PRIVACY POLICY

1. ABOUT THIS POLICY

Hillside Property Management Limited (“Hillside”, “we”, “us”, or “our”) provides residential property management services in New Zealand.

We are committed to protecting personal information and handling it in accordance with the Privacy Act 2020, the Residential Tenancies Act 1986, and other applicable New Zealand laws.

This policy explains how we collect, use, disclose, store, and protect personal information relating to:

• Prospective and existing landlords and property owners
• Prospective and existing tenants and occupants
• Guarantors, referees, and emergency contacts
• Contractors and service providers
• Website visitors and people who contact us
• Other individuals whose information we may lawfully collect

“Personal information” means information about an identifiable individual.

2. PERSONAL INFORMATION WE MAY COLLECT

We only collect personal information that is reasonably necessary for a lawful purpose connected with our business.

Landlords and property owners

We may collect:

• Name and contact details
• Property ownership or authority-to-act information
• Identification information where reasonably required
• Property and tenancy information
• Bank account and payment details
• Tax, invoicing, and accounting information
• Management instructions and authorised expenditure limits
• Agreements, correspondence, complaints, and service records

Prospective tenants and occupants

The information collected depends on the stage of the application process.

For property viewings, we will generally only require a person’s name and contact details.

For tenancy applications, we may collect:

• Name and contact details
• Confirmation that an applicant is 18 years or older
• Proof of identity
• Number and names of intended occupants
• Rental history
• Contact details for authorised referees
• Information about pets or smoking where relevant to the property
• Consent to carry out reference, credit, or other permitted checks
• Other information reasonably necessary to assess the application

For preferred applicants or applicants with whom an offer is being negotiated, we may also collect:

• Date of birth or additional identification details needed for an authorised check
• One reasonable form of evidence showing the ability to pay rent
• Information received from authorised referees
• Credit information from the credit reporting provider identified in the application notice
• Vehicle details where required for parking arrangements
• Address for service
• Emergency contact details

We will not require detailed bank statements showing an applicant’s spending habits. Credit, reference, or similar checks will only be undertaken when reasonably necessary, at the appropriate stage of an application, and with any authorisation required by law.

Existing tenants

During a tenancy, we may collect:

• Tenancy agreement, bond, rent, and payment information
• Contact and address-for-service details
• Maintenance and repair requests
• Property access arrangements
• Inspection reports, notes, and photographs
• Communications, complaints, notices, and dispute records
• Information relating to damage, arrears, safety, or compliance
• Information required for Tenancy Tribunal or other legal proceedings
• Relevant accessibility, safety, or communication information voluntarily provided by a tenant

Inspection photographs will be limited to what is reasonably necessary to record the condition of the property. We will avoid photographing people or unnecessarily focusing on personal possessions.

Maintenance information submitted through the Tenant Concierge is processed through TAPI and may include names, contact details, property details, maintenance descriptions, photographs and videos.

Contractors and service providers

We may collect:

• Names and contact details
• Trade qualifications, licences, and insurance information
• Quotes, invoices, and payment details
• Property access and work records
• Communications concerning maintenance or other services

Website visitors and enquiries

When someone visits our website or submits an enquiry, we may collect:

• Name, email address, telephone number, and enquiry details
• Property information voluntarily submitted
• IP address, device, browser, and approximate location information
• Website activity and referral information
• Website technology and analytics information
• Communication and marketing preferences
• Messages entered into the Hillside Assistant and the conversation context needed to respond

General enquiries, rental appraisal requests and apartment-support enquiries are used to review and respond to the request, contact the person using their preferred details, assess whether Hillside can assist, prevent duplicate or abusive submissions, and maintain necessary operational records.

Assistant messages are processed through Base44’s managed agent service. Visitors should not enter passwords, identity documents, bank information, medical information, dispute evidence or other unnecessary sensitive information.

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

• Directly from the individual
• Through our website, enquiry forms, tenancy forms, email, telephone, or in person
• From landlords, tenants, occupants, or authorised representatives
• From referees, employers, or previous landlords where authorised
• From credit reporting or tenant-checking providers where authorised
• From contractors, neighbours, or other people involved in managing a tenancy
• From Tenancy Services, Bond Hub, tribunals, courts, or government agencies
• From publicly available sources where collection is lawful, relevant, and reasonable
• Through property management, maintenance, accounting, communication, website, and analytics systems

Where we collect personal information from someone other than the individual concerned, we will take reasonable steps to notify that individual of the collection and the matters required by Information Privacy Principle 3A, unless an exception under the Privacy Act applies.

