FOUNDHER

Our Commitment to Your Privacy

FoundHer is committed to protecting your personal information in accordance with the Privacy Act 2020, the Privacy Amendment Act 2025, and other applicable laws. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our services or visit our website.

FoundHer is operated by FoundHer Financial Planning Ltd, a licensed Financial Advice Provider (FSP1009249). Our Privacy Officer can be contacted at [email protected]. If you have any questions or concerns about this policy, please get in touch at that address.

1. What Information We Collect

We collect personal information necessary to provide our financial advice services and operate our business. We collect this information directly from you. We do not collect personal information about you from other people or organisations.

1.1 Information You Provide Directly

When you engage with FoundHer, you provide information directly through meetings, phone calls, online forms, or email correspondence. This may include:

• Contact information (name, email address, phone number, postal address)
• Financial information (income, assets, liabilities, KiwiSaver details, investment holdings)
• Date of birth
• Personal circumstances (employment status, family situation, financial goals)

1.2 Information We Collect Automatically from Your Website Visit

When you visit foundher.co.nz, we automatically collect certain technical information about your visit using cookies, analytics tools, and session recording tools. This is explained in detail in Section 3 below.

2. How We Use Your Information

We use your personal information only for lawful and relevant purposes related to our financial advice services. These purposes include:

• Providing financial advice and ongoing service to you
• Managing our relationship with you, including responding to enquiries and providing updates
• Marketing our own services to you, which you can opt out of at any time
• Complying with legal and regulatory obligations, including reporting to the Financial Markets Authority, tax authorities, and other regulatory bodies
• Protecting our legal rights and interests
• Conducting anonymised research to improve our services
• Website performance analysis, user experience analysis, advertising, and remarketing (see Section 3)

We do not sell, trade, or rent your personal information. We do not give your personal information to any other person or organisation for their own marketing purposes.

We will not use your personal information for any purpose other than the reason it was collected, unless you consent or the Privacy Act 2020 permits disclosure, for example to prevent or lessen a serious threat to public health or safety.

3. Cookies and Tracking Technologies

When you visit foundher.co.nz, we use cookies, analytics tools, and session recording tools to understand how visitors interact with our website, improve user experience, develop our content strategy, and deliver targeted advertising. This section explains what tools we use, what data is collected, and how you can control these technologies.

3.1 What Are Cookies?

Cookies are small text files stored on your device (computer, phone, or tablet) when you visit a website. They help websites remember information about your visit, such as your preferences or browsing behaviour. Cookies can be:

• First-party cookies: Set by foundher.co.nz itself
• Third-party cookies: Set by external services like Google Analytics or Meta
• Session cookies: Temporary cookies that expire when you close your browser
• Persistent cookies: Remain on your device for a set period or until you delete them

3.2 Session Recording and Heatmaps

Some of the tools we use record how you move through our website. This is called session replay. It captures mouse movement, clicks, scrolling, page navigation, and how long you spend on each page, and it replays that activity as a recording.

We also use heatmap recording, which combines data from many visitors to show where people click and how far down a page they scroll.

The tools that do this are Microsoft Clarity and OpenReplay, described below.

3.3 What Tracking Tools We Use

FoundHer uses the following third-party tools on foundher.co.nz.

Google Analytics 4 (GA4)

Provider: Google LLC

Purpose: To analyse website traffic, understand user behaviour, measure website performance, improve content strategy, and optimise advertising campaigns including Google Ads

Data collected: IP address (anonymised), browser type and version, device type (desktop, mobile, tablet), operating system, pages visited, time spent on each page, links clicked, referring website, geolocation data (country, region, city), session duration, and browsing behaviour

Cookie type: First-party and third-party persistent cookies

Retention period: Google Analytics cookies are retained for up to 24 months

Where data is held: Google Analytics transfers data to servers in the United States and other countries.

Learn more: How Google uses information from sites or apps that use our services

Meta Pixel

Provider: Meta Platforms, Inc.

Purpose: To measure the effectiveness of advertising campaigns, track conversions such as form submissions or bookings, build custom audiences for targeted advertising on Facebook and Instagram, and enable remarketing to website visitors

Data collected: IP address, browser type, device identifiers, pages visited, buttons clicked, forms submitted, referring website, and browsing behaviour

Cookie type: Third-party persistent cookies

Retention period: Meta Pixel cookies are retained for up to 90 days

Where data is held: Meta Pixel transfers data to servers in the United States and other countries.

