Draft for legal review. Written for the New Zealand Privacy Act 2020 (including IPP 3A) and the Australian Privacy Act 1988 and Australian Privacy Principles, as at October 2026. Replace the highlighted items and have a privacy lawyer in New Zealand and Australia review it before launch.
Privacy policy
This policy explains how [Privami Limited] (NZBN [NZBN], [ABN / ARBN], "Privami", "we") handles personal information in the Privami app, the Privami box on employers' careers pages, and this website.
The short version
- Recruiters see your work details without your name. Your name and contact details go to one recruiter, for one role, only when you say yes.
- Your current employer, and every recruiter who works for them, never see you.
- We don't sell your information and we don't show ads.
- You can see, download, change or delete everything we hold, at any time.
1. The laws we follow
- New Zealand: the Privacy Act 2020 and its Information Privacy Principles, including IPP 3A on information collected from someone other than you.
- Australia: the Privacy Act 1988 and the Australian Privacy Principles, including the Notifiable Data Breaches scheme. We apply the APPs in full whether or not a small business exemption might apply to us.
- Emails and texts: the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Australia).
2. What we collect from job seekers
| Type | Examples | Required? |
|---|---|---|
| Account | Email address, sign-up date, the policy versions you accepted | Yes, to sign you in |
| Work profile | Job title, level, years of experience, skills, locations, work style, job type, industries, pay range, notice period, where you can work, relocation, commute, how ready you are to move | No. Leave out anything you like |
| Contact details | Name, and if you add them: mobile number, LinkedIn, CV (PDF or Word, up to 5 MB), how and when you like to be contacted | Only shared after you say yes |
| Where you work now | Your current employer | No. Used only to hide you from them |
| Companies you hide from | Any other companies you choose | No |
| About you | Region, suburb or postcode, age range, gender, languages, education, how you heard about us | No. Every answer can be skipped |
| Choices | Each switch you turn on or off, and when | Yes, so we respect them |
| Activity | Pages and tabs you open, jobs you view and save, companies you watch, requests you answer, searches, settings you change | Recorded as you use Privami; analytics can be turned off |
| Careers page box | On an employer’s careers page: the roles you picked, how ready you are, the page you were on, and your email if you give it | Only if you use the box |
| Your answers to requests | Yes or no to each request and, only if you choose, a reason for a no (for example "pay is too low") | The reason is optional |
| What happened next | After a yes, the recruiter can record interviewing, offered, placed or not progressed. You see it on your Requests tab | Comes from the recruiter |
| How you found us | The website button or campaign link you arrived from (for example a LinkedIn post), recorded once when you sign up | Recorded automatically; no extra details |
| Technical | Internet address, browser and device type, security and audit logs. Not your precise location | Yes, for security |
We don't ask for, and you shouldn't give us, sensitive information such as health, ethnicity, religion, political views, union membership, sexual orientation or criminal record. If it's included by mistake, for example in a CV, we only store it as part of that file and delete it when you remove the file.
3. Visitors to this website
We count visits to this website so we can see which pages help and where visitors come from. For each visit we record the pages viewed, the buttons clicked, the name of the site that linked to us (not the full address), any campaign tags in the link, and whether you're on a phone or a computer. We don't use cookies, we don't store your internet address, and we don't know who you are. A random visit number stays in your browser's session storage until you close the tab. If your browser sends Do Not Track or Global Privacy Control, we record nothing. If you go on to sign up, we note which button and campaign brought you, so we know which marketing works.
4. What we collect from recruiters and employers
Name, work email, the agency or company you work for, the clients an agency lists, the roles a recruiter types when asking to meet someone, the searches recruiters run (job title, skills, places and how many people were found), requests, introductions and what happened after them, and security and audit logs.
5. How we use it
| Purpose | Information used | Basis |
|---|---|---|
| Showing you jobs and showing your card to suitable recruiters | Work profile, activity | To provide the service you signed up for |
| Keeping you hidden | Where you work now, companies you hide from, and the clients each agency lists | To keep our promise to you |
| Showing your card to recruiters, without your name | Work profile; pay range and industries only if you allow each | Your choice: the "Open to hear" switch |
| Sharing your details with one recruiter | Name, email, mobile, LinkedIn, CV | Your yes to that specific request |
| Introducing you to an employer | The same details | Your yes to that employer’s role |
| Emails about requests, and job emails | Email, matches | Requests: needed for the service. Job emails: your choice, at the frequency you pick |
| Texts about requests | Mobile number | Only if you turn texts on |
| Analytics | Every profile field and your activity | Your choice; on by default, and you can turn it off on the Cookies page in the app |
| Anonymous counts for employers | Work profile, grouped | Your choice; you can turn it off. Groups of 10 or more only, never including that employer’s staff |
| Improving and marketing Privami | Anonymous website visits; how sign-ups found us | Counts only, never used to decide anything about you |
| Security, fraud prevention, legal duties | Technical and account data, audit logs | Needed to run Privami safely and lawfully |
About analytics. Our analytics takes into account all of your profile attributes and what you do on Privami. We use it to improve matching and the service, and to produce anonymous counts for employers. You can see the activity we've recorded, and switch analytics off, on the Your data page in the app.