This notification will normally be provided in advance through an application form, agreement, specific privacy notice, or this policy. If advance notification is not reasonably practicable, we will take reasonable steps to notify the person as soon as reasonably practicable after collection.

If someone provides us with personal information about another person, they must have lawful authority to provide it and should make that person aware of this policy.

4. WHY WE COLLECT AND USE PERSONAL INFORMATION

We may use personal information to:

• Respond to enquiries and provide rental appraisals
• Establish and manage relationships with landlords
• Market and manage residential rental properties
• Arrange property viewings
• Assess and process tenancy applications
• Verify identity and an applicant’s ability to meet tenancy obligations
• Conduct authorised reference, credit, or other lawful checks
• Prepare, administer, renew, and end tenancies
• Collect, account for, and distribute rent, bond, invoices, and other payments
• Conduct property inspections
• Assess, coordinate and record maintenance requests, repairs and compliance work
• Communicate with landlords, tenants, contractors, and other relevant parties
• Manage complaints, arrears, breaches, disputes, insurance claims, and Tribunal proceedings
• Meet health and safety and emergency-management responsibilities
• Keep accounting, tax, business, and tenancy records
• Detect or prevent fraud, misuse, security incidents, or unlawful activity
• Comply with the Residential Tenancies Act 1986, Privacy Act 2020, and other legal obligations
• Operate, secure, analyse, and improve our website and services
• Send marketing communications to landlords or prospective clients where permitted

Tenant information collected for tenancy purposes will not be used to promote an unrelated business without express authorisation.

5. IS PROVIDING INFORMATION COMPULSORY?

Providing personal information is generally voluntary unless it is required by law or is necessary to enter into or administer an agreement.

If requested information is not provided, we may be unable to:

• Process an application or enquiry
• Verify relevant information
• Offer or manage a tenancy
• Provide property management services
• Make a payment or arrange property access
• Meet our legal or contractual obligations

Any collection form may contain a more specific privacy notice explaining which information is required and the consequences of not providing it.

6. WHO WE MAY DISCLOSE INFORMATION TO

Where reasonably necessary for the purpose for which it was collected, directly related purposes, or as otherwise permitted by law, we may disclose personal information to:

• The owner of the relevant rental property
• Tenants, occupants, or their authorised representatives
• Referees, previous landlords, or employers where authorised
• Credit reporting and tenant-checking providers identified in the relevant application or authorisation
• Property management and tenancy software providers
• Maintenance contractors, tradespeople, inspectors, and other service providers
• Tenancy Services, Bond Hub, and the Ministry of Business, Innovation and Employment
• Insurers, insurance brokers, loss assessors, and claims providers
• Accountants, auditors, lawyers, and other professional advisers
• Banks, payment providers, and debt-recovery providers
• Courts, the Tenancy Tribunal, dispute-resolution services, regulators, Police, or other government agencies
• Base44 for website hosting, database, backend functions and managed assistant services
• Resend for processing internal website-enquiry notification emails
• TAPI, as a third-party service provider involved in processing Tenant Concierge maintenance submissions
• Google Analytics and Google Ads where the visitor has enabled the relevant privacy categories
• Meta Pixel and OpenAI advertising measurement where the visitor has enabled Marketing
• Other website hosting, cloud storage, communications and information-technology providers where reasonably necessary
• Emergency services where necessary to protect health or safety
• Any other person where the individual has authorised disclosure or disclosure is otherwise permitted or required by law

When arranging maintenance, we will generally only provide contractors with the tenant and property information reasonably required to arrange access and complete the work.

Information provided to a property owner about a tenant or applicant will be limited to what is reasonably necessary for selecting a tenant, managing the property, meeting the owner’s legal responsibilities, or dealing with a dispute.

We do not sell or rent personal information.

7. OVERSEAS STORAGE AND DISCLOSURE

Some of our software, cloud, website, communication, or analytics providers may store or process personal information outside New Zealand.

Where an overseas provider only stores or processes information on our behalf and does not use it for its own purposes, we remain responsible for the information as required by the Privacy Act.

