Privacy Policy
This Privacy Policy explains how WAE Engineering Ltd (“WAE”, “we”, “us” or “our”) collects, holds, uses and shares personal information.
We provide engineering, fabrication, maintenance, construction, mechanical and vehicle inspection services, engineering-based labour hire and engineering retail services. This policy applies to personal information handled through our website, enquiries, customer and supplier relationships, service delivery, recruitment and other business activities.
Personal information means information about an identifiable individual. It can include business contact details and information in job, vehicle or project records where that information identifies a person.
We handle personal information in accordance with the Privacy Act 2020 and other applicable New Zealand law. WAE is the organisation collecting and holding the information described in this policy, except where a specific notice explains otherwise. Our contact details are in section 13.
1. Personal information we collect
We collect only personal information necessary for a lawful purpose connected with our functions or activities. Depending on your dealings with us, this may include:
your name, email address, telephone number and postal, billing or service address;
your organisation, role and business contact details;
enquiries, correspondence, booking details, quotes, orders, invoices and payment or account records;
project and site information, including contact people, access arrangements, work instructions and records of services performed;
vehicle registration and identification details, inspection results, servicing and repair history, and owner or customer contact details, where linked to an identifiable individual;
information needed for site inductions, qualifications, safety training, incident reporting and health-and-safety responsibilities;
recruitment, contractor or labour-hire information, such as applications, work history, relevant qualifications, licences, availability and referee details;
CCTV footage in which individuals may be identifiable;
vehicle location and speed information where linked to a driver or other individual;
photographs or video in which individuals may be identifiable; and
website technical and usage information, as explained in section 6.
These categories apply only where relevant to your dealings with us. We do not collect every category from every person.
We may collect other personal information where necessary for a specific lawful purpose connected with our services or business activities, subject to the Privacy Act and any required notices.
We seek sensitive information, such as health information relevant to an incident or fitness for a particular task, only where necessary and lawful. We limit access according to its sensitivity and purpose.
2. How we collect personal information
We normally collect information directly from you, including when you:
use our website or submit an enquiry;
contact us by telephone, email or in person;
request a quote, book a service, purchase goods or open an account;
engage us for a project or visit a workshop or worksite;
apply for work or participate in a recruitment or labour-hire process; or
provide information needed for a service, inspection or safety process.
Where permitted by the Privacy Act, we may also collect information from other sources, including an employer or authorised representative, a client or main contractor, a vehicle owner or fleet manager, a referee, a supplier or a public register.
Where we collect personal information indirectly, we will take reasonable steps to make the individual aware of the collection, its purpose, intended recipients, the name and address of the organisation collecting and holding it, and their access and correction rights, as soon as reasonably practicable. This applies unless the individual has already been appropriately informed or a lawful exception applies. Where collection is authorised or required by law, the notice will identify that law.
If you provide someone else’s personal information, please ensure you are authorised to do so and draw their attention to this policy where appropriate. This does not remove our own legal obligations.
Workshop CCTV
We operate CCTV in our workshops for staff health and safety during operational hours and for security outside operational hours. Notices are displayed in the workshops. Footage may contain personal information about staff, customers, contractors or visitors.
Vehicle monitoring
Most of our vehicles are fitted with EROAD devices using GPS. We collect vehicle location and speed information for speed monitoring and health-and-safety purposes, including responding to or investigating an incident. This information may identify a driver when linked to vehicle-use records.
Employees are informed about this monitoring through our vehicle policy. Where information about other individuals is collected, we will provide any notices required by law.
CCTV footage and vehicle-monitoring information are used and shared only for their stated purposes or another purpose permitted by law. Access is restricted to authorised people who need it for those purposes. Retention and disposal are governed by section 10, including where information must be preserved for an incident, investigation or legal obligation. Access and correction rights apply as described in section 11.
Project photographs and video
We publish photographs of work carried out for clients. We seek to avoid identifying customers without permission and obtain permission before publishing images of client sites, taking account of applicable client social-media policies.
Where staff, customers or others are identifiable, we will obtain appropriate permission or establish another lawful basis for publication and provide any required notice. Permission to capture an image for safety or documenting work does not automatically permit promotional use.
New recording or monitoring measures
Before introducing new recording or monitoring measures, we will assess their lawful purpose, necessity and privacy impact, provide required notices and obtain consent where required. If calls or meetings are recorded, we will notify participants before recording begins unless a lawful exception applies.
Any automated biometric processing would require a separate assessment and compliance with applicable law, including the Biometric Processing Privacy Code 2025 where it applies. This policy does not itself authorise covert surveillance or unrestricted monitoring.
