Privacy Policy - Insurance

Small Change NZ (2023) Limited is committed to protecting your personal information and complying with the Privacy Act 2020, the Privacy Amendment Act 2025, the Information Privacy Principles (IPPs), and the Code of Professional Conduct for Financial Advice Services.

This policy explains how we collect, use, store, and protect your information when providing insurance, lending, and financial advice services.

1. What Personal Information We Collect

We collect the personal information necessary to provide you with financial advice and related services. This may include:

• Contact details

• Financial information

• Medical information (for insurance purposes)

• Employment and income details

• Existing insurance and lending information

• Meeting notes, call recordings, and documentation

• Any other information required to assess your needs

You may choose not to provide certain information, but this may limit our ability to provide suitable advice.

2. How We Use Your Information

We use your information for the following purposes:

• Providing life, health, risk, and medical insurance advice

• Providing lending, mortgage, and KiwiSaver guidance

• Assessing product suitability and preparing recommendations

• Applying for products with insurers, lenders, and providers

• Supporting underwriting and claims processes

• Meeting regulatory, audit, and compliance obligations

• Quality assurance and dispute resolution

• Communicating relevant updates, where consent has been given

We only use your information for the purposes you have authorised.

3. Use of Technology, AI & Automated Tools (IPP3A Compliance)

To support accuracy and meet regulatory record‑keeping standards, we use AI‑supported tools and automated systems for:

• Meeting transcription

• Document preparation

• File‑note accuracy

• Analysis and administrative support

Human Oversight: All advice, recommendations, and decisions are made by a licensed human adviser. Your Right to Review: Under IPP3A, you may request human review of any information processed using automated systems.

We do not use AI to make eligibility decisions or automated determinations about your insurance or lending outcomes.

4. How We Store and Protect Your Information

Your information is stored securely in encrypted systems, including trusted third‑party platforms such as CRM and cloud‑storage providers that comply with New Zealand privacy law.

Information may be stored in secure cloud‑based facilities located in New Zealand or overseas.

We protect your information through:

• Access controls and authentication

• Encryption and secure storage

• Staff training and confidentiality obligations

• Monitoring and regular compliance reviews

We retain your information for as long as required by law, typically seven years after our business relationship ends.

5. Sharing Your Information

We may share your information with:

• Insurers and underwriters

• Lenders and mortgage providers

• KiwiSaver and managed‑fund providers

• Compliance auditors and dispute‑resolution services

• Technology providers that support our business operations

• Other parties where required by law

We do not sell or trade your personal information.

6. Meeting Recordings

With your consent, meetings may be recorded (audio or video) to support accurate documentation, compliance, and advice quality. Recordings are stored securely and accessed only for legitimate business or regulatory purposes.

7. Your Rights

You have the right to:

• Access the personal information we hold about you

• Request correction of any information that is inaccurate

• Request human review of any automated processing (IPP3A)

• Withdraw consent for marketing communications at any time

To exercise these rights, contact us at: matt@smallchange.nz

8. Privacy Breaches

If a privacy breach occurs that may cause harm, we will:

• Notify you as soon as practicable

• Take steps to minimise further risk

• Report the breach to the Office of the Privacy Commissioner (as required)

We maintain a breach register and follow a documented incident‑response process.

9. Updates to This Policy

We may update this policy to reflect changes in legislation or business practices. The latest version will always be available on our website.

Last updated: May 2026