+IMPAC Privacy Policy


This privacy policy (Policy) applies to all personal information (as defined in the Privacy Act 1993 (New Zealand) (Privacy Act) held by IMPAC Services Limited (New Zealand Company Number: 977706) and CPNZ Limited (New Zealand Company Number: 3479454) (us, we, our, or IMPAC). IMPAC’s business is to supply products and services to our customers to help them comply with their health and safety regulatory obligations (Services). 

The Policy outlines our policy and practices for collection of personal information, how we use that information, and the options that you have regarding our use of, and your ability to correct, such personal information.
The provisions in this Policy govern only the activities of IMPAC in regard to personal information. If you disclose your personal information to third parties, or if you are directed to a third party website (whether from our Website or by other means) that third party’s privacy notices and practices will apply. We suggest reviewing the third party’s privacy policy before you provide personal information.
In this Policy, where the term “including” is used (or a similar expression is used to denote an example) that term or expression is deemed to be followed by the words “without limitation”.



2.1         We collect personal information for the following purposes:

2.1.1      to verify a person’s identity;

2.1.2      to provide and improve the Services;

2.1.3      to market our Services, including by means of direct electronic communication;

2.1.4      to undertake credit checks (if we deem it necessary);

2.1.5      to bill and collect money that our customers owe us, including authorising and processing credit card transactions;

2.1.6      to respond to communications;

2.1.7      for statistical reporting, marketing purposes, and our internal business use;

2.1.8      to protect and/or enforce our legal rights and interests;

2.1.9      to analyse the traffic of users of the IMPAC website at www.impac.co.nz (Website);

2.1.10    to provide and improve our Website; and

2.1.11    for any other purpose authorised by the person whose personal information it is, or by the Privacy Act.



3.1         By accessing or using the Services, the Website, or by providing information to us, you consent to:

3.1.1      our collection of personal information in accordance with this Policy; and

3.1.2      the onward transfer, processing, collection, use, disclosure, retention and storage of  personal information as described in this Policy.

3.2         We will only collect personal information in a manner that is compatible with this Policy.

3.3         We may collect personal information from the following sources:

3.3.1      our customer’s health and safety policies and practices (including information about any health and safety incidents, and hazard identification register);

3.3.2      our customer’s contact and payment/bank details (including name, address, phone number, email, bank account number, credit card information, transaction data, and invoicing details)

3.3.3      third party data about our customer’s in connection with the Services, including information from:

(a)       WorkSafe New Zealand;

(b)       Inland Revenue; and

(c)       Credit reporting companies;

3.3.4      data and analytics on our customer’s use of the Services; and

3.3.5      traffic, visitor information, and analytics relating to use of the Website and other online aspects of the Services.



4.1         We collect the personal information outlined at clause 4.3 by the following methods:

4.1.1      when a person register for, and/or uses, the Services;

4.1.2      directly from a person including via:

(a)       any registration or subscription process (including in person and via web forms or similar methods of input on the Website);

(b)       any employment application; and

(c)       information provided to us by email, phone, or in person; and

4.1.3      using analytics tools on the Website and other online components of the Services, including through the use of cookies to monitor a user’s use of the Website;

4.1.4      directly from third parties where the person has authorised this; and

4.1.5      from publically available resources.

4.2         If we are unable to collect certain personal information from you, your use of the Services (and user’s use of our Website) may suffer from reduced functionality, and certain features                   may be disabled.



5.1        We will not sell, rent, share, or otherwise disclose any personal information to anyone  except to provide the Services or as otherwise described in this Policy, which may be updated from time to time in accordance with clause 2.

5.2        We may disclose personal information in the following circumstances:

5.2.1     to provide the Services;

5.2.2     to provide the Website; and/or

5.2.3     to meet the purpose(s) for which it was collected (as set out at clause 3).

5.3        We may disclose personal information:

5.3.1     to another company within the IMPAC group;

5.3.2     to any business that supports IMPAC to provide and enhance the Services, including Website hosting, data analysis and storage, payment processing, information  technology and                   related infrastructure, customer service, service maintenance, e-mail delivery, credit card processing, auditing, and other  similar services;

5.3.3     to any credit reporting companies;

5.3.4     in an aggregated form (such that no personal information is identifiable), for statistical reporting and marketing purposes;

5.3.5     for our internal business purposes (including in connection with any audits, professional advice, research, or Service improvements);

5.3.6     to any business that provides IMPAC with direct marketing services;

5.3.7     In connection with a sale of the IMPAC business, or if IMPAC were to merge with or be acquired by another company. If IMPAC were to merge with or be acquired by another                             company, we may share information with them in accordance with our privacy  standards. Should such an event occur, we will use our best endeavors to ensure that the new                             combined entity follow this Policy with respect to personal information;

5.3.8     to comply with a request from any regulatory or law enforcement authorities. We will  provide requested information in compliance with local laws and regulations, and only  in the                    instance and to the extent where we reasonably believe that we are  legally required to do so; and

5.3.9     to any other person authorised by the person whose personal information it is, or by the Privacy Act.



6.1         We will take reasonable steps to keep personal information safe from loss, unauthorised activity, or other misuse.

6.2         The Services and the Website may be hosted internally or by third party cloud services, and as a result, personal information may be processed and stored outside of New Zealand.

6.3         We will take reasonable steps to maintain secure internet connections. Please note that when providing personal information via our Website, the transmission may not  be                                 completely secure and will depend on your browser and internet settings. We cannot guarantee the security of data transmitted to us via our Website and any such transmission is at                 your own risk.

6.4         If you wish to retain a copy of your personal information (or any part of it) please contact us prior to you ceasing to use the Services, otherwise, upon:

6.4.1      you ceasing to use the Services; and

6.4.2      IMPAC no longer being required to comply with any legal obligations that necessitate  the retention of personal information, we will securely delete your personal information.

6.5         Despite clause 6.4 we may retain personal information in an aggregated and non- identifying form.



7.1         You have the right to:

7.1.1      access any of your personal information; and

7.1.2      request correction of any of your personal information, held by us by contacting us using the details given at clause 8.

7.2         Please provide evidence to confirm your identity, and set out the details of your  request (including the personal information or correction) when you contact us.

7.3        We will respond to any request in accordance with the Privacy Act (including making available to any readily retrievable personal information, making corrections that are reasonable                 and that we are reasonably able to, and charging for costs reasonably incurred by us).



8.1          If you wish to contact us in relation to this Policy, our privacy standards, or our  personal information-handling practices please contact us using the details below:

                                           Email: personalinfo@impac.co.nz

8.2          Note that emails to this address may be distributed to IMPAC personnel and tracked for reporting purposes.



We may revise and change this policy from time to time, any changes will apply from the date that we upload the revised policy to our website.  Version: 1.0 - Last updated: 5 July 2017