Your data matters

Committed to safeguarding your information

NetFunds Privacy Policy

Last Updated: 7 November 2025

Introduction

NetFunds Nominee Limited (NetFunds, we, us, or our) provides a public-facing website (Website) to inform investors, clients and the general public about NetFunds, what we offer, and who we are.

NetFunds provides an online investor portal (Investor Portal) for investors to consider, invest and monitor the performance of investment opportunities created, managed, or administered by us or another company in the NetFunds group.

Combined, the Website, the Investor Portal, and other technology tools used by NetFunds are referred to as Services.

We respect the privacy rights of our users and recognise the importance of protecting the Personal Information we collect about you. This privacy policy is designed to outline the way in which we manage the Personal Information we hold about our investors, prospective investors, prospective employees, visitors to our Website and Investor Portal, and how we comply with the privacy laws that we are legally obliged to comply with, including the New Zealand Privacy Act 2020.

Personal information is information that relates to an identified or identifiable individual (Personal Information). If an individual can’t be identified (for example, when Personal Information is aggregated and anonymised) then the information is not Personal Information and this privacy policy doesn’t apply to it.

This privacy policy is governed by New Zealand law. For more information about privacy issues in New Zealand and protecting your privacy, visit the New Zealand Privacy Commissioner's website at www.privacy.org.nz.

When handling Personal Information, we will comply with Applicable Privacy Laws, including (as applicable), the New Zealand Privacy Act 2020 (NZPA), the General Data Protection Regulation (EU) 2016/679 (EU GDPR) and the United Kingdom General Data Protection Regulation (UK GDPR).

What kinds of personal information does NetFunds collect?

In general, and depending upon the nature of your connection with NetFunds Nominee Limited, the type of Personal Information we collect and hold includes (but is not limited to):

  • your name, addresses, contact details, date of birth, place of birth, tax identification number, tax residency status and citizenship;
  • information about your bank account details and financial and personal circumstances, including your source of funds (in some cases evidence of this), and transactional and financial information relating to your user account;
  • in the case of prospective employees, occupation, employment history and/or details, education and qualifications, testimonials and feedback;
  • documents that verify your identity and other personal details; and
  • other information which assists us in conducting our business, providing and marketing our services and meeting our legal obligations.

How does NetFunds collect personal information?

We collect your Personal Information in several ways when you use the Website, Investor Portal or Services. These can broadly be categorised as follows:

Information that comes directly from you

This is the Personal Information about you that you enter into the Website, Investor Portal or Services yourself, including any Personal Information you provide through the registration or investment process, through any contact with us (e.g. telephone calls, face to face meetings, Investor Portal enquiry forms or emails, or through the use of other Services. If you don’t want to provide your Personal Information, you don’t have to, but it may restrict the function of some parts of our Services.

Information we receive from third parties

We may receive Personal Information about you from third parties, for example:

  • we may use third parties to analyse traffic on our Investor Portal, websites and social media channels, which may involve the use of cookies;
  • where a third party provides security-related or identity verification services;
  • in some circumstances we might collect Personal Information about an individual from a third party (for example, an employment reference from another person and, including without limitation, for the purposes of our compliance with our anti-money laundering and sanctions compliance obligations);
  • from publicly available websites.

Information we receive from your use of the Investor Portal and Services

Some Personal Information is automatically collected when you perform any action on, or interact with, any part of our Services, including:

  • clickstream data, which is a record of how you navigate or click through our Investor Portal or Services; and
  • information obtained through the use of cookies, web beacons and similar storage technologies. Please refer to the section of this privacy policy entitled “Cookies and Tracking” for further information, including information on how you can disable these technologies

Whenever you lodge a support query using our “Help” or “Contact us” features on the Website or Investor Portal, we collect your name and email address to be able to reply to you and provide the support or advice requested.

How might NetFunds use your personal information?

We will not process Personal Information, other than as outlined in this privacy policy, without having a lawful basis to do so. We may process your Personal Information:

  • to create, manage and administer your User Account within the Investor Portal;
  • to review your eligibility to create or continue to use a User Account with us;
  • to process your application to become an investor and other matters in connection with the operation of the Investor Portal and your User Account including, without limitation, transfers, deposits, payments, generating reports and record keeping of investment portfolios;
  • to provide our Investor Portal and Services and otherwise carry out our obligations;
  • to bill you (or the Investment Entity on whose behalf you are acting) and to collect money that is owed and such processing is necessary for the performance of the contract between you (or the Investment Entity on whose behalf you are acting) and us.

