Purpose

We understand that how we collect, use, share and protect your personal information matters to you, and we value your trust. That is why protecting your information and being clear about what we do with it is a vital part of our relationship with you.

This Privacy Policy explains how we manage personal information in accordance with the New Zealand Privacy Act 2020, including how we collect, store and use information from clients and users of our digital platforms (i.e. our website, any social media pages and email communications).

 

Consent to Privacy Policy

By contacting us through our website, social media pages or email communications you acknowledge that you have had the opportunity to read and understand this Privacy Policy.

If you prefer not to engage through digital platforms, you can contact us by phone on 027 737 8507.

 

Collection of personal information

Personal Information is defined under the Privacy Act 2020 as information about an identifiable individual (a natural person as opposed to a company or other legal entity).

Where we need to verify your identity electronically, and you have agreed to this method, you authorise your mobile service provider to share relevant account details for the purpose of verifying your identity, for example, your name, address and device information.

This information will only be used for verification and handled in accordance with our Privacy Policy and the Privacy Act 2020.

 

Types of personal information we collect

The types of personal information we collect will depend on how you interact with us. We only collect personal information that is necessary. Where reasonable and practicable, we will collect your personal information directly from you and inform you that we are collecting it.

We may collect personal information when you:

• Complete an investment application,
• Contact our staff by phone or video call (e.g. MS Teams, Zoom or Skype),
• Use our website, social media pages or email newsletters,
• Email or write to us, or
• Participate in a marketing campaign, competition or promotion (or a similar event) administered by us or our representatives.

If it is not obvious that we are collecting personal information, we will do our best to make it clear to you so that you are always aware when information is being collected.

The types of personal information we collect, and hold may include:

• Your name and date of birth,
• Contact details (e.g. email address, postal address, phone number),
• Details relating to your use of any product and/or service offered by us,
• Details of your enquiry or communication,
• Details of any preferences you tell us about (such as subscription preferences), and
• Financial status.

We may also collect personal information from:

• Publicly available sources (e.g. online sources such as directories), and
• Your professional advisers (e.g. sharebroker, lawyer or your accountant) where you have given us express consent.

From 1 May 2026, a new Information Privacy Principle (IPP), IPP3A, will come into effect under the Privacy Amendment Bill, which was passed by Parliament in September 2025.

This change will require organisations to notify individuals when collecting personal information indirectly (i.e. from someone other than the individual themselves), unless a specific exception applies.

The update is designed to improve transparency and ensure you know when your information is being gathered and why.

Adminis NZ Ltd and IPP 3A

Certain personal information which we share with Adminis NZ Ltd (Adminis) may amount to an indirect collection of personal information by Adminis and be subject to IPP 3A. This could include personal information collected from our staff, directors and other authorised representatives in the course of Know-Your-Customer (KYC) and the continued delivery of our services.

We share this information only where it is necessary for Adminis to perform its functions, and we provide only the information required. The types of information indirectly collected may include identification information, contact details, role‑related information, and documentation required to meet regulatory or operational obligations.

Adminis is responsible for meeting its own obligations under IPP 3A in relation to any personal information it indirectly collects.

Your personal information will be shared with, and collected, held and handled by Adminis in accordance with their privacy policy, available at Adminis | Fund Administration & Wealth Platform NZ.

Additionally, please find attached the updated Data Protection Notice of our underlying custodian, BNP Paribas:

https://apac.bnpparibas/en/australia-new-zealand/data-protection-notice-new-zealand/

Please note that while we take care when working with third parties, their privacy and security practices are outside our control and not covered by this Privacy Policy.

 Other Providers and IPP 3A

We also use a number of third‑party service providers to support our operations, including customer relationship management platforms, electronic signature providers, IT hosting, communication tools and secure cloud‑based systems. Some of these providers may indirectly collect personal information in the course of delivering their services. These providers handle personal information in accordance with their own privacy policies, and their privacy and security practices are outside our control.

 

Online device information and cookies

When you visit our website, social media pages or email communications, we may collect information about your use and experience using cookies. Cookies are small data files stored on your device that help remember your visit and improve your experience.

