Privacy Policy

This Privacy Policy explains how personal information is collected, used, stored, disclosed, and protected when you access or use the website located at https://www.ruconrails.co.nz (the “Site”).

This policy is intended to comply with the Privacy Act 2020 (New Zealand) and applies to all users of the Site.

By using the Site, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

The Site is owned and operated by:

References to “RUC on Rails”, “we”, “us”, or “our” refer to RUC ON RAILS LIMITED.

RUC ON RAILS LIMITED operates multiple brands and digital platforms. This Privacy Policy applies to personal information collected via ruconrails.co.nz. Other brand sites may have their own privacy policies, which should be read alongside this one.

2. Scope of This Policy

This Privacy Policy applies to:

• browsing and interacting with the Site;
• submitting enquiries or contact forms;
• submitting partnership or media enquiries;
• applying for roles or contractor positions;
• subscribing to updates (if enabled);
• interacting with embedded third-party services;
• analytics and tracking technologies.

This Site does not facilitate payments or transactions. Any transaction functionality is governed by the privacy policy of the relevant brand or platform.

This policy does not apply to third-party websites linked from the Site.

3. What Is Personal Information

For the purposes of this policy, personal information means information about an identifiable individual, as defined in the Privacy Act 2020.

This does not include information that has been irreversibly anonymised or aggregated.

4. Personal Information We May Collect

We may collect personal information directly from you or automatically through your use of the Site.

4.1 Information You Provide Voluntarily

This may include:

• name;
• email address;
• phone number;
• company or organisation details;
• CVs, resumes, and cover letters;
• messages, correspondence, or enquiry details;
• information provided in partnership or recruitment discussions.

You are not required to provide personal information unless it is necessary for us to respond to your enquiry or assess your application.

4.2 Recruitment and Contractor Information

If you apply for a role, we may collect:

• employment history;
• education history;
• references;
• portfolio links;
• right-to-work information;
• other information relevant to recruitment assessment.

Submission of this information does not create an employment or contractual relationship.

4.3 Automatically Collected Information

When you use the Site, we may automatically collect:

• IP address;
• device identifiers;
• browser type and version;
• operating system;
• pages viewed;
• referring URLs;
• timestamps;
• approximate geographic location derived from IP;
• interaction and navigation data.

This information is typically collected through server logs, cookies, and analytics tools.

4.4 Information Collected from Other Sources

We may collect personal information about you from someone other than you where you have authorised the collection, it is permitted by law, or an exception under the Privacy Act 2020 applies. Depending on the context, those sources may include referees, recruitment agencies, your employer or organisation, professional advisers, event organisers, business partners, service providers, