Privacy Policy

1. Introduction

WAWADATA LTD ("WAWADATA", "we", "us", or "our"), a company registered in New Zealand (Company Registration No. 8922888), located at 44 Oriana Avenue, Lynfield, Auckland, 1042, New Zealand, is committed to protecting the privacy and security of your personal information.

This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our Wāwā Assistant service ("Service") and visit our website at www.wawadata.com. This policy applies to all users of our Service and is designed to comply with the New Zealand Privacy Act 2020.

2. Information We Collect

2.1 Information You Provide with Consent

With your explicit consent, we access and process:

• —Email Data: Content and metadata from your Microsoft 365 email accounts
• —Calendar Information: Events and scheduling data from your Microsoft 365 calendar

2.2 Information Collected to Fulfill Our Contract

To provide and maintain our Service, we collect:

• —Account Information: Company name, administrator name, business email address, and contact details
• —Payment Information: Billing details necessary for subscription management (processed through Stripe or bank transfer)
• —User Account Details: Names and email addresses of authorized users within your organization

2.3 Technical Information

For technical support and service maintenance, we collect:

• —IP Addresses: For security and troubleshooting purposes
• —Login Logs: Authentication timestamps and access records
• —Technical Support Records: Communications and issue resolution documentation

2.4 Cookies

We use essential cookies solely for authentication and maintaining your login session. We do not use tracking cookies or analytics cookies on our website.

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• —Consent: For accessing and processing your Microsoft 365 data (emails and calendar)
• —Contract Performance: For account management, billing, and service provision
• —Legitimate Interests: For technical support, security, and service improvements

4. How We Use Your Information

4.1 Primary Uses

• —Provide the Wāwā Assistant service and its features
• —Process and analyze your data as requested
• —Generate reports and insights from your data
• —Maintain and improve our Service

4.2 Secondary Uses

• —Manage your account and subscription
• —Process payments and billing
• —Provide customer support
• —Send service updates and important notifications
• —Ensure security and prevent fraud

4.3 What We Don't Do

• —We NEVER use your data for training AI models
• —We do NOT send marketing emails
• —We do NOT sell or rent your personal information to third parties
• —We do NOT use tracking technologies for advertising

5. Data Storage and Security

5.1 Data Location

• —Your Business Data: Stored exclusively on your private servers under your control
• —Account and Routing Information: Minimal necessary data stored on our secure systems in New Zealand
• —Backup Data: Stored on your own physical media, with backup frequency (daily or weekly) determined by you

5.2 Security Measures

We implement appropriate technical and organizational measures including:

• —HTTPS encryption for all data transmissions
• —JWT/Session-based access controls
• —Limited access to personal data (restricted to authorized technical support personnel, typically no more than 5 people)
• —Access on a need-to-know basis only

5.3 Data Retention

• —Account Information: Retained until service termination
• —Login Logs: Retained until service termination
• —Technical Support Records: Retained for one year after service termination
• —Your Business Data: Retention period determined by you; physical destruction available upon written request

6. Information Sharing and Third Parties

6.1 Service Providers

We share limited information with trusted third-party service providers:

• —Stripe: Payment processing (payment information only)
• —Microsoft: OAuth authentication (authentication tokens only)
• —Cloud Infrastructure (AWS/Azure): Hosting services (may have access to IP addresses and login information)

6.2 Legal Requirements

We may disclose information if required by law, court order, or government regulation, or to protect our rights, property, or safety.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred with prior notice to you.

7. International Data Transfers

• —Currently, we primarily serve customers in New Zealand
• —Login and payment information may be processed by international service providers
• —Your business data may cross borders based on your original Microsoft 365 data location
• —Your specific business data is never transmitted overseas to our servers

8. Your Rights and Choices

Under the New Zealand Privacy Act 2020, you have the right to:

8.1 Access and Control

• —Access Your Data: Your data is stored on your own private servers with full access
• —Correct Information: Request corrections to your account information
• —Delete Information: Request deletion of your account and associated data
• —Object to Processing: Refuse any data processing (we will inform you of any service impacts)
• —Data Portability: Export your data in a usable format

8.2 Response Timeline

We will respond to all privacy-related requests within 30 days.

8.3 Opt-Out Rights

• —You may opt out of any data processing, though this may affect service functionality
• —You cannot opt out of essential service notifications
• —To unsubscribe from services, please contact us directly

9. Automated Decision-Making

The Service may involve automated processing and analysis of your data to generate insights and reports. However:

• —All processed data remains on your private servers
• —We do not retain any results of automated processing
• —You maintain full control over all automated processing outputs
• —Service capabilities may expand based on your requirements, but we only collect information necessary to fulfill service requirements

10. Children's Privacy

Our Service is intended for business use only. We do not knowingly collect personal information from individuals under 18 years of age. Users must be of legal working age in their jurisdiction.

11. Data Breach Notification

In the event of a data breach:

• —We will notify affected users within 48 hours of discovery
• —We will notify the Office of the Privacy Commissioner as required
• —We will provide information about the nature of the breach and recommended actions
• —We will take immediate steps to mitigate any harm

12. Privacy Policy Updates

We may update this Privacy Policy from time to time. When we make changes:

• —We will notify you via email
• —The updated policy will be posted on our website
• —Continued use of the Service after changes constitutes acceptance

13. Contact Information

For privacy-related inquiries, requests, or complaints, please contact:

14. Privacy Commissioner

You have the right to lodge a complaint with the New Zealand Privacy Commissioner:

15. Additional Rights for Specific Jurisdictions

While we primarily operate in New Zealand, if you access our Service from other jurisdictions, you may have additional rights under local laws. Please contact us for more information about rights specific to your location.