Where we disclose personal information to an overseas person or organisation for its own use, we will comply with Information Privacy Principle 12. This may include ensuring that:

• The recipient is subject to the New Zealand Privacy Act
• The recipient is required to provide safeguards comparable to those in New Zealand
• The recipient is located in a country with comparable privacy protections
• The individual has expressly authorised the disclosure after being informed that comparable safeguards may not apply

8. SECURITY

We take reasonable safeguards to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

These safeguards may include:

• Access-controlled property management and business systems
• Multi-factor authentication and secure account management
• Secure cloud storage and backups
• Device, email, and network security controls
• Limiting access to people who require the information
• Secure disposal of paper and electronic records
• Reviewing the security and privacy arrangements of service providers

Images of identity documents submitted for verification will be securely deleted once verification is complete unless we have a lawful and necessary reason to retain them.

No internet or electronic storage system is completely secure. However, this does not limit our obligation to take reasonable security safeguards.

9. PRIVACY BREACHES

If a privacy breach occurs, we will take reasonable steps to contain it, investigate it, reduce any harm, and prevent it from happening again.

Where a breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as reasonably practicable, unless an exception under the Privacy Act applies.

10. RETAINING INFORMATION

We retain personal information only for as long as it is lawfully required.

Generally:

• Viewing information will be deleted when it is no longer required
• Unsuccessful tenancy applications will normally be securely deleted within 90 days after the selection decision, unless a longer period is reasonably required for a complaint, dispute, legal obligation, or the applicant asks us to retain it
• Identity-document images will be deleted promptly after verification unless lawful retention is required
• Tenancy-related documents will be kept during the tenancy and for at least 12 months after the tenancy ends where required by the Residential Tenancies Act 1986
• Rent and bond records will be retained for seven years after the tax year to which they relate
• Accounting and business records will be kept for the applicable statutory period
• Records relevant to a complaint, insurance claim, Tribunal proceeding, court matter, debt, or reasonably anticipated dispute may be retained until the matter and applicable review periods are complete
• Closed or unconverted website enquiries are proposed to be deleted 24 months after the last meaningful activity, subject to legal or dispute-related retention requirements
• Where a converted website lead has been confirmed as transferred to Hillside’s operational property-management system, the website copy is proposed to be deleted after 90 days
• Successful notification-job records are retained for up to 90 days and operational alerts for up to 12 months, unless an earlier deletion is appropriate
• Short-lived duplicate-prevention and rate-limit records are automatically removed after their operational window

Base44 does not currently expose a configurable retention period for managed assistant conversations. Hillside will seek provider confirmation or deletion support rather than making an unverified fixed-retention claim.

When information is no longer required, we will securely delete, destroy, or de-identify it.

11. WEBSITE TECHNOLOGY, ANALYTICS, AND MARKETING

We use essential technology to operate this website and its forms. If you choose Analytics, we may use Google Analytics 4 to understand aggregated website use. If you choose Marketing, we may use Google Ads, Meta Pixel and OpenAI advertising measurement tools to understand whether advertising led to an enquiry. Non-essential tools are disabled until the relevant choice is made. You can change or withdraw your choice at any time using ‘Privacy choices’ in the footer. We do not intentionally send enquiry-field values such as your name, email address, phone number, message or property address to these analytics or advertising tools.

Some analytics or advertising providers may process information outside New Zealand. We do not make claims about a provider’s processing location, encryption, deletion or retention beyond information we have verified.

Where we send electronic marketing communications, recipients may unsubscribe using the link in the message or by contacting us. Service, tenancy, safety, legal, or account-related communications cannot necessarily be opted out of while the relevant relationship continues.

12. ACCESSING AND CORRECTING PERSONAL INFORMATION

Individuals have the right to request access to personal information we hold about them and to ask us to correct it.

We may need to verify the requester’s identity before providing information. We will respond as soon as reasonably practicable and within the timeframe required by the Privacy Act, usually no later than 20 working days.

In limited circumstances, the Privacy Act may permit us to withhold some information. If we do not agree that information should be corrected, the individual may ask us to attach a statement of correction to the information.

13. PRIVACY QUESTIONS AND COMPLAINTS

Hillside has a designated Privacy Officer.

Requests, questions, or complaints can be sent to:

We will acknowledge and investigate privacy complaints within a reasonable timeframe.

If someone is not satisfied with our response, they may contact:

14. CHANGES TO THIS POLICY

We may update this policy when our services, systems, providers, or legal obligations change.

The current version and its effective date will be published on our website. Where a change materially affects how we use or disclose information already collected, we will take reasonable steps to notify affected individuals where required.