not use analytics, advertising or other tracking cookies. The only cookies that may be set are those strictly necessary for the website to work and to protect it from malicious traffic, which do not require consent. You can block or delete cookies in your browser settings.

If you have a question or complaint about how we handle personal information, contact our Privacy Officer:

We will acknowledge your complaint within 5 working days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the regulator:

• New Zealand: Office of the Privacy Commissioner – privacy.org.nz, 0800 803 909
• Australia: Office of the Australian Information Commissioner – oaic.gov.au, 1300 363 992
• United Kingdom: Information Commissioner's Office – ico.org.uk, 0303 123 1113

We review this policy at least once a year and update it when our services, our service providers or the law change.