Privacy Policy

Smart Business Centre (Nelson) Limited — Version 2026.1

1. About this policy

1.1 This policy explains how Smart Business Centre (Nelson) Limited (“SBC”, “we”, “us”) collects, uses, shares, stores and protects personal information, and how you can see or correct the information we hold about you.

1.2 We are bound by the Privacy Act 2020. Our director is a Chartered Accountant, and we are also bound by the confidentiality requirements of the NZICA Code of Ethics.

1.3 Our offices are at 19 Strawbridge Square, Stoke, Nelson 7011 and 58 Buxton Square, Nelson 7010. Phone 03 547 7995. Email privacy@sbcnelson.co.nz.

2. The information we collect

We only collect personal information that we need to provide our services, meet our legal obligations and run our business. Depending on the services you use, this may include:

  • Identity and contact details: name, date of birth, address, phone, email, and copies of identity documents (such as a passport or driver licence) and proof of address. Most clients bring their documents to our office. If you choose electronic identity verification through 2 Shakes instead, a photo or short video of you is taken and compared with your identity document.

  • Tax and government identifiers: IRD numbers, GST numbers, NZBN and similar.

  • Financial information: income, expenses, bank statements and transactions, assets, liabilities, loans, investments, KiwiSaver, and accounting records.

  • Anti-money-laundering information: who owns or controls an entity, the source of your funds or wealth, and the purpose of the business relationship.

  • Entity information: company, trust, partnership and society records, including about directors, shareholders, trustees and beneficiaries.

  • Payroll information about your employees: names, contact details, IRD numbers, tax codes, bank accounts, pay rates, hours, leave, KiwiSaver, student loan and child support deductions. Leave records may include limited health information, such as sick leave.

  • Payment information: your bank account for GoCardless direct debits (we see only a masked account number). We do not hold card details: card payments are made by you through Stripe or at our EFTPOS terminals.

  • Communications: emails, letters, phone notes and meeting notes.

  • Website information: details you enter in our website contact form. Our website also uses cookies and analytics tools that collect information about how visitors use the site, such as pages viewed, browser type and approximate location. This is reported to us as overall statistics.

  • Mailing list: for our newsletter, we hold the contact name and email address of people who subscribe through our website.

3. How we collect it

3.1 From you directly: most information comes from you, through our onboarding forms, 2 Shakes, email, meetings, and the documents and records you give us.

3.2 From other people and organisations (indirect collection): with your authority, or where the law allows, we also collect information from: Inland Revenue (through our tax agent access), the Companies Office and other public registers, your bank (for example through Xero bank feeds), your previous accountant, your lawyer, lender or other advisers, Tax Traders, Accountancy Insurance (Audit Shield) and payroll providers. Our identity verification provider (2 Shakes) checks your details against government and other databases.

3.3 About people connected to you: when you give us information about other people, such as your employees, fellow directors, trustees, beneficiaries, partners or family members, you must make sure they know you are giving it to us and that they can read this policy. This allows us to meet our obligations under the Privacy Act when we collect their information through you.

3.4 If you do not provide information: we may be unable to provide some services. If we cannot complete the identity checks required by anti-money-laundering law, we cannot act for you.

4. Why we use it

We use personal information to:

  • provide the services you engage us for, including accounting, tax, payroll, company secretarial and advisory work;

  • deal with Inland Revenue, the Companies Office, ACC and other agencies on your behalf;

  • verify identity and carry out customer due diligence and ongoing monitoring, as required by the Anti-Money Laundering and Countering Financing of Terrorism Act 2009;

  • meet our record-keeping and professional obligations, including under the Tax Administration Act 1994 and the NZICA Rules (including practice review);

  • invoice you and collect payment, including by direct debit;

  • manage our relationship with you, including telling you about changes that affect you, our services and tax deadlines;

  • send our newsletter. You can unsubscribe at any time using the link in each newsletter or by contacting us;

  • protect our systems, prevent fraud and deal with complaints or legal claims.

We will not use your information for an unrelated purpose without your consent, unless the law allows it.

5. Who we share it with

We share personal information only as needed for the purposes above, with:

  • Government agencies: Inland Revenue, the Companies Office, ACC, the Department of Internal Affairs (our anti-money-laundering supervisor) and other agencies as needed for your work or as the law requires.

  • Our service providers: Xero (accounting, practice management and working papers), 2 Shakes (onboarding, identity verification and electronic signing), Wolters Kluwer CCH Entities (company records), Smartly and Thankyou Payroll (payroll), GoCardless (direct debit), Stripe (card payments), Tax Traders (tax pooling), Accountancy Insurance (Audit Shield), Knowledge Shop (tax research), Integrity IT (IT support and backup), Microsoft 365 (email and documents) and Perplexity (AI-assisted research and drafting, see section 8). For electronic identity checks, 2 Shakes uses identity verification services such as Centrix and OCR Labs. They may use the information only to provide their services to us.