3. Whether you need to provide information
Providing personal information is generally voluntary. However, if you do not provide information necessary for a particular enquiry, booking, job, inspection or application, we may be unable to respond, provide the requested service, allow site access or assess your application.
When requesting personal information, we will take reasonable steps to make you aware of the relevant collection purposes, intended recipients, the name and address of the organisation collecting and holding it, and your access and correction rights, unless a lawful exception applies. We may do this by drawing your attention to this policy and, where needed, providing a specific notice.
Where collection is authorised or required by law, we will identify the relevant law and explain whether providing the information is voluntary or mandatory. We will explain the consequences of not providing requested information and identify required and optional fields where appropriate.
You do not need to agree to receive marketing communications to obtain our services.
4. Why we use personal information
We use personal information for the purpose for which it was collected or another purpose permitted by the Privacy Act. These purposes may include:
responding to enquiries and preparing quotes, estimates and agreements;
booking, planning, carrying out and documenting our work;
managing project contacts, site access, deliveries and coordination with contractors;
carrying out vehicle servicing, repairs and inspections, maintaining related records and issuing relevant communications;
managing purchases, customer accounts, invoicing, payments and account enquiries;
supporting workshop health and safety and after-hours security through CCTV;
monitoring vehicle speed and supporting incident-related health and safety through EROAD devices;
meeting health-and-safety, inspection, employment, accounting, taxation and other legal responsibilities;
assessing applicants and arranging suitable contractor or labour-hire placements;
managing suppliers and other business relationships;
dealing with warranties, complaints, insurance matters and disputes;
securing our systems, preventing fraud and improving our services and website; and
sending relevant marketing communications where we have the consent required by law.
We will not use personal information for an unrelated purpose unless you authorise it or the law permits it. We take reasonable steps to check information is accurate, up to date, complete, relevant and not misleading before using or sharing it.
5. Who we share personal information with
We share personal information only where permitted by the Privacy Act and to the extent appropriate for the purpose. Depending on the service and circumstances, recipients may include:
authorised WAE personnel;
subcontractors, specialist trades, suppliers and delivery providers involved in your work or order;
clients, main contractors, site operators, employers or fleet managers where necessary to coordinate work or a labour-hire placement;
inspection or certification bodies and relevant authorities, including NZ Transport Agency Waka Kotahi where applicable to vehicle inspections or related statutory processes;
providers supporting our website, communications, vehicle monitoring, business systems, IT, storage, accounting or payments;
professional advisers, insurers and debt-recovery providers where disclosure is lawful and appropriate; and
courts, regulators, government agencies or other parties where disclosure is legally required or otherwise permitted.
A business relationship alone does not give permission to share all information. Information about an applicant, worker or incident is shared only to the extent necessary and lawful, with particular care for sensitive information.
Where a service provider handles information on our behalf, we take reasonable steps to require appropriate protection and use only for the agreed purposes.
6. Website information and cookies
Our website is provided through Squarespace. Information submitted through the Contact Us form is received and handled by our General Manager, Health and Safety Advisor or HR/Finance Manager to respond to your enquiry and for the relevant purposes described in this policy. Squarespace may process website and form information as part of providing its services.
Depending on the website features and tools in use, we and providers supporting our website may collect technical information such as your IP address, browser and device type, pages viewed, referring website, dates and times of visits, and interactions with forms or other website features. This information may be personal information where it identifies or can be linked to an individual.
Where used, cookies and similar technologies may support website functionality and security, remember preferences, help us understand website use and improve performance, and measure enquiries or advertising effectiveness. Where advertising or remarketing tools are used, they may also support relevant advertising on other platforms, subject to applicable privacy requirements and any necessary notices or consent.
Providers of hosting, form processing, analytics, embedded content or advertising tools may receive information needed to provide those functions. Where a provider uses information for its own purposes, its privacy terms may also apply. This does not remove our obligations in relation to information we collect or disclose. Overseas handling is addressed in section 8.
Not all of these technologies are necessarily in use at any given time. Where additional collection, sharing or choices need to be explained, we will provide appropriate information through this policy, a specific notice or website controls.
You can manage cookies through your browser settings and any preference controls available on our website. Restricting certain cookies may affect website functionality. Browser cookie settings do not necessarily prevent all forms of technical-data collection.
Our website may link to independent third-party websites. Those websites have their own privacy practices, which you should review before providing information to them.
7. Marketing and service communications
We may send newsletters, business updates, offers or promotional reminders about our services where we have the consent required by law.
