How TrustPoint handles your information.

1. Who We Are

TrustPoint is operated by Bryan White trading as LivewireSolutions, based in Masterton, Wairarapa, New Zealand. We provide a subcontractor compliance platform for NZ builders and contractors at trustpoint.nz.

We are bound by the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles (“IPPs”). This policy explains how we handle personal information in accordance with those principles.

Questions or complaints about how we handle your personal information should be directed to: operations@trustpoint.nz

2. What Information We Collect and Why

We collect only the information needed to operate the Platform. The table below maps each category of information to the purpose for which it is collected (IPP 1: Purpose of Collection).

We do not collect information we do not need. We do not collect sensitive information (as defined by the Privacy Act) except where it is incidental to a compliance document you choose to upload.

3. How We Collect Information

We collect information:

• Directly from you when you register an account, upload documents, set site requirements, or interact with the Platform;
• From Workers at site gates when they enter their mobile phone number to complete a QR code induction;
• From government registers when we query the MBIE Companies Register, LBP Register, or Insolvency Register in connection with your account (see Section 5);
• Automatically via server logs and session cookies during Platform use.

Where information is collected at a site gate, Workers are presented with a Gate Privacy Notice before they submit their phone number (IPP 3: Collection of Information from Subject).

4. Who Can See Your Information

4.1 Builder and Contractor relationships

Compliance documents and Readiness States are visible only within the specific Builder and Contractor relationship in which they were submitted. A Contractor’s documents are not shared across different Builder relationships without the Contractor’s knowledge. Each Builder sees only the information pertaining to Contractors with whom they have an active relationship on the Platform.

4.2 Worker gate records

Site gate induction records (including phone number, timestamp, and readiness state) are visible to the Builder who owns that site. Workers’ phone numbers are not shared between different Builder accounts.

4.3 TrustPoint staff

TrustPoint staff may access account and compliance data where necessary to provide support, investigate a security incident, or comply with a legal obligation. Support access requires a time-limited consent token generated by the Contractor in their account settings.

4.4 Third parties

We do not sell, rent, or trade your personal information. We may share information with:

• Our hosting provider (see Section 6) as necessary to operate the Platform;
• Brevo (our email delivery service) solely to send transactional emails on our behalf;
• TNZ (our SMS delivery provider) solely to send SMS OTP messages at site gate inductions;
• Stripe (our payment processor) for billing purposes (Builder account holders only);
• Law enforcement or regulatory authorities where we are legally required to do so, including WorkSafe NZ in connection with a health and safety investigation.

Each of these third-party services operates under its own privacy policy and is engaged only to the extent necessary for the service they provide.

5. Government Register Data

TrustPoint integrates with three MBIE government registers to verify compliance information. This integration is used solely for compliance purposes as authorised under applicable legislation.

• New Zealand Companies Register (NZBN): We check contractor company status (active, dissolved, liquidation, etc.) at account creation and on a weekly basis. Data sourced from the New Zealand Companies Register, Ministry of Business, Innovation and Employment.
• Licensed Building Practitioners (LBP) Register: We verify worker LBP licence numbers and status at the time of document upload. Data sourced from the Licensed Building Practitioners Register, Ministry of Business, Innovation and Employment.
• Insolvency Register: We check contractor companies for active insolvency proceedings at relationship creation. Insolvency data is queried live and not cached, in accordance with MBIE data licence requirements. Data sourced from the New Zealand Insolvency Register, Ministry of Business, Innovation and Employment.

Register query results are stored against the relevant account record and are displayed with attribution and the date/time of the last check. We do not modify or supplement register data.

6. Hosting and Data Storage

The Platform and its database are hosted in New Zealand on a third-party shared hosting infrastructure. We take reasonable steps to ensure that our hosting provider maintains appropriate security controls, including SSL encryption, access controls, and regular backups.

All data is stored within New Zealand. We do not transfer personal information to servers outside New Zealand (IPP 12: Disclosure of Information Outside New Zealand).

The Platform database is encrypted at rest. All connections to the Platform are encrypted in transit via HTTPS (TLS).

7. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law (IPP 9: Retention of Personal Information).

7.1 Compliance and audit records

Gate induction records, document approval records, override records, and audit trail events are retained for seven years from the date of creation. This period reflects the practical requirements of WorkSafe NZ investigations and civil proceedings under HSWA 2015, which may arise years after an incident.

Retention applies regardless of whether a Builder cancels their subscription. You will be notified before records are purged under our data retention schedule.

7.2 Account data

Account holder information (name, email, company details) is retained for the duration of your account and for 12 months after account closure, after which it is deleted or anonymised.

7.3 Worker phone numbers

Worker phone numbers collected at gate inductions are retained as part of the induction record for seven years. Workers may request access to or deletion of their gate induction records in accordance with Section 8 of this policy.

7.4 Uploaded documents

Documents uploaded to the Platform are retained for the duration of the relevant Builder and Contractor relationship and for up to seven years thereafter to support potential WorkSafe audits or legal proceedings.

8. Your Rights Under the Privacy Act 2020

Under the Privacy Act 2020, you have the following rights in relation to personal information we hold about you (IPP 6: Access to Personal Information; IPP 7: Correction of Personal Information):

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may ask us to correct personal information that is inaccurate, incomplete, or misleading.
• Deletion: You may ask us to delete personal information where there is no lawful reason to retain it. Note that certain compliance and audit records may be retained as described in Section 7, even following a deletion request, where retention is required for legal or health and safety record-keeping purposes.
• Portability: You may request a copy of your compliance data in a machine-readable format where technically practicable.

To exercise any of these rights, contact us at operations@trustpoint.nz. We will respond within 20 working days as required by the Privacy Act 2020. We may need to verify your identity before fulfilling a request.

For deletion requests specifically, please read our Personal Information Erasure Process, which explains what can be deleted, what is retained for health and safety compliance purposes, and what pseudonymisation means in practice.

9. Data Breaches

If we become aware of a privacy breach that we reasonably believe has caused or is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner and the affected individuals as soon as reasonably practicable, as required by Part 7 of the Privacy Act 2020.

We maintain security monitoring and incident response procedures to detect and respond to potential breaches promptly.

10. Cookies and Session Data

The Platform uses session cookies to maintain your logged-in state. These cookies are:

• set with HttpOnly and Secure flags (transmitted over HTTPS only);
• scoped with SameSite=Lax to reduce cross-site request exposure;
• deleted when you log out or your session expires.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies. We do not use Google Analytics or any equivalent third-party analytics service.

11. Children

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. We will notify you of material changes by email or by prominent notice on the Platform. The date at the top of this page indicates when the policy was last updated.

13. Contact and Complaints

For questions, access requests, correction requests, or complaints about how we handle your personal information, contact us at:

TrustPoint / LivewireSolutions
Email: operations@trustpoint.nz
Masterton, Wairarapa, New Zealand

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner:

privacy.org.nz · Phone: 0800 803 909