Privacy Policy

1. Who We Are

Kitenga (“we”, “us”, “our”) is a customer relationship and marketing platform operated by Kitenga Group Limited (NZBN: 9429053426604), a company registered in New Zealand. Our registered address is 17 Nelson Street, Helensville 0800, New Zealand.

Our Privacy Officer can be contacted at: [email protected]

2. What This Policy Covers

This policy explains how we collect, use, store, and share personal information through the Kitenga platform and related services. It applies to:

• Platform users — staff of organisations who use Kitenga to manage their customer relationships and marketing
• End contacts — individuals whose data is stored or processed within Kitenga by our customers
• Website visitors — people who visit kitenga.app

3. Information We Collect

3.1 From Platform Users

• Name, email address, and organisation
• Authentication credentials (passwords, passkeys, SSO tokens)
• Usage data (pages visited, features used, timestamps)

3.2 From End Contacts

Our customers use Kitenga to store and manage their own customer and contact data. This may include:

• Contact details (name, email, phone number, postal address)
• Organisation and role information
• Communication history (emails sent and received, engagement metrics)
• Behavioural data (website visits, event attendance, product usage)
• Marketing preferences and consent records
• Engagement and health scores derived from the above data

We process this data on behalf of our customers, who are the data controllers. Our customers are responsible for ensuring they have a lawful basis to collect and process this data.

3.3 From Website Visitors

• Standard web server logs (IP address, browser type, pages visited)
• Cookies for essential functionality and analytics

4. How We Use Personal Information

4.1 Platform Operation

We use personal information to:

• Provide, maintain, and improve the Kitenga platform
• Authenticate users and manage access permissions
• Send transactional communications (password resets, system notifications)
• Provide customer support
• Monitor platform security and prevent abuse

4.2 Audience Activation

Kitenga enables our customers to sync audience segments to third-party advertising platforms for targeted advertising. When a customer uses this feature:

• What is shared: Hashed (SHA-256) versions of contact identifiers (email addresses, phone numbers, names). Raw personal information is never transmitted to advertising platforms.
• Which platforms: Meta (Facebook/Instagram), Google Ads, LinkedIn, TikTok, and Display & Video 360 (DV360).
• Purpose: To create custom audiences for targeted advertising, suppression audiences to exclude existing customers, and lookalike audiences to find similar prospects.
• Data controller: The customer who initiates the sync controls which contacts are included and which platforms receive the data. Kitenga acts as a data processor.
• Consent: Our customers are responsible for ensuring they have obtained appropriate consent from their contacts for the use of their data in advertising, in compliance with applicable laws and the terms of each advertising platform.
• How it works: Contact data is hashed locally within Kitenga before transmission. Advertising platforms match the hashed data against their own user databases. Kitenga does not receive information about whether individual contacts matched.

4.3 Analytics and Insights

We process contact data to generate aggregated insights for our customers, including engagement scoring, segment membership calculations, campaign effectiveness measurement, and customer lifecycle analysis. These insights are provided to the customer who owns the data. We do not use one customer’s data to benefit another customer.

5. How We Share Personal Information

We share personal information only in the following circumstances:

We do not sell personal information. We do not use customer data for our own marketing purposes.

6. Data Storage and Security

6.1 Where Data Is Stored

Platform data is stored in cloud infrastructure located in the Australia (Sydney) region. Some third-party services may process data in other regions as required to provide their services.

6.2 Security Measures

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Per-tenant database isolation
• Role-based access control with module-level permissions
• Multi-factor authentication support (passkeys/WebAuthn, TOTP)
• Single Sign-On integration (Google Workspace, Microsoft Entra ID)
• Audit logging of access and changes to sensitive data

6.3 Data Retention

• Platform user accounts: Retained while the account is active. Deleted within 90 days of account closure.
• End contact data: Retained as long as the customer’s subscription is active. Deleted within 90 days of subscription termination, unless the customer requests earlier deletion.
• Audit logs: Retained for 24 months for compliance purposes.
• Hashed data sent to ad platforms: Governed by each platform’s own retention policies. Kitenga does not control data held by third-party platforms.

7. Your Rights

7.1 Under the New Zealand Privacy Act 2020

If you are a New Zealand resident, you have the right to:

• Access your personal information held by us
• Request correction of inaccurate personal information
• Know the purpose for which your information was collected
• Complain to the Office of the Privacy Commissioner if you believe your privacy has been interfered with

7.2 For End Contacts

If your personal information is stored in Kitenga by one of our customers, you should contact that organisation directly to exercise your rights. They are the data controller and are responsible for responding to your requests.

If you are unable to reach the organisation, or if you believe your data is being misused, you can contact us at [email protected] and we will assist where we can.

7.3 Advertising Opt-Out

If you wish to opt out of being included in audience data synced to advertising platforms:

• Contact the organisation that holds your data and request removal from marketing audiences
• You can also opt out directly with each advertising platform:
  • Meta: Ad Preferences
  • Google: Ad Settings
  • LinkedIn: Ad Preferences
  • TikTok: Privacy Settings

8. Cookies

We use cookies for:

• Essential: Authentication, session management, security
• Analytics: Understanding how the platform is used (aggregated, not individual tracking)

We do not use cookies for advertising or cross-site tracking.

9. Children’s Privacy

Kitenga is a business platform and is not directed at children under 16. We do not knowingly collect personal information from children. If our customers process data relating to minors, they are responsible for ensuring appropriate consent and protections are in place.

10. International Data Transfers

Personal information may be transferred to and processed in countries outside New Zealand, including Australia and the United States, where our infrastructure providers and third-party services operate. We ensure that appropriate safeguards are in place for such transfers in accordance with the Privacy Act 2020.

11. Changes to This Policy

We may update this policy from time to time. We will notify platform users of material changes via email or in-app notification. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact Us

If you have questions about this privacy policy or our data practices:

• Email: [email protected]

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Phone: 0800 803 909