Our cookies cannot access your hard drive, control your device or be shared with non-McBride Wealth platforms. They are designed to enhance your interaction with our digital services, not to track or profile across other websites.

When you interact with us through our website, social media pages or email communications, the information collected through the cookies may include:

• Date and time of visits,
• Page viewed and navigation patterns,
• Referring websites or platforms,
• Form interactions (e.g. fields completed),
• Location and device details, and
• IP address (or addresses) and browser type.

We will not ask you to supply personal information publicly on social media. If needed, we may invite you to send your details to us through a private message or secure channel, for example, to answer a question.

You may also be invited to share your personal information through secure channels to participate in other activities, such as competitions. We will always seek your express consent before including you in such activities.

 

Purpose of collection and use of personal information

We collect personal information to:

• Assess your eligibility for our products or services,
• Deliver and manage those services,
• Respond to your enquiry, and/or
• Share information about other products or services you may be interested in.

We also maintain personal information where required by law, including for disclosure to regulatory bodies (see “Disclosure of your personal information” below). These bodies have a legal right to access certain information, and we only share what is necessary to meet those obligations.

 

Storage and protection of your personal information

We may electronically record and store personal information that we collect from you. When we do so, we will take all reasonable steps to keep it secure and prevent unauthorised access, use, modification, or disclosure, in accordance with the Privacy Act 2020.

While we use robust safeguards, no system is completely immune to unauthorised access (e.g. hacking).  If a privacy breach occurs, we will act promptly to contain the breach, mitigate harm, and notify affected individuals. If the breach is serious, we will also notify the Office of the Privacy Commissioner as required under the Privacy Act 2020.

If we provide you with passwords or other security devices, it is important that you keep these confidential and do not allow them to be used by any other person. Please notify us immediately if the security of your password or security device is compromised. This will help prevent the unauthorised access or disclosure of your personal information.

Some information we hold about you will be stored in paper files, but most information is stored electronically on physical hard drives and in the cloud via secure cloud service providers. For more detail, see “Cloud-based service providers” below.

We use a range of physical and electronic security measures to protect the security of the personal information, including:

• Controlled access to information systems through identity and access management procedures,
• Secure premises where business is conducted,
• Internal information security policies that all employees are bound by,
• Mandatory training for employees about information security and privacy,
• Protective arrangements when sending information overseas or using third party service providers,
• Regular monitoring and review of our compliance (and our service providers’ compliance) with internal policies and industry best practice,
• A records management policy that ensures we only retain personal information for as long as necessary, or as required by law. Outdated, irrelevant or unnecessary information is securely destroyed.

 

Cloud-based service providers

We use third party service providers to store and process most of the personal information we collect.  Currently, we use Microsoft 365 and HubSpot cloud servers located in Australia.

We take reasonable steps to ensure that our cloud-based service providers protect personal information in a way that is comparable to the safeguards set out in the Privacy Act 2020. This includes requiring appropriate security and information handling arrangements and ensuring that any personal information stored or processed by these providers remains subject to strict confidentiality obligations.

 

Timeframes for keeping personal information

We retain personal information only for as long as it is needed for lawful, regulatory, or legitimate business purposes. When personal information is no longer required, we take reasonable steps to destroy or permanently de-identify it as soon as practicable.

For information relating to our advice services or products we have provided, we are legally required to hold this information for seven years. After this time, provided that the personal information is no longer relevant to any ongoing service, we will take reasonable steps to safely destroy or de-identify it.

Our records management policy outlines how we manage, review, and dispose of information to ensure outdated, irrelevant or unnecessary records are securely handled in accordance with our legal obligations.

 

If there is a privacy breach

We work hard to keep your personal information safe. However, despite applying strict security measures and following industry standards to protect your personal information, there is still a possibility that our security systems could be compromised or breached.

