The purpose of this policy is to facilitate the respecting and upholding of the privacy of our clients and to recognise our obligations under the Privacy Act 2020.

Definitions:

For the purposes of this policy, unless context otherwise requires:

“CS Law” means the firm of Cullinane Steele Limited.

“Personal Information” means any information about an identifiable individual.

Privacy Officer

The Privacy Officer for CS Law is Hannah Wood, and in times of absence, Julia Turnbull. The Privacy Officer is responsible for the management of privacy issues at CS Law.  As a client of CS Law, please feel free to approach Hannah Wood or Julia Turnbull with any issues associated with your Personal Information retained by CS Law.

Collection of Personal Information

Where CS Law needs to collect Personal Information about our clients, we will make every endeavour to collect information directly from our clients or from a person that they have authorised.

We will only collect Personal Information for lawful purposes relating to our business, and we will only use lawful means to collect that information.

Reasons for collecting Personal Information

CS Law collects Personal Information for a variety of purposes connected with the provision of legal services and the operation of our business. These purposes may include:

• Verifying your identity and carrying out customer due diligence obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009;
• Conducting electronic verification and sanctions screening using approved third-party providers;
• Assessing whether we are able to act for you and conducting conflict of interest checks;
• Providing legal advice and legal services requested by you – including preparing legal documents and correspondence;
• Communicating with you and other parties involved in your matter;
• Obtaining information from relevant organisations, government agencies, financial institutions and professional advisors where authorised or required;
• Administering trusts, estates, companies and other entities for which we act;
• Managing billing, accounts and payment processing;
• Complying with legal, regulatory and professional obligations;
• Responding to complaints, disputes or legal proceedings; and
• Maintaining the security and integrity of our systems and records.

If we wish to use your Personal Information for a purpose unrelated to the original purpose for which it was collected, we will gain your permission for its new use.

Electronic Identity Verification

To comply with our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, CS Law may use electronic identity verification providers to verify your identity.

This process may involve collecting and disclosing Personal Information including your name, date of birth, address, identification documents and biometric information (such as a photograph or live image) to approved verification providers.

These providers may compare information supplied by you against official records, databases and other trusted sources for the purpose of confirming your identity and reducing the risk of fraud.

Where you do not wish to complete electronic verification, alternative methods of identity verification may be available, although this may affect our ability to act for you or delay the provision of services.

Source of Information

Personal Information may be collected directly from you or from third parties where authorised by you or permitted by law. This may include:

• government agencies;
• Land Information New Zealand;
• the Companies Office;
• financial institutions;
• accountants and financial advisors;
• real estate agents;
• valuers and other professional advisers;
• courts and tribunals;
• publicly available registers; and
• electronic identity verification providers.

Access to and Correction of Personal Information

CS Law will make every effort to ensure that any Personal Information held by CS Law is accurate, up to date, complete and relevant before it is used.

You may request access to Personal Information we hold about you and request correction of that information where you believe it is inaccurate.

If we do not agree to make a requested correction, you may request that a statement of correction be attached to the information.

Requests should be directed to our Privacy Officer. We will respond in accordance with the Privacy Act 2020.

Protection of Personal Information

CS Law takes reasonable steps to protect Personal Information from loss, misuse, unauthorised access, disclosure, alteration or destruction.

These measures include:

• secure document and practice management systems;
• restricted staff access to information;
• authentication and password controls;
• cybersecurity protections;
• staff confidentiality obligations;
• secure disposal procedures; and
• engagement of specialist IT service providers.

Retaining information

Client files and Personal Information are generally retained for a minimum period of 15 years following completion of a matter, for the purposes of providing protection in the event of a legal claim. Longer retention periods may apply where required by law, professional obligations or risk management considerations.

CS Law assures clients that it will only hold Personal Information for as long as needed. Once that need has gone the information will be securely destroyed.

Disclosure of Personal Information

Keeping your Personal Information secure is important to CS Law. We will make every attempt to ensure that no unauthorised person can gain access or alter your information or give it to another person.

CS Law may disclose Personal Information where necessary for the provision of legal services, compliance with legal obligations or the operation of our business. Recipients may include:

• courts and tribunals;
• government departments and regulators;
• banks and financial institutions;
• barristers and expert witnesses;
• accountants and other professional advisers;
• electronic identity verification providers;
• legal technology and practice management providers;
• IT support and cloud storage providers;
• insurers; and
• any person authorised by you.

We may use or disclose Personal Information that you have provided to us, or which we have obtained about you, to our third parties providers, including technology providers who assist us in providing services or who perform functions on our behalf, such as providers that provide generative AI technologies to assist us in legal research, document review, document drafting and other legal tasks.

Our technology providers (including generative AI providers) may use your Personal Information to provide services to us, to administer, maintain, analyse, improve and/or develop their services, to undertake their business processes, to comply with their legal obligations and to conduct research.  Unless we state otherwise, our technology providers will not use your Personal Information to improve AI training models, train, retrain or improve foundation models, improve third-party products or services, conduct user profiling, advertising or similar commercial purposes, or to market products and services to you.

Our technology providersmay rely on and make your personal information available to their third-party providers (which may be located in countries other than New Zealand) in the course of delivering their services to us, including for hosting, cloud storage, email communication and web analytics purposes, such as the Azure OpenAI Service operated by Microsoft. Our technology providers may share your IP address and other information about your device to Microsoft for security reasons.  Our technology providers may also share your personal information with their affiliates, any other entity that they merge with or sell their business or assets to, and other third parties (such as government agencies) if legally required to do so.

Privacy Complaints

If you have a concern or complaint about how CS Law has collected, used, held or disclosed your Personal Information, including information collected for identity verification purposes, please contact our Privacy Officer in the first instance.

Complaints can be made in writing to:

Hannah Wood / Julia Turnbull
Cullinane Steele Limited,
Post:  PO Box 541, Levin 5510
Email:  [email protected] / [email protected]
Phone:  06 368 9239

To help us investigate, please provide your contact details, a description of your concern and any relevant supporting information.

We will acknowledge your complaint within 5 working days of receipt. Our Privacy Officer will investigate the matter, which may include reviewing our records and speaking with relevant staff or third-party providers (such as electronic verification providers).

We aim to respond to you in writing with the outcome of our investigation, and any steps we will take to resolve the matter, within 20 working days. If we need more time, we will let you know why and when you can expect a response.

If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner:

Website:  www.privacy.org.nz
Phone:  0800 803 909
Post: PO Box 10094, The Terrace, Wellington 6143

Amendment of Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal requirements or technology.

Any such amendment or revocation will be effective from the date of implementation.