DPA

You are the controller of personal information in the updates. OnRecord Limited processes it for you.

That information may include names and email addresses of people you choose to send the PDF to. We use it only to generate, store, and remind. Subprocessors are those named in the privacy policy. We will email you before we add one that handles update content.

We will tell you without undue delay if we become aware of a breach affecting that information. On closure, we delete the updates within 30 days, except for records New Zealand tax law requires us to keep.

For customers in the UK or EEA, the EU standard contractual clauses and the UK addendum apply as well. They do not replace the Privacy Act 2020.