We also process your Personal Information:

  • to verify your identity, including:
  • to check your identity against governmental and other databases, including the National Register of driver licences;
  • to check your identity against databases maintained by the New Zealand Department of Internal Affairs (including birth or death information recorded under the Births, Deaths, Marriages, and Relationships Registration Act 1995, citizenship information recorded under the Citizenship Act 1977, and/or travel document information recorded under the Passports Act 1992);
  • to check your identity against the records of the Document Verification Service (and related databases) maintained and provided by the Commonwealth of Australia; to check your identity against other governmental databases;
  • to identify, prevent or investigate any actual or suspected fraud, unlawful activity or threats to our systems; and
  • to comply with our legal obligations, including (but not limited to) in relation to our AML/CFT Act obligations, including in relation to FACTA and general tax regulation.
  • to communicate with you (including responding to feedback and information requests relating to our Investor Portal and the Services, to let you know when we are experiencing technical difficulties, and to alert you of new features or developments);
  • to communicate with, and comply with our obligations to, our third-party service providers, suppliers and other users of our Investor Portal and/or Services;
  • to send administrative messages, reminders, notices, updates, security alerts, and other information relevant to your use of the Investor Portal and/or the Services;
  • to engage third parties on your behalf;
  • to track access to the Investor Portal and Services in order to help detect and prevent any fraudulent or malicious activity;
  • to analyse and report on usage of the Investor Portal and Services, so we can improve the Investor Portal and Services;
  • to send you (or Investment Entity on whose behalf you are accessing the Investor Portal) marketing and promotional messages and other information that may be of interest to you where you (or the Investor Entity on whose behalf you are accessing the Investor Portal) have consented to receiving such material. You can opt out of receiving marketing materials from us by using the opt-out facility provided (e.g. an unsubscribe link) or by emailing us at info@netfunds.co.nz;
  • to keep you informed of investments we consider may be of interest to you, unless you ask us not to provide you with this information;
  • to protect and/or enforce our legal rights and interests, including defending any claim; and
  • to comply with our legal obligations, including (but not limited to) in relation to our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), the Financial Markets Conduct Act 2013, as well as obligations under the Double Tax Agreements (United States of America—FATCA) Order 2014 (FACTA) and general tax regulation. This may include any notification and reporting obligations and any access directions imposed on us by an applicable Government agency, law enforcement agency or regulatory authority, and such processing is necessary for the purposes of a legitimate interest pursued by us, and we have assessed that our interests are not overridden by your interests or fundamental rights and freedoms.

We may also process your Personal Information for such other purposes that are compatible with the original purposes described above, or that you otherwise consent to.

We may anonymise and aggregate information such that no person could be re-identified from the information. This aggregated and anonymised data is not Personal Information and this privacy policy does not apply to it.

To whom might NetFunds disclose your personal information?

We may disclose your Personal Information to:

  • your professional advisers, your authorised signatories and your agents;
  • other members of the NetFunds group, including its subsidiaries (if any) and related parties;
  • service providers and suppliers who provide necessary goods and/or services to us (including identity checks), and any other partners who help us market and sell the Investor Portal and/or the Services - for instance, to manage customer relations, send out newsletters and/or to process payments;
  • any business that supports us, including hosting or maintaining any underlying software, IT system or data centre that we use to provide our Investor Portal and/or Services;
  • other companies, agencies or individuals that maintain databases against which your identity may be verified, which may include (but is not limited to) the New Zealand Department of Internal Affairs, New Zealand Transport Agency, and the Commonwealth of Australia Document Verification Service;
  • our professional advisers (such as our lawyers who assist us to ensure we are complying with our legal obligations), and banks and other financial institutions as part of our obligations when paying or receiving funds on your behalf;
  • social media sites on which we have a presence, to the extent that you interact with us via a social media site. We limit interactions on social media sites that may disclose Personal Information to the private messaging functions of those sites, unless you otherwise request or give permission.
  • anyone who assists us to identify, prevent or investigate fraud, unlawful activity, misconduct or threats to our systems;
  • other third parties to anonymise and aggregate statistical information;
  • a person who can require us to supply Personal Information (e.g. a Government agency, regulatory authority or law enforcement agency);
  • respond to due diligence requests and/or transfer Personal Information in the case of a sale, merger, consolidation, liquidation, reorganisation or acquisition of our business; and
  • any other person or entity authorised by you.

The rights of disclosure in this section may, if applicable, be subject to further restrictions contained in data processing agreements with our third-party service providers (as applicable).

At no time will NetFunds sell your Personal Information to any third parties or transfer your Personal Information to any third parties, for a use not related to the provision or marketing of our products and services.

Overseas Transfers of Personal Information

NetFunds is located in New Zealand, so your Personal Information may be transferred and/or stored there. For the purposes of the EU GDPR and the UK GDPR, New Zealand has been recognised as providing adequate protection.

We utilise the services of third-party processors (or sub-processors, as applicable) in various countries who may access your Personal Information. Consequently, we may transfer Personal Information to persons or entities located in these countries. Although we will endeavour to ensure that Personal Information is treated securely and in accordance with this privacy policy as well as Applicable Privacy Laws, we advise that some of these countries may not have an equivalent level of data protection laws as those in New Zealand.