  • Our marketing agency: Downing (Nelson) manages our website and newsletter, and has access to our mailing list (contact name and email address only) for that purpose. Newsletters are sent using Squarespace.

  • Specialists you agree to: for example Findex for specialist tax advice.

  • Our professional bodies and reviewers: Chartered Accountants Australia and New Zealand and NZICA reviewers, our independent anti-money-laundering auditor and our professional indemnity insurer, all of whom must keep it confidential.

  • People you authorise: such as your bank, lender, lawyer, financial adviser or a new accountant.

  • Where the law requires: for example, we must report suspicious activity to the New Zealand Police Financial Intelligence Unit, and the law may prevent us from telling you we have done so.

We do not sell personal information.

6. Storage outside New Zealand

Some of our providers store information in cloud systems outside New Zealand. Based on their published information, the main locations are:

  • Xero (accounting, practice management, working papers): United States (Amazon Web Services)

  • 2 Shakes (onboarding, identity verification): Australia (Microsoft Azure). Electronic identity checks are processed by OCR Labs and Centrix, mainly in New Zealand and Australia

  • Microsoft 365 (email and documents): Australia

  • GoCardless (direct debit): United Kingdom, with service providers in other countries including the United States

  • Stripe (card payments) and Squarespace (newsletter): United States

  • Perplexity (AI-assisted research and drafting): United States

  • Smartly, Thankyou Payroll, Wolters Kluwer CCH, Tax Traders, Knowledge Shop: New Zealand or overseas. Wherever their systems are located, we remain responsible for your information under the Privacy Act.

When we use overseas providers, we take reasonable steps to make sure your information is protected in a way that is comparable to the Privacy Act. We use established providers with recognised security standards and confidentiality obligations. Our shared drive and its backup are held in New Zealand.

7. How we protect it

  • Client information is held in secure cloud systems and on our shared drive, which is backed up within our Stoke office. Multi-factor authentication is used for our cloud systems, and access is limited to staff who need it.

  • All staff and contractors are bound by confidentiality obligations.

  • Our IT provider manages security, updates and backups.

  • Paper originals are scanned, then either collected by you or securely shredded by SBS Security.

  • Staff only use client information in artificial intelligence tools that we have approved for that purpose (see section 8).

8. Use of artificial intelligence tools

8.1 We use artificial intelligence (AI) tools to help with research, drafting, and reviewing and analysing documents. They help us work efficiently. They do not replace our professional judgement.

8.2 We only enter client information into AI tools that we have approved for that purpose. These are business services provided under agreements that prevent your information being used to train AI models. They currently are Perplexity Enterprise, used by a small number of authorised staff, and the AI features built into Xero, which work within Xero’s normal access permissions.

8.3 Our staff do not enter client information into free or personal AI tools.

8.4 We only enter the information needed for the task, and we delete client-specific AI conversations once the task is finished.

8.5 A member of our team reviews all AI output before we use or rely on it. We do not use AI to make decisions about you without human review.

9. How long we keep it

We keep records for at least 7 years after the end of the relevant income year, as required by tax law, and anti-money-laundering records for at least 5 years after our relationship with you ends, or longer where the law requires. After that, records are securely deleted or destroyed.

10. Seeing and correcting your information

10.1 You can ask to see the personal information we hold about you, and ask us to correct it. Contact our Privacy Officer (section 12).

10.2 We will respond within 20 working days. We may need to verify your identity first. We do not normally charge for this.

10.3 In some cases the law allows or requires us to withhold information, for example where releasing it would disclose another person’s information or breach our anti-money-laundering obligations. If so, we will tell you, unless the law prevents us.

10.4 If we do not agree to correct information, you can ask us to attach a statement of the correction you asked for.

11. Privacy breaches

If a privacy breach occurs, we act quickly to contain it and assess the risk. If it is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as required by the Privacy Act 2020.

12. Contact and complaints

12.1 Our Privacy Officer is David Sax, Business Manager. Contact privacy@sbcnelson.co.nz or 03 547 7995.

12.2 If you have a concern about how we have handled your information, please contact our Privacy Officer first. We will acknowledge your complaint within 5 working days and respond in writing.

12.3 If you are not satisfied, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

13. Changes to this policy

We may update this policy from time to time. The current version is on our website (www.sbcnelson.co.nz) and is available on request. This version took effect on 16 October 2026.