Privacy Policy

Tripwire Digital Ltd (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, enquire about or attend our training, or engage our consulting services. We are a New Zealand-registered company and comply with the New Zealand Privacy Act 2020 and, where they apply to us, other privacy laws.

We may collect personal information that you voluntarily provide when you fill out contact forms, complete our training readiness questionnaire, subscribe to communications, or engage our services. This includes your name, email address, phone number, company name, your answers about your business’s current AI use, comfort level, tools and goals, and any other details you choose to share. We also automatically collect certain technical data when you visit our website, including your IP address, browser type, operating system, referring URLs, pages visited, and the dates and times of your visits. This information is collected through cookies, server logs, and similar technologies.

We use the information we collect to deliver and improve our services, respond to your enquiries and requests, communicate with you about projects, updates, and relevant industry information, analyse website usage to improve user experience and site performance, and comply with legal obligations. We do not sell or rent your personal information to third parties, and we do not use information you send us through this website to train AI models.

Our website uses cookies and similar tracking technologies to enhance your browsing experience and gather analytical data. Cookies are small text files stored on your device that help us understand how you interact with our site. You can control cookie preferences through your browser settings. Disabling cookies may affect your experience on certain parts of our website. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted or expired).

We use third-party services to help us operate our website and deliver our services. These include Vercel (website hosting), Resend (delivering contact form messages to our inbox), Cloudflare Turnstile (checking form submissions are from a person, not a bot), Upstash (short-term rate limiting of form submissions by IP address), Google Tag Manager and Google Analytics for website traffic analysis, Google Ads for advertising measurement and remarketing, and other advertising and analytics partners. These services may collect information about your online activities across different websites. Each third-party service operates under its own privacy policy, and we encourage you to review their respective policies. We do not control how these third parties collect or use your data beyond what is necessary for our stated purposes.

Several of the services we use store or process information on servers outside New Zealand, for example in Australia, the United States or Europe. When we send personal information to an overseas provider, we take reasonable steps, as required by information privacy principle 12 of the Privacy Act 2020, to make sure it is protected in a way that is comparable to New Zealand law. By submitting information through our website, you acknowledge it may be stored or processed overseas by these providers.

When you book or attend our training or coaching, we collect the information needed to run it: participant names, work email addresses, roles, attendance, and your answers to our readiness questionnaire. We use this to tailor the sessions, communicate with participants, and provide follow-up support.

During hands-on sessions, participants work in their own (or their employer’s) AI accounts, such as ChatGPT, Microsoft Copilot or Google Gemini. Anything a participant enters into those tools is handled by that provider under the participant’s or organisation’s agreement with them, not by us. We recommend participants do not enter other people’s personal information, or confidential customer data, unless their organisation’s policy and the tool’s settings allow it.

We do not keep copies of participants’ work from sessions except where you share it with us for follow-up support, and we delete it when that support period ends.

When we provide consulting services, we may access, process, or store information belonging to our clients and their customers. This may include business data, account credentials, analytics data, advertising account information, and communications shared with us for the purpose of delivering our services.

The collection, use, and handling of client data during a consulting engagement is governed by the specific Consulting Services Agreement, Non-Disclosure Agreement, and Security and Governance schedule agreed between Tripwire Digital Ltd and each client. Those agreements, not this Privacy Policy, set out the obligations, restrictions, and safeguards for client engagement data.

This Privacy Policy applies to information collected through our website and direct communications with us. It does not govern data processed as part of a consulting engagement, which is subject to the terms of the relevant client agreement.

If you are a client or prospective client with questions about how your data is handled during an engagement, please contact us directly.

In delivering our consulting services, we may use artificial intelligence tools, large language models, code assistants, and automation platforms to assist with tasks such as drafting, analysis, data processing, and workflow design.

We take reasonable steps to ensure that:

• client data shared with AI tools is limited to what is necessary for the specific engagement task;
• we do not send personally identifiable information belonging to our clients or their customers to external AI services unless expressly agreed with the client in writing;
• all AI-assisted outputs are reviewed by qualified professionals before delivery; and
• the specific tools used and their data handling practices are documented in the Security and Governance schedule of each client engagement.

The AI and third-party tools we use operate under their own privacy policies and terms of service. We select tools that meet reasonable security and privacy standards, but we do not control how these providers process data beyond the controls available to us as users of their services.

Upon completion or termination of a consulting engagement, we handle client data in accordance with the terms of the relevant Consulting Services Agreement. This typically includes:

• returning or providing access to all client-owned data and deliverables;
• deleting or destroying local copies of client data within a reasonable timeframe after the engagement ends;
• retaining only such records as are necessary for compliance, legal, or legitimate business purposes (such as evidencing the work performed, supporting warranty obligations, or meeting tax and regulatory requirements); and
• revoking access to client systems and rotating any shared credentials.

Specific data retention and offboarding obligations are documented in the Security and Governance schedule of each engagement.

For information about how we retain data collected through this website (such as contact form submissions and analytics data), please refer to the "How We Use Information" and "Cookies and Tracking" sections above.

Under the New Zealand Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it. You can also ask us to delete it. If you are in another country, you may have further rights under your local laws (such as the GDPR). To make a request, contact our privacy officer using the details below. We will respond within the timeframes the Privacy Act requires.

If you are not happy with how we have handled your personal information, please talk to us first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

Our website and services are not directed at individuals under the age of 13. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 13, we will take steps to delete that information as promptly as possible. If you believe a child has provided us with personal information, please contact us immediately.

We take reasonable steps to protect personal information from loss, misuse and unauthorised access, including multi-factor authentication on our accounts and limiting access to the people who need it. No online service is completely secure. If a privacy breach happens that is likely to cause someone serious harm, we will notify the affected people and the Privacy Commissioner as the Privacy Act requires.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the date at the top of this page. We encourage you to review this policy periodically to stay informed about how we are protecting your information.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact our privacy officer, Luke Gray, at luke@tripwiredigital.co.nz, or use the contact form on our website. Tripwire Digital Ltd, New Zealand. We are committed to resolving any concerns you may have about our collection and use of your personal information.