Privacy Policy

1. Introduction

Nineteen Ninety Five Limited (NZBN 9429050673650) trading as Dupli (we, us, our) is committed to protecting personal information and using it responsibly.

This Privacy Policy explains how we collect, use, store and disclose personal information when we provide our software-as-a-service platform, websites, mobile applications, integrations, and related services (together, the Services), or when you otherwise interact with us.

Where we handle personal information about individuals in New Zealand, we comply with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs). Because Dupli is a global SaaS platform, individuals located in other jurisdictions may also have additional rights under applicable privacy laws, including the GDPR (EU/UK) and United States state and federal privacy laws. These additional rights are outlined in the appendices to this Privacy Policy.

This Privacy Policy applies whether you are:

• a Customer (including a business entity, administrator, or authorised user of a Customer); or
• an End User (for example, a worker, contractor, visitor, or other individual whose information is processed through the Services).

2. Our role and your role

Dupli is a platform that enables Customers to manage people, sites, risks, and compliance more efficiently.

• Customers decide what personal information is collected through the Services and how it is used for their business purposes.
• Dupli processes personal information to provide and support the Services, in accordance with this Privacy Policy and our agreements with Customers.

Where we process personal information on behalf of a Customer, the Customer is responsible for providing any required notices to End Users and ensuring they have a lawful basis to collect and use that information.

3. Personal information

Personal information means information about an identifiable individual, as defined under the Privacy Act 2020.

3.1 Types of personal information we may collect

Depending on how the Services are used, we may collect and process the following categories of personal information:

Identity information

• Name
• Date of birth
• Job title or role
• Photographic identification or profile images (where enabled by a Customer)

Contact information

• Email address
• Telephone number
• Physical or postal address
• Emergency contact details (where provided by or on behalf of an End User)

Account and profile information

• Username and password
• User roles and permissions
• Preferences and settings
• Content submitted through the Services

Technical and usage information

• IP address
• Device, browser and operating system information
• Log-in activity
• Usage analytics, cookies and similar technologies
• Approximate or precise location data (where enabled)

Transaction and billing information

• Subscription details
• Payment records (processed via third-party payment providers)
• Invoicing and financial records (for Customers)

Professional and employment-related information

• Work history or qualifications (where relevant to Customer use cases)
• Site attendance, induction or competency records

Higher-risk information
Some information processed through the Services may be higher risk, including:

• Health information (for example, allergies or medical conditions relevant to site safety)
• Emergency information
• Biometric identifiers, if enabled by a Customer

We only process higher-risk information where necessary for the Services, authorised by the Customer, and subject to additional safeguards.

4. How we collect personal information

We collect personal information in several ways, including:

• Directly from you, when you create an account, use the Services, contact us, or communicate with us.
• From Customers, where they input or upload information about End Users into the Services.
• Automatically, through use of the Services (for example, logs, cookies, and analytics).
• From third parties, such as identity, analytics, or integration providers, where enabled by a Customer.
• From publicly available sources, such as professional networking platforms.

5. Why we collect, use and disclose personal information

We collect, use and disclose personal information for purposes including:

• providing, operating and supporting the Services;
• onboarding Customers and End Users;
• enabling site access, inductions, and safety processes;
• responding to enquiries and support requests;
• billing, invoicing and account administration;
• improving and developing our platform and features;
• security, fraud prevention and system integrity;
• marketing and communications (subject to consent and opt-out rights);
• meeting legal, regulatory and contractual obligations.

We do not use personal information in ways that are inconsistent with these purposes without lawful authority.

6. Software integrations and data exchange

At a Customer’s request, Dupli may integrate with third-party software platforms (such as HR, payroll, project management, safety, identity, or reporting systems).

Where integrations are enabled:

• data may be imported into Dupli, exported from Dupli, or synchronised between systems;
• the scope, direction and frequency of data exchange is controlled by the Customer’s configuration and permissions;
• Dupli does not initiate data sharing with third-party systems unless requested or authorised by the Customer.

Customers are responsible for ensuring they have the right to share personal information with integrated systems and for understanding the privacy practices of those third-party providers.

7. Disclosure of personal information

We may disclose personal information to:

• our employees and contractors;
• cloud hosting, infrastructure and IT service providers;
• analytics, monitoring and security providers;
• payment processors and financial institutions;
• professional advisers (legal, accounting, insurance);
• integration partners approved or enabled by Customers;
• regulators, courts or law enforcement where required or authorised by law;
• a purchaser or successor in connection with a business transaction.

We require service providers to protect personal information through confidentiality and security obligations and to use it only for permitted purposes.

8. Overseas storage and disclosure

Dupli operates globally. Personal information may be stored or processed in New Zealand and other countries where we or our service providers operate.

Where personal information is disclosed from New Zealand to a recipient outside New Zealand, we do so in accordance with IPP 12, including by:

• ensuring the recipient is subject to comparable privacy safeguards; or
• using contractual protections; or
• relying on another lawful basis under the Privacy Act 2020.

9. Location information

If enabled, our mobile applications may collect approximate or precise location data for purposes such as:

• verifying site attendance or check-ins;
• supporting safety and security features.

Location data is collected only when necessary, can be controlled through device and application settings, and is retained only for as long as required for the relevant purpose.

10. Retention of personal information

We retain personal information only for as long as necessary to:

• provide the Services;
• meet legal and contractual obligations;
• resolve disputes and enforce agreements; and
• support legitimate business needs.

When information is no longer required, we securely delete or anonymise it, unless we are legally required to retain it longer or instructed otherwise by a Customer.

11. Security

We use reasonable physical, technical and organisational safeguards to protect personal information against loss, misuse, unauthorised access, modification or disclosure.

While we take security seriously, no system is completely secure, and information transmitted over the internet is done at your own risk.

12. Privacy breaches

We maintain processes to identify and respond to privacy incidents.

Where a privacy breach has caused or is likely to cause serious harm, we will notify affected individuals and relevant regulators as required by applicable law, including the Office of the Privacy Commissioner (NZ).

13. Your rights

Depending on your location, you may have rights to:

• access personal information we hold about you;
• request correction of inaccurate or incomplete information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent.

Requests can be made using the contact details below. We may need to verify your identity before responding.

Complaints

If you are in New Zealand and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (NZ).
If you are in Australia, you may contact the OAIC.
If you are in the EU or UK, you may contact your local data protection authority.

14. Cookies and analytics

We use cookies and similar technologies to operate and improve our Services, understand usage, and support marketing activities.

You can control cookies through your browser settings. Blocking certain cookies may affect functionality.

Where we send commercial electronic messages, we comply with applicable anti-spam laws, including New Zealand’s Unsolicited Electronic Messages Act 2007, and provide an unsubscribe mechanism.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website. Continued use of the Services indicates acceptance of the updated policy.

16. Contact us

For privacy questions, requests or complaints, contact us at:

Email: [email protected]