Data Policy

This Data Policy applies to Skylights.co.nz, operated by Light for Life Limited (“we,” “our,” “us”). We are committed to safeguarding your personal information and upholding the highest standards of privacy, transparency, and security in compliance with the New Zealand Privacy Act 2020. This policy complements our Privacy Policy and outlines how we collect, use, store, share, and protect data across our platform.

1. Scope and Legal Basis for Data Processing

This policy applies to all users of Skylights.co.nz, including homeowners, businesses, and registered installers. We process personal information under the following legal bases:

Consent: When users voluntarily provide information (e.g., submitting enquiries, opting into communications).
Contractual Obligation: Where processing is necessary to provide services requested by the user.
Legal Compliance: Where processing is required by law or regulation.
Legitimate Interest: Where processing helps us operate, improve, and secure our platform, provided this does not override user rights.

2. Data We Collect

2.1 Personal Data

Full name
Contact details (email, phone number, address)
Account or installer registration details
Payment details (if applicable)
Communications and enquiry history

2.2 Usage Data

Pages visited, time spent, and navigation patterns
IP address, browser type, and device information
Log files, error reports, and system activity

2.3 Cookies & Tracking

Used to improve user experience, remember preferences, and analyse traffic.
Users can manage preferences through browser settings (see our Cookie Policy).

3. How We Use Data

We use collected data to:

Provide, operate, and improve our services.
Connect customers with registered independent installers.
Respond to enquiries, requests, and communications.
Personalise content and service recommendations.
Monitor security, prevent fraud, and maintain platform integrity.
Comply with legal and regulatory obligations.
Conduct analysis to optimise performance and future services.

4. Data Sharing and Disclosure

We do not sell or trade personal data. Information may be shared only in the following circumstances:

4.1 Installers

When a customer submits an enquiry, relevant details are shared with one or more registered installers for the purpose of providing quotes and services.
Installers are independent contractors and are solely responsible for complying with the Privacy Act 2020 when handling shared data.
Skylights.co.nz is not liable for installer misuse or unauthorised use of data once it has been shared.

4.2 Service Providers

We may engage trusted third parties (e.g., hosting providers, analytics, payment processors, IT support).
These providers are contractually required to protect data and use it only for authorised purposes.

4.3 Legal & Regulatory Compliance

Data may be disclosed where required by law, court order, or regulatory authority.
We may also disclose data to protect our rights, property, or user safety.

4.4 Business Transfers

In the event of a merger, acquisition, or asset transfer, data may be transferred under strict confidentiality safeguards.

5. Data Security

We take data protection seriously and implement industry-standard safeguards, including:

Encryption of sensitive data during transmission and storage.
Restricted access to personal data, limited to authorised staff.
Monitoring systems, firewalls, and regular security audits.
Incident response procedures, including mandatory breach notifications under the Privacy Act 2020.

Users are encouraged to protect their own accounts by using strong passwords and not sharing login details.

6. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy, or as required by law. Typical retention periods are:

Customer and installer records: up to 7 years (to meet business, insurance, and tax obligations).
Enquiry and service request data: retained for at least 7 years for compliance and dispute resolution.
Analytics and tracking data: retained for 12 months for performance optimisation.

Data no longer required is securely deleted or anonymised.

7. User Rights

Users have the right to:

Access: Request a copy of personal data we hold.
Correction: Update or amend inaccurate data.
Deletion: Request removal of personal data (subject to legal requirements).
Restriction: Limit processing in certain circumstances.
Withdraw Consent: Opt out of marketing or communications at any time.

Requests can be made by contacting us at [email protected]. We will respond within 30 days of receiving a verified request.

8. Cross-Border Data Transfers

If personal data is stored or processed overseas, we ensure that:

The receiving party provides safeguards comparable to those required under the NZ Privacy Act 2020.
Appropriate measures are taken to protect personal information when hosted by international cloud providers.

9. Policy Updates

We may update this Data Policy from time to time to reflect changes in business practices, regulations, or technology. Significant updates will be communicated via:

Notices on our website, and
Email notifications where appropriate.

Continued use of our services following updates constitutes acceptance of the revised policy.

10. Contact Information

For questions or to exercise your rights under this policy, please contact:

Entity Name: Light for Life Limited
Trading As: Skylights.co.nz
Email: [email protected]
Response Time: within 5 business days