Google Tag Manager

Provider: Google LLC

Purpose: To manage and deploy tracking codes on our website without modifying the website code directly

Data collected: Google Tag Manager does not itself collect personal data. It is a container that deploys other tools, which then collect data as described in this section.

Cookie type: First-party cookies

Microsoft Clarity

Provider: Microsoft Corporation

Purpose: To record and replay website sessions, and to generate heatmaps showing where visitors click and scroll

Data collected: Mouse movement, clicks, scrolling, page navigation, pages visited, session duration, device type, browser type, operating system, and approximate location derived from IP address

Cookie type: First-party and third-party cookies

Retention period: Session recordings are available to us for up to 30 days from the time of recording

Where data is held: Microsoft stores this data in the Microsoft Azure cloud, in the United States.

GoHighLevel

Provider: HighLevel Inc.

Purpose: Customer relationship management, bookings, forms, and email communication, including tracking how you interact with our website and our emails

Data collected: Contact details you submit through our forms and booking pages, together with records of how you interact with those pages and with emails we send you

Learn more: HighLevel Privacy Policy

OpenReplay

Provider: OpenReplay (Asayer SAS)

Purpose: To record and replay website sessions

Data collected: Mouse movement, clicks, scrolling, page navigation, pages visited, session duration, and device and browser information

Learn more: OpenReplay Privacy Policy

3.4 Legal Basis for Using Cookies

We use cookies and tracking technologies based on the following grounds:

• Legitimate interest, for essential analytics: We have a legitimate interest in understanding basic website traffic and performance to maintain and improve our services.
• Consent, for advertising and remarketing: For cookies used for advertising and remarketing purposes, we rely on your consent as described above through your continued use of the website after being informed of these practices.

3.5 How to Control Cookies and Opt Out

You have control over cookies and tracking technologies. You can opt out or manage your preferences at any time.

Browser settings

Most web browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Block third-party cookies only
• Delete cookies after each browsing session
• Be notified when a cookie is set

For instructions on how to manage cookies in your browser, visit:

• Chrome: support.google.com/chrome/answer/95647
• Firefox: support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• Safari: support.apple.com/en-nz/guide/safari/sfri11471/mac
• Edge: support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge

4. How We Share Your Information

We only share your personal information when necessary to provide our services, when required by law, or with your explicit consent. We do not sell or trade your personal information to any other company or person, and we do not share it with anyone for their own marketing purposes.

We may share your information with:

• Business partners: IT service providers, cloud storage providers, accountants, legal advisers, and compliance consultants
• Financial product providers: KiwiSaver providers, investment platforms, banks, and insurance companies, when necessary to implement your financial advice
• Regulatory bodies: Financial Markets Authority, Inland Revenue, and other regulatory authorities, if legally required or requested
• Debt collection agencies: If necessary to recover unpaid fees
• Locum advisers: A qualified substitute financial adviser to ensure service continuity if we are unavailable. They will be bound by confidentiality and will only use your data for that purpose
• Third-party providers: As described in Section 4.1 below
• Other authorised entities: Any other parties authorised by law

4.1 The Providers We Use

The following providers handle personal information as part of how we operate. They fall into two groups, and the difference matters to you.

Providers acting on our instruction

These companies process information on our behalf. You do not have an account or an agreement with them.

• GoHighLevel. Customer relationship management, bookings, forms, and email. Privacy policy
• Google Cloud. File and data storage. How Google uses information
• Contented AI. Meeting summarisation and drafting assistance, as described in Section 5.

Providers you contract with directly

With these providers, you set up your own account and agree their terms with them.

• Akahu. Open banking. You authorise the connection to your bank and accept Akahu's terms with Akahu directly. You can manage or revoke that connection at any time. Akahu privacy information
• Eccuity. Financial planning platform, described below.

Eccuity

We use Eccuity for financial modelling. We send you an invitation link and you create an account with Eccuity directly. Your agreement for that account is with Eccuity, under their terms and privacy policy.