If we transfer Personal Information to a third party located in a country outside:

  • The European Economic Union that the European Commission has not recognised as providing adequate protection, if required by the EU GDPR we will enter into an agreement with that third party that contains the standard contractual clauses approved by the European Commission; or
  • the United Kingdom that the United Kingdom Government has not recognised as providing adequate protection, if required by the UK GDPR we will enter into an International Data Transfer Agreement or Addendum (as appropriate) issued under section 119A of the UK Data Protection Act 2018.

Internet Use

While we take reasonable steps to maintain secure internet connections, the supply of Personal Information over the internet is at your own risk.

If you follow a link on our Services to another website, the owner of that website will have its own privacy policy that will apply to its use of your Personal Information processed on that website. We suggest you review that website’s privacy policy before you provide access to your Personal Information.

How long does NetFunds keep Personal Information

We will keep your Personal Information:

  • until we no longer have a valid reason for keeping it;
  • until you request us to stop using it; or
  • for as long as required by law e.g., we keep invoice information for 7 years to fulfil our tax obligations.

When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymise such information, or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.

Cookies and tracking

Web Analytics

We use web analytics tools to collect information about the use of our Services, with the goal of improving our Services. These web analytics tools collect information such as how often users visit, what pages they visit when they do so, and what other sites they used prior to coming to the site.

We may use various technologies to collect and store information about you when you use the Services, and this may include using cookies and similar tracking technologies, such as pixels and web beacons, as described below.

Cookies

A cookie is a piece of information that our web server may send to your machine when you visit our Investor Portal. The cookie is stored on your device, but does not identify you or give us any information about your device.

The types of cookies we use may include (but are not limited to):

  • Session Cookies: These are temporary cookies that are erased when the user closes their web browser. They're used to remember user activity within a single session, making it smoother to navigate the site.
  • Persistent Cookies: Also known as permanent or stored cookies, they remain on the user's device even after the browser is closed. These cookies can be used to remember a user's login information, preferences, and other persistent information for future visits.
  • First-Party Cookies: These cookies are set by the website the user is visiting, and they typically allow the website to keep track of the user's activity during their visit.
  • Third-Party Cookies: These are set by domains other than the one the user is visiting, often by advertising and tracking services. They can be used to track a user's activity across multiple websites and build up a profile of their interests.
  • Secure Cookies: These cookies can only be transmitted over an encrypted connection (i.e., HTTPS). They help to ensure that the user's information is secure and prevent unauthorised access.
  • HTTP-Only Cookies: These cookies can't be accessed by client-side scripts, which makes them more secure against potential cross-site scripting (XSS) attacks.
  • SameSite Cookies: These cookies help prevent Cross-Site Request Forgery (CSRF) attacks by allowing servers to assert that a particular cookie should not be sent along with cross-site requests.

With most internet browsers, you can erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored. If you want to do this, refer to your browser instructions or help screen to learn more. If you reject the use of cookies, you will still be able to access our Services but please note that some of their functions may not work as well as if cookies were enabled.

Protecting Personal Information

We take the protection of Personal Information seriously and we will take reasonable steps (using physical, electronic and procedural safeguards) to keep Personal Information in our possession safe from loss, unauthorised activity, or other misuse. Staff who handle your Personal Information are provided with training on how to do so appropriately.

Your rights

You have the right to access your readily retrievable Personal Information that we hold about you, and to ask for it to be corrected if you think it is wrong.

If you are based in the EU or the United Kingdom you have the right, under the EU GDPR or the UK GDPR (as applicable), to:

  • in certain circumstances, have your Personal Information erased;
  • restrict the processing of your Personal Information;
  • move, copy or transfer your Personal Information easily for your own purposes across different services in a safe and secure way;
  • object to processing where we rely on our legitimate interests as the lawful basis for processing;
  • withdraw your consent at any time, where our processing of your Personal Information is based on consent; and
  • lodge a complaint with an appropriate supervisory authority, if you consider that our processing of your Personal Information has breached the EU GDPR or the UK GDPR (as applicable).

We will respond to any request made in respect of the above in accordance with the Applicable Privacy Laws.

Please note that in certain circumstances, we may refuse to respond to a rights request where we have the right to do so under Applicable Privacy Law, for example, where a request is manifestly unfounded or excessive.

Contact

If you wish to exercise your rights under this privacy policy or any Applicable Privacy Laws, you can do this by contacting NetFunds directly.

If you believe we are unlawfully processing your personal information and wish to lodge a complaint, you can lodge a complaint with us directly using the above contact details, or you can lodge a complaint with the New Zealand Privacy Commissioner. Information about how to lodge a complaint is available at Privacy Commissioner’s website.

If you are located in the EU or the UK, you also have the right to complain to your Member State data protection authority or UK data protection authority.

Changes to this Privacy Policy

From time to time we may make changes to this privacy policy (for example, to reflect any changes in our Services or any Applicable Privacy Laws). Where a change is significant, we’ll make sure we let you know – usually by displaying a notice on our Investor Portal or by sending you an email.