Privacy Policy

1. Data Controller

ENORBY ("we", "us", "our") is a managed IT services and cybersecurity firm operating in Auckland, New Zealand. This policy governs the collection, processing, storage, and protection of personal information obtained through enorby.co.nz.

2. Information We Collect

Provided directly by you

• Contact forms: Full name, email address, telephone number, company name, and message content.
• IT Scorecard: Business environment information and assessment responses submitted through our infrastructure evaluation tool.
• Correspondence: Content of any direct email communication you initiate.

Collected automatically

• Server logs: IP address, browser type, operating system, referring URL, and pages accessed. Retained for security and diagnostics only.
• Cookies: Limited first-party cookies for security and functionality. Full disclosure in our Cookie Policy.

Information we do not collect

• We do not use Google Analytics or third-party tracking scripts.
• We do not collect payment information through this website.
• We do not deploy social media pixels, advertising identifiers, or device fingerprinting.

3. Purpose of Processing

• Responding to business enquiries and delivering requested services.
• Generating and delivering IT Scorecard assessment results.
• Follow-up communications related to your enquiry (opt-out at any time: reply "unsubscribe" or email info@enorby.co.nz).
• Maintaining website security and operational performance.
• Fulfilling obligations under New Zealand law.

4. Lawful Basis

Under the Privacy Act 2020 (Information Privacy Principles), we process personal information on the following bases:

• Consent: Voluntarily provided when you submit information through our forms.
• Legitimate purpose: Necessary for business operation and fulfilment of your requests.
• Legal obligation: Where required by applicable New Zealand legislation.

5. Security Measures

• All data stored on encrypted infrastructure with TLS in transit and AES-256 at rest.
• Access restricted through role-based controls with multi-factor authentication.
• Systems monitored continuously and subject to regular security assessments.
• Data retained only as long as necessary for its stated purpose, or as mandated by law.

6. Data Breach Protocol

In the event of a notifiable privacy breach as defined under Part 6A of the Privacy Act 2020:

• Affected individuals notified without unreasonable delay — detailing the breach nature, data involved, and recommended protective actions.
• The Office of the Privacy Commissioner notified as required by statute.
• Immediate containment and remediation measures enacted.

Target notification window: 72 hours from confirmed discovery. Internal incident response plan maintained and reviewed quarterly.

7. Sub-Processors & Third Parties

• CRM Platform: Stores contact name, email, and company for enquiry management.
• Hosting Provider: Infrastructure hosting with encrypted connections.
• Typography: All fonts self-hosted — no external font services.

We do not sell, rent, trade, or disclose personal information to any third party for their independent use. A list of current sub-processors is available upon request to info@enorby.co.nz.

8. Your Rights

Under the Privacy Act 2020, you may exercise the following at any time:

• Access (IPP 6): Request a copy of all personal information held about you.
• Correction (IPP 7): Request amendment of inaccurate or incomplete data.
• Deletion: Request erasure of your data, subject to lawful retention requirements.
• Complaint: Lodge a formal complaint with the Office of the Privacy Commissioner.

Contact info@enorby.co.nz to exercise any right. We respond within 20 working days as required by statute.

9. Data Retention

• Contact form submissions: 24 months, then securely deleted.
• IT Scorecard assessments: 12 months after delivery.
• Server logs: 90 days.
• Client engagement records: Duration of relationship plus 7 years (NZ tax obligations).

Upon expiry, data is purged from all systems including backups within 30 days.

10. Children's Privacy

Our services are intended exclusively for businesses and individuals aged 18 and over. We do not knowingly collect information from persons under 18.

11. Policy Amendments

This policy may be revised to reflect changes in our practices or regulatory obligations. Material changes affecting your rights will be communicated with 14 days' advance notice via the website or email.

12. Contact & Complaints

• Email: info@enorby.co.nz
• Phone: 020 4047 7367
• Regulator: Office of the Privacy Commissioner