Financial information reaches your Eccuity account in one of two ways, depending on how we work together. You may enter it yourself. Or, where you provide it to us in a meeting, we enter it into the platform on your behalf. This includes information such as your income, assets, liabilities, KiwiSaver details and investment holdings.

Eccuity processes and stores information on Amazon Web Services infrastructure located in Australia, Singapore and the United States. This means information about you is held outside New Zealand.

Eccuity Privacy Policy

Our responsibility

Where a provider holds your information on our behalf, that information is held by FoundHer. We remain responsible for it. Linking to a provider's privacy policy tells you how they operate. It does not move our obligations to you onto them.

4.2 Information Held Overseas

Some of the providers we use store and process personal information outside New Zealand.

• Eccuity stores information in Australia, Singapore and the United States.
• Google, Meta and Microsoft store information in the United States and other countries.

Privacy laws in those countries are not the same as New Zealand law, and in some cases offer less protection. Where a provider holds your information on our behalf, our obligations to you under the Privacy Act 2020 continue to apply regardless of where that information is stored.

5. Use of Artificial Intelligence

At FoundHer, we use Contented AI to assist with meeting summarisation and the drafting of advice documents.

We prioritise your data security:

• Privacy protection: We use professional-grade subscriptions that contractually ensure your data is never used to train global AI models.
• Data sanitisation: We mask or remove sensitive personal identifiers before data is processed by these tools.
• Human verification: All AI-generated content is reviewed, edited, and validated by a human adviser for accuracy. We do not use AI for financial calculations or core research.

6. Data Storage and Security

We take the security of your personal information seriously and implement appropriate physical and electronic security measures to protect it from unauthorised access, alteration, loss, or destruction.

Your personal information is stored securely, primarily in electronic form using:

• Password-protected electronic systems
• Cloud storage providers, as listed in Section 4.1
• Restricted network access for authorised people and service providers only

Some of the providers we use store information outside New Zealand. Section 4.2 sets out where.

7. Data Retention

We keep your personal information only as long as necessary for the purposes for which it was collected or as required by law.

• Financial advice records: We retain financial advice-related information for at least seven years to meet tax, legal, and professional obligations.
• Website data: Cookie and session recording retention periods are set out in Section 3.3.
• Marketing data: If you unsubscribe from our marketing communications, we will remove you from our mailing list but may retain your contact information to ensure we do not inadvertently contact you again.

8. Your Rights

You have the following rights under the Privacy Act 2020.

8.1 Access Your Information

You have the right to request access to the personal information we hold about you. We will respond within a reasonable timeframe, generally within 20 working days.

8.2 Correct Your Information

If you believe your information is incorrect, incomplete, or out of date, you may request a correction. If we do not agree to make the correction, we will add a note to your record stating your requested correction.

8.3 Request Deletion

You may request that we delete your personal information. However, we may not be able to delete information we are legally required to keep, for example financial advice records that must be retained for seven years.

8.4 How to Exercise Your Rights

To exercise any of these rights, please contact our Privacy Officer at [email protected]. We will respond within a reasonable timeframe. There may be a charge for access requests to cover administrative costs, and we will inform you of any fees before processing your request.

If we refuse your request, we will provide reasons and information on how to complain to the Office of the Privacy Commissioner.

9. Privacy Breaches

In the event of a privacy breach that is likely to cause you serious harm, we will:

1. Take immediate steps to contain the breach, for example retrieving the information and disabling compromised systems
2. Assess the severity of the breach by considering the nature, type, and volume of personal information involved, who has access to it, and the potential risk of harm
3. Notify you directly so you can take steps to protect yourself
4. Notify the Office of the Privacy Commissioner if the breach meets the criteria of causing serious harm as defined by the Privacy Act 2020
5. Take preventative measures to avoid future breaches, including reviewing and enhancing our security protocols

10. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at [email protected] so we can delete it.

11. Third-Party Websites

Our website may contain links to third-party websites, for example product provider websites, regulatory bodies, or external resources. These websites are governed by their own privacy policies. We are not responsible for the privacy practices of third-party websites, and we encourage you to read their privacy policies before providing any personal information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the last updated date at the top of this policy and notify you by:

• Posting a notice on our website
• Sending you an email notification, if you are a current client

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

13. Contact Us

If you are not satisfied with our response to your privacy concern or complaint, you have the right to contact the Office of the Privacy Commissioner: