Privacy Policy

Wright Way Limited (trading as Wright Way Insurance) | FSP1010481

Purpose

We know that how we collect, use, share and protect your information is important to you, and we value your trust. Protecting your information, and being clear about what we do with it, is a vital part of our relationship with you.

This Privacy Policy explains how Wright Way Limited (“we”, “us”) collects, uses, holds and shares personal information about our clients and people who use our website or social media pages, and how we comply with the Privacy Act 2020 and the Health Information Privacy Code 2020.

By contacting us, using our website or giving us your information, you acknowledge this Privacy Policy. If you would prefer not to use our website or other online channels, please call us on 021 1939 371.

Our Privacy Officer

Our Privacy Officer is Sharai de Klerk, Office Manager | Business Support Manager, under the supervision of our Managing Director, Wanda Wright. Please contact our Privacy Officer with any privacy question, request or concern:

• Email: sharai@wrightwayinsurance.co.nz
• Phone: 021 1939 371

What personal information we collect

Personal information is information about an identifiable individual. We only collect information that is necessary to provide our advice and services, or to meet our legal obligations. Depending on the service you ask us for, this may include:

• Identity and contact details – name, date of birth, gender, postal and email address, phone number.
• Health information – your medical history, current health, lifestyle (for example smoking status, occupation and pastimes), family medical history and doctor’s details. We need this to advise on, apply for, and support claims on life, health, trauma, disability and income protection insurance. See “Health information” below.
• Financial information – income, assets and liabilities, existing insurance policies, KiwiSaver scheme and fund details, balances and contributions, your IRD number and prescribed investor rate (PIR) where needed for a KiwiSaver application.
• Employment and family information – occupation and employer, and details of your partner and dependants where relevant to your advice.
• Your preferences and enquiries – details of your enquiry, how you like to be contacted and your marketing preferences.

Health information

Personal insurance advice often involves sensitive health information. Because of this, we take extra care with it and follow the Health Information Privacy Code 2020 as well as the Privacy Act 2020.

Why we collect it

We collect health information only where we need it to advise you on, apply for, review or claim on life, trauma, disability, income protection and health insurance. Insurers need accurate health information to decide whether to offer cover, on what terms, and to assess claims.

Where it comes from

• Mainly from you – for example in our fact-find, in health questions on insurance applications and in claim forms.
• From your doctor, specialists or other health providers – only with your signed authority, usually requested by the insurer during underwriting or a claim.
• From insurers – for example underwriting decisions, exclusions or claim outcomes on your policies.

Who we share it with

We share your health information only with the insurers you apply to or claim with (and their reinsurers and claims assessors), with your health providers where you have authorised this, and with our compliance adviser or regulators where required by law. We never use your health information for marketing, and we never share it with referral partners unless you specifically ask us to.

How we protect it

• Access to health information is limited to your adviser and the staff who need it to support your application or claim.
• Health information is stored only in your secure client file – not in personal email, on paper left in vehicles or on unsecured devices.
• We avoid entering identifiable health information into AI tools.
• When we send health information to an insurer, we use the insurer’s secure online portal or other secure methods wherever possible.

Your rights

You can ask to see the health information we hold about you and ask us to correct it. We will not charge you for this, except where the Health Information Privacy Code 2020 allows a charge (for example, for repeated requests for the same information within 12 months), and we will tell you before any charge. If the information came from your doctor, we may suggest you also contact them, as they may hold more detail.

It is important that the health information given to an insurer is complete and accurate. Missing or incorrect information can lead to a policy being cancelled or a claim being declined. Your adviser will explain your disclosure obligations before you apply.

How we collect your information

We collect most personal information directly from you – in meetings, over the phone or by video call (for example Microsoft Teams or Zoom), by email, through fact-find and application forms, and through our website or social media pages.

Information we collect from other people (IPP3A notification)

Sometimes we need to collect information about you from other sources. This may include:

• insurers and KiwiSaver providers (for example policy, underwriting, claims and account information);
• Link Financial Group (LFG), the insurance aggregator through which we place some business;
• your doctor or other health providers, with your written authority, during underwriting or a claim;
• your other professional advisers, such as your accountant, lawyer or previous financial adviser, with your consent;
• lead providers we work with (see below);
• people you authorise to act for you, such as a family member or attorney; and
• publicly available sources, such as public registers and the internet.

Lead providers

Some people first come to us through lead providers – companies that run online advertising and enquiry forms for people interested in insurance and pass their details to advisers. Our current lead providers include Velocity Leads, OneAdsphere and Growth Academy. The providers we use may change from time to time without notice.

Lead providers collect your details under their own privacy policies, and should only pass them to us if you have asked to be contacted. When we contact you, we will tell you how we received your details. We will not pressure you, and if you do not want to hear from us, just tell us and we will remove your details from our contact lists.

When we collect information about you from someone else, we will take reasonable steps to let you know, as soon as reasonably practicable, what we have collected, why we need it, how it will be used and who it may be shared with – unless an exception under the Privacy Act applies.

Our website and social media

Our website uses cookies – small files stored by your browser – to help it work properly and to understand how it is used. Cookies may record the date and time of your visit, the pages you viewed, the site you came from, the type of device and browser you used, your IP address and your approximate location. Cookies cannot read your hard drive or take control of your device. You can set your browser to refuse cookies, although some parts of the website may not then work as intended.

We will never ask you to share personal or financial information publicly on Facebook or any other social media platform. We may invite you to message us privately or to contact us directly. If you contact us through a third-party platform such as Facebook Messenger or a Google service, that platform’s own privacy policy also applies to the information you share there.

Our use of artificial intelligence (AI) tools

We use AI tools – currently ChatGPT, Claude and Wispr Flow (a voice dictation tool) – to help us work efficiently, for example to dictate and summarise file notes, draft letters and emails, and check documents. When we use these tools:

• we limit the personal information we enter, and remove or minimise identifying and health details wherever practicable;
• we use account settings that stop our content being used to train the provider’s AI models, wherever those settings are available;
• AI tools never make recommendations or decisions about you – all advice is prepared, reviewed and given by your financial adviser, who is responsible for it; and
• these providers store information overseas (mainly in the United States) – see “Sending information overseas” below.

How we use your information

We use your personal information to:

• understand your needs and give you financial advice;
• apply for, arrange, review and service insurance and KiwiSaver products for you, and help you with claims;
• keep records and meet our legal and regulatory obligations, including those of a licensed financial advice provider;
• respond to your enquiries and any complaints; and
• send you newsletters and information about our services – you can opt out of marketing at any time.

Who we share your information with

We only share your personal information where it is needed to provide our services to you, where you have agreed, or where the law requires or allows it. This may include:

• Product providers – the insurers and KiwiSaver providers you apply to or hold products with, and their reinsurers and claims assessors.
• Link Financial Group (LFG) – where your insurance is placed through LFG as our insurance aggregator, and because LFG arranges our independent compliance reviews. These reviews look at a sample of client advice files, and LFG may receive the information reviewed and the review reports.
• Our service providers – our client management system (AdviceLink), our IT, website and cyber-security provider (Sudolabs), cloud email and document storage providers, and the AI tools described above.
• Compliance and professional services – our independent compliance reviewer (Rosewill Consulting, on behalf of LFG), our accountant and auditors, and, if a claim is made against us, our insurance broker (Aon) and our professional indemnity insurers.
• Regulators and dispute resolution – the Financial Markets Authority, the Privacy Commissioner, our dispute resolution scheme (Financial Dispute Resolution Service) and other authorities where the law requires.
• Health providers – your doctor or other health providers, where you have authorised this for underwriting or a claim.
• People you authorise – such as a family member, attorney, accountant or lawyer acting for you.

Referral partners – only with your permission. If you would like help that is outside our scope of advice, we will only pass your details to a referral partner after you have agreed. Our referral partners include FG Link (general insurance), NZ Funds (investment and KiwiSaver services), Owen C Law (wills and estate planning), and mortgage advisers we work with. We may receive a referral fee or commission, which we will tell you about.

We will never sell your personal information.

Sending information overseas

Some of our service providers – including cloud storage, email and AI providers – may store or process information outside New Zealand, for example in Australia or the United States. Before we do this, we take reasonable steps to make sure your information will be protected by safeguards comparable to those in the Privacy Act 2020. If we cannot be reasonably sure of this, we will tell you and ask for your permission first.

How we protect your information

We take reasonable steps to keep your information secure and to protect it from loss and unauthorised access, use or disclosure. These include:

• storing client information electronically in secure, cloud-based systems, with access limited to the people who need it;
• unique, strong passwords and multi-factor authentication wherever it is available, managed through a business password manager;
• antivirus and security software on our computers and mobile devices, including when we travel;
• confidentiality obligations and regular privacy and cyber-security training for everyone who works with us;
• keeping as little paper as possible – paper documents are scanned to the client file, stored securely while needed and then shredded; and
• regular review of our security, including an independent cyber-security review with our IT provider.

No system is completely secure. If we give you a password or secure link, please keep it confidential and tell us straight away if you think it has been compromised.

How long we keep your information

As a licensed financial advice provider, we keep records of our advice and the products we arrange for at least seven years. After that, if the information is no longer needed for any service we provide to you or any legal purpose, we securely destroy or permanently de-identify it.

If there is a privacy breach

If a privacy breach happens that has caused, or is likely to cause, serious harm, we will, as soon as practicable after becoming aware of it:

• act quickly to contain the breach and reduce any harm;
• assess what information is involved and the risk to the people affected;
• notify the Privacy Commissioner and the people affected (directly where possible), as the Privacy Act requires; and
• involve the Police or other authorities where criminal activity is suspected.

Accessing and correcting your information

You have the right to ask for access to the personal information we hold about you and to ask us to correct it. To make a request, contact our Privacy Officer (details above). We may need to confirm your identity before we act on a request.

We will respond as soon as reasonably practicable, and within 20 working days. There is no charge for asking us to correct your information. We do not usually charge for access; if a request is unusually large or repeated, we may charge a reasonable fee where the law allows, and we will tell you before any charge is incurred. For health information, see “Health information” above.

If we cannot give you access or make a correction, we will tell you why (unless the law prevents us) and how you can complain. If we do not agree to correct your information, you can ask us to attach a statement of the correction you asked for.

If you do not give us your information

If you choose not to give us information we ask for, we may not be able to give you suitable advice or arrange the products you want. When you apply for insurance, it is important that the information given to the insurer is complete and accurate – incorrect or missing information can affect your cover and any future claim.

Privacy questions and complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer, Sharai de Klerk, on 021 1939 371 or at sharai@wrightwayinsurance.co.nz.

We will acknowledge your complaint within three working days and let you know if we need more information. We aim to resolve complaints within 10 working days. If we need longer, we will tell you why and when you can expect a response.

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner:

• Website: www.privacy.org.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz
• Post: PO Box 10094, Wellington 6143

Changes to this Privacy Policy

We review this Privacy Policy regularly. The current version is always available on our website, and you can ask our Privacy Officer for a copy. If we make significant changes, we may let you know directly.