Privacy Policy

Harbourstone Limited, trading as Harbourstone Mortgage Specialists ("Harbourstone", "we", "us"), is an independent lending advisory. Harbourstone Limited (FSP719891) is an authorised body operating under the financial advice provider licence held by Finsure New Zealand Limited (FSP1005389). Arranging a loan means handling detailed information about your finances, your household and your property. This policy explains what we collect, why we collect it, who sees it and how you can access or correct it, under the Privacy Act 2020.

What we collect

When you use this website, we collect:

• the details you enter in our enquiry form: your name, email address, phone number, the type of lending you are asking about and your message. The form is processed by Netlify Forms and sent to our inbox
• technical information about your visit, such as your internet protocol (IP) address, browser, device and the pages you view (see "Cookies and analytics" below)

We do not take payments through this website, and we do not ask you to upload documents here.

When you become a client, we collect the information lenders need to assess your application:

• identity and contact details, including your date of birth and copies of your identity documents
• income, employment, assets, debts, living expenses and bank statements
• credit information, including your credit report
• details of the property, and for business lending, company and trust financial statements and details of directors, shareholders and guarantors
• details of other people involved in your application, such as a co-borrower, guarantor or dependants
• your IRD number, where a lender requires it.

You may choose to tell us about your health or other personal circumstances, for example to support a hardship request. We use that information only for the purpose you gave it to us.

If you refer clients to us, we collect your name, business and contact details and, where a referral fee applies, your payment details.

How we collect it

Most of the information we hold comes directly from you: through this website, by phone, by email, in meetings and through the secure document method we give you when you become a client.

With your authority, we also collect information about you from other people and organisations:

• credit reporters, for your credit report. Centrix, Equifax and Experian are used
• lenders, about your existing loans and your application
• your employer, accountant or lawyer, to confirm your income, financial statements or settlement details
• valuers and real estate agents, about the property
• the person or business that referred you to us
• a co-borrower, partner or guarantor applying with you
• public registers, such as the Companies Office and property title records

When we collect information about you from someone else, we take reasonable steps to make sure you know we have it, what it is for and how you can access it, as the Privacy Act requires (information privacy principle 3A). This policy and the client authority you sign with us are part of how we do that. If someone gives us information about you as part of their own application, we ask them to show you this policy.

Why we collect it

We use your information to:

• answer your enquiry
• understand your situation and give you lending advice
• prepare, submit and manage loan applications with lenders
• coordinate the valuation, legal and settlement steps of your loan
• review your lending after settlement
• meet our legal obligations, including under the Financial Markets Conduct Act 2013, the Credit Contracts and Consumer Finance Act 2003 and the Anti-Money Laundering and Countering Financing of Terrorism Act 2009
• run our business, including record keeping, audits and complaints

We do not sell your personal information. If you do not give us the information a lender needs, we may not be able to arrange your loan.

Who we share it with

We share your information only as needed to arrange and manage your lending, or where the law requires or allows it. This may include:

• the lenders we recommend or submit your application to, with your authority
• credit reporters, when we obtain your credit report. The enquiry may be recorded on your credit file
• Finsure New Zealand Limited, the financial advice provider whose licence we operate under. We use its systems to lodge applications and manage commission, and it monitors our advice for compliance
• valuers, lawyers and conveyancers acting on your loan
• our professional advisers, auditors and insurers
• regulators, our dispute resolution scheme and law enforcement agencies
• the service providers who host and support our systems (see "Where your information is stored" below)

If someone referred you to us, they hear only what you agree to when you engage us. We will ask whether you are happy for us to tell them the key milestones of your application. If we pay the referrer a fee when your loan settles, we will tell you when you engage us. Paying that fee lets the referrer know your loan has settled.

We will refer you to another adviser, such as an insurance adviser, only with your agreement.

Where your information is stored

Our systems are run by service providers, some of whom store information outside New Zealand, including in Australia and the United States. This website is hosted by Netlify in the United States, and Google processes our website analytics in the United States and other countries. Our service providers act on our instructions, do not use your information for their own purposes, and are bound by contract to protect it.

If we ever disclose your information to an overseas organisation for its own purposes, we will first make sure it will protect your information to a standard comparable to New Zealand law, or ask for your authorisation after telling you it may not be protected to that standard.

Artificial intelligence and automated decisions

We do not use artificial intelligence (AI) tools to process your personal information. We use artificial intelligence (AI) tools to help with administrative work, such as summarising documents and drafting correspondence. We use them only on business terms that stop the provider using your information to train its models, and a person checks everything before it is used.

We do not make decisions about you by solely automated means. Your adviser makes every recommendation. Lenders make their own credit decisions, and some use automated systems to do so. Each lender's privacy policy explains how it handles your application.

Cookies and analytics

This website uses cookies, which are small files stored on your device.

• Essential cookies make the site work, for example by keeping forms secure.
• Analytics cookies, set by Google Analytics 4, show us which pages are viewed, how visitors find the site, and their approximate location and device type, so we can improve it. We load Google Analytics through Google Tag Manager. We review this information in aggregate, not to identify you.
• We also use the LinkedIn Insight Tag and Meta Pixel to see where visitors come from.

You can block or delete cookies in your browser settings, or install Google's opt-out browser add-on for Google Analytics. The site will still work, although some features may not.

Marketing

If you subscribe to our updates, we will send you articles and market commentary by email. Every email includes an unsubscribe link, and you can ask us to stop at any time. We will not add you to a mailing list without your agreement. If you are a client, we will still contact you about your lending.

How we protect your information

We protect your information with multi-factor authentication on email and business systems, encrypted devices, and a secure upload method for identity and financial documents instead of email attachments. Access is limited to the people who need it to work on your lending.

No system is completely secure. If a privacy breach is likely to cause you serious harm, we will tell you and the Office of the Privacy Commissioner as soon as practicable, unless an exception in the Privacy Act applies.

How long we keep it

We keep client files for seven years after our relationship with you ends, to meet our legal record-keeping obligations. After that, we securely delete or destroy them. Website enquiries that do not lead to a client relationship are deleted after 60 months.

Your rights

You can ask for a copy of the personal information we hold about you, and ask us to correct it. Contact our Privacy Officer using the details below. We will confirm your identity, respond as soon as we can and within 20 working days, and we will not charge you. If we decline your request, we will tell you why.

If we do not agree to make a correction you ask for, you can ask us to attach a statement of the correction to your information.

You can ask us for any copy of your credit report we hold on your file. For your current credit report, contact the credit reporters directly. If you are worried about identity fraud, you can ask a credit reporter to freeze your credit information. A first freeze request to one credit reporter is passed on to the others.

Complaints

If you are unhappy with how we have handled your information, contact our Privacy Officer first. We will acknowledge your complaint within two working days and aim to resolve it within 20 working days.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:

• online at www.privacy.org.nz
• by phone on 0800 803 909
• by post to PO Box 10 094, Wellington 6140

Complaints about our advice or service, rather than privacy, follow the process set out in our disclosure statement.

Contact our Privacy Officer

Carl Mann, Lead Lending Specialist and Privacy Officer

• Email: hello@harbourstone.co.nz, with "Privacy" in the subject line
• Phone: 027 536 6480
• Post: Privacy Officer, Harbourstone Limited, Level 2, 24 Johnston Street, Wellington Central, Wellington 6011

Changes to this policy

We review this policy at least once a year and whenever our systems or the law change. The version on this page, with its effective date, is the one that applies.