If we experience a privacy breach involving loss, unauthorised access, or disclosure of personal information that is likely to cause serious harm, we will act promptly. As soon as we become aware of the breach, we will:

• Identify and secure the breach to prevent further incidents and minimise harm,
• Assess the nature and severity of the breach, including the type of personal information involved and the potential impact on affected individuals,
• Involve the appropriate authorities if criminal activity is suspected,
• Notify affected individuals directly, where appropriate and practicable,
• Post a notice on our website to inform clients, if appropriate, and
• Notify the Office of the Privacy Commissioner, as required by law.

 

Disclosure of your personal information

We may disclose your personal information to parties outside McBride Wealth where:

• It is necessary to achieve the purpose for which the information was collected,
• We are required or authorised to do so by law, or where we have a public duty,
• You have given your express consent, or your consent can be reasonably inferred from the circumstances, or
• The disclosure is permitted under the Privacy Act 2020.

 

Parties we may disclose your information to

We may use your personal information to provide advice and services to you. In doing so, we may disclose your information to third parties such as:

• Outsourced service providers who support our operations such as auditors and external compliance reviewers,
• Our external dispute resolution service,
• Regulatory authorities,
• Credit reporting and debt collecting agencies,
• McBride Wealth’s related companies.

If disclosure to a third party is not necessary to provide our services, we will not share your personal information without your consent.  We will never sell your personal information or accept payment for disclosing it.

 

Sending your information overseas

If we need to send your personal information overseas, this does not change our commitment to safeguarding your privacy. We ensure that appropriate security and information handling arrangements are in place, and that your information remains subject to strict confidentiality obligations.

We recognise that privacy laws and information protection standards vary between countries. If we need to send your personal information to a country that has lower privacy safeguards than in New Zealand, we will take reasonable steps to protect your information. Where it is not possible to ensure comparable protection, we will inform you and seek your consent before proceeding.

 

Third party websites

Our website and/or social media pages may contain links to third party websites that are not under our control. These websites are not covered by this Privacy Policy, and we are not responsible for their privacy or security practices.

We encourage you to review the privacy and security policies of any third-party websites you visit.

We do not sponsor, recommend, or endorse the content of linked websites, and we have no control over their nature, availability or accuracy. We accept no liability for any loss or damage you may suffer because of relying on content found on or missing from those websites.

 

Right to access, correct and delete personal information

You have the right to request access to, correct and, in some circumstances, delete your personal information. You can do so by contacting us at:

40 Major Hornbrook Road
Mount Pleasant, Christchurch 8081
or via e-mail tom@mcbridewealth.co.nz

When we receive your request, we will take reasonable steps to respond within a timely manner. This may include updating or deleting your personal information, providing access, or otherwise addressing your query. To protect your privacy, we may ask you to verify your identity before processing your request.

We can only delete personal information where it is not required to meet any legal, regulatory, or business obligations.

There is no fee to request a correction or deletion of your personal information. If you request access, we may charge a reasonable fee to cover the cost of locating and supplying the information.

In some circumstances, we are not required to provide access to your personal information. If we refuse your request to access, correct or delete your personal information, we will explain our reasons, unless the law prevents us from doing so.

If we refuse your request to correct or delete your personal information, you have the right to request that a statement be associated with your record noting that you disagree with its accuracy.

We will also provide information on how to lodge a complaint if your request is refused.

 

What happens if you do not provide us with your information?

If you choose not to provide information we have requested, you may be unable to access or use our services for which the information is required.

Please ask us if you are unsure what information is important and how this might affect you.

 

Changes to this Privacy Policy

We review this Privacy Policy regularly to ensure it remains current. The latest version is always available here on our website. If we make significant changes, we may notify you directly.

You can also request a copy of the latest version by calling us on 027 737 8507.

 

Privacy Policy queries and concerns

If you are concerned about how your personal information is being handled or if you believe that your privacy has been compromised in any way, please contact us at:

40 Major Hornbrook Road
Mount Pleasant, Christchurch 8081
or phone 027 737 8507

 

If you have a privacy complaint

If you’re not satisfied with our response to any privacy-related concern, you have the right to contact the Office of the Privacy Commissioner.

You can find their contact details here: https://www.privacy.org.nz/about-us/contact/

The Privacy Commissioner can provide independent guidance and may investigate your complaint, if appropriate.