Where we send commercial electronic messages, we will comply with the Unsolicited Electronic Messages Act 2007. This includes obtaining the consent required by law, clearly identifying the sender and providing a functioning unsubscribe facility where required. An enquiry or purchase does not automatically amount to consent to unrelated marketing.
You can unsubscribe using the mechanism in a message or by contacting us. We will honour unsubscribe requests within five working days.
Opting out of marketing does not stop communications necessary for your enquiry, booking, job, account, transaction or our legal obligations.
8. Business systems, service providers and overseas handling
We use Squarespace for our website and EROAD for vehicle-monitoring services. We may also use third-party providers and business systems for email and communications, job and customer administration, accounting and payments, document storage, backups and IT security. The providers and systems used may change over time.
Personal information may be handled through these systems only for the purposes described in this policy or as otherwise permitted by law. We take reasonable steps when selecting and using providers to ensure appropriate security, confidentiality, access restrictions and limits on use, having regard to the nature and sensitivity of the information.
Where applicable, providers may store or process personal information outside New Zealand. We do not represent that every system or provider operates exclusively within New Zealand.
Where a provider acts solely on our behalf to store or process information, we remain responsible for the information under the Privacy Act and take reasonable steps to protect it.
Where we disclose personal information to an overseas recipient for its own purposes and information privacy principle 12 applies, we will meet its requirements. This may involve establishing reasonable grounds that comparable privacy safeguards apply, including through an appropriate contractual agreement. If relying instead on your authorisation where comparable safeguards may not apply, we will expressly explain that before seeking your authorisation.
Using our services or website does not, by itself, authorise an overseas disclosure that requires specific informed authorisation.
9. Security and privacy breaches
We take reasonable technical, physical and organisational safeguards to protect personal information against loss, unauthorised access, use, modification or disclosure, and other misuse. Measures are selected according to the nature and sensitivity of the information, how it is held and the risks involved. They may include access restrictions, authentication, secure storage and transfer, staff guidance and appropriate arrangements with service providers.
Our safeguards include restricted access to the support@wae.co.nz email account and permission-based access to server folders containing confidential information. Access to personal information is limited to people who need it for an authorised purpose.
Privacy incidents are handled confidentially by our General Manager, Health and Safety Advisor or HR/Finance Manager. Information about an incident may nevertheless need to be shared for investigation, professional advice or legally required notifications.
No electronic transmission or storage system is completely secure. This does not limit our obligations to protect the information we hold.
If a privacy breach occurs, we will take steps to contain it, assess the risks and address its cause. Where a breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, subject to any lawful exceptions or permitted delays.
10. How long we keep personal information
We retain personal information only for as long as required for a lawful purpose for which it may be used. Retention periods vary according to the record and may reflect service and inspection requirements, warranties, health-and-safety responsibilities, employment obligations, accounting and tax rules, or legitimate dispute-related needs.
This approach also applies to CCTV footage and vehicle-monitoring information. Relevant records may need to be preserved in connection with an incident, investigation, dispute or legal obligation.
When information is no longer required, we will take reasonable steps to securely delete or dispose of it, or anonymise it so it no longer identifies an individual. Backup records are managed under appropriate security and retention arrangements.
11. Accessing and correcting your personal information
You have the right to request access to personal information we hold about you and to ask us to correct it, subject to the Privacy Act.
Please send your request to the privacy contact in section 13. We may need to verify your identity or your authority to act for someone else before releasing information.
We will respond to an access or correction request as soon as reasonably practicable and no later than 20 working days after receiving it, unless a lawful extension applies. If we extend the time limit, we will tell you why, the extension period and your right to complain to the Privacy Commissioner.
If we refuse access or decline a correction, we will explain our decision and your complaint rights as required by law. If we do not make a correction you request, you can ask us to attach a statement of the correction sought to the information.
Please let us know if your contact details or other information change.
12. Complaints and changes to this policy
If you are concerned about how we have handled personal information, please contact us using the details in section 13 so we can investigate and respond.
You can also make a complaint to the Office of the Privacy Commissioner. Information about your rights and the complaint process is available at privacy.org.nz.
We may update this policy to reflect changes in our practices or legal requirements. The current version will be published on our website with its effective date. A policy update does not itself authorise a new use or disclosure of information that would otherwise require your authorisation.
13. Contact us
Privacy enquiries
WAE Engineering Ltd
Email: support@wae.co.nz
Privacy enquiries are received and handled by our General Manager, Health and Safety Advisor or HR/Finance Manager.
Telephone: 03 465 7797
Post: Privacy enquiries, WAE Engineering Ltd, 128 Main Road, Waikouaiti 9510, New Zealand