We never show your "About you" answers to recruiters or employers, and never use age, gender or other personal characteristics to rank, filter or exclude you.
6. Recruiters and employers
- Recruiters only see you if "Open to hear" is on. They see a card with your work details and no name, photo, employer or contact details.
- A recruiter can ask to meet you about a specific role, with its employer, place and pay. We remind you once after 3 days, and the request closes after 7 days if you don't answer.
- If you say yes, your name and contact details, and your CV if you added one, go to that recruiter for that role.
- That recruiter can introduce you to that role's employer, and only that employer.
- If you say no, you can give a reason. The recruiter sees the reason with their request, never your name.
- After a yes, the recruiter can record what happened next: interviewing, offered, placed or not progressed. You see what they recorded on your Requests tab, and can ask us to correct it.
- Every agency must list every client it recruits for. You are never shown to an agency that lists your current employer, or a company you've hidden from, as a client. We treat trading names, short names and related company names as the same company.
- Employers see the people introduced to them, and weekly counts of people open to move. Counts are rounded down to the nearest 5, cover groups of at least 10, and never include the employer's own staff.
- Agencies sign an agreement before they get access. They can't export the people on Privami. Once you've said yes, the agency is also responsible for your details under its own privacy obligations.
7. Automated decisions
A computer program works out match scores from your work profile and activity. They decide which jobs you see first and which recruiters' searches show your card. They never decide who is introduced or hired: that needs your yes and a person's decision. Ask us and we'll explain how a score was worked out. This is our disclosure under the Australian automated-decision transparency requirements that apply from 10 December 2026.
8. Emails and texts
We email you about new requests and a reminder if one is unanswered, sign-in links, account warnings and changes to these terms. Job emails and news are your choice, and every one has a one-click unsubscribe link that takes effect immediately. Texts are off unless you turn them on: one text per new request and one reminder, between 9am and 8pm your time, saying only that you have a request on Privami. They never name the recruiter or the role.
9. Where it's stored
We store data with DigitalOcean in Sydney, Australia. Our email provider, [provider, e.g. Amazon SES in Sydney], processes your email address to send messages. If you turn texts on, Twilio processes your mobile number to send them, and may do so in the United States. Where a provider handles information outside New Zealand or Australia, we take reasonable steps under IPP 12 and APP 8 to make sure it's protected to a comparable standard, including contracts. Our Privacy Officer can give you a current list of providers.
10. Keeping it secure
Data is encrypted in transit (TLS 1.2 or later) and at rest. Sign-in uses one-time email links instead of passwords, and sessions use a secure, http-only cookie. Staff access is limited to people who need it, protected by multi-factor authentication, and logged. To report a security issue, see our security contact file.
11. How long we keep it
- Your account and profile: until you delete them. If you don't sign in for 18 months, we email you, then delete your account 30 days later unless you sign in.
- When you delete your account, your data is removed from our live systems straight away and from backups within 35 days.
- Activity records: 13 months.
- Careers page box responses with no email: 90 days.
- Enquiries through this website: 12 months.
- Anonymous website visit records: 13 months.
- Recruiters' search records: 13 months.
- Choice records and security logs: 2 years, for audit, unless the law needs longer.
- Anonymous weekly counts: 8 weeks.
12. Your rights
You can see, download, correct and delete your information yourself on the Your data page in the app, and change any choice at any time. You can also ask our Privacy Officer. We reply within 20 working days (New Zealand) or 30 days (Australia), free of charge. If we refuse a request, we'll explain why and how to complain.
13. Data breaches
If a breach is likely to cause you serious harm, we tell you and the Office of the Privacy Commissioner (New Zealand) and/or the Office of the Australian Information Commissioner as soon as practicable, as both laws require.
14. Age
Privami is for people aged 18 and over. If we learn that an account belongs to someone younger, we close it and delete the data.
15. Questions and complaints
Contact our Privacy Officer at privacy@privami.com or [registered address]. We acknowledge complaints within 5 working days and aim to resolve them within 20 working days. If you're not happy with our answer:
- New Zealand: Office of the Privacy Commissioner, privacy.org.nz
- Australia: Office of the Australian Information Commissioner, oaic.gov.au
16. Changes
If we make an important change, we tell you by email and in the app at least 14 days before it takes effect, and ask for your agreement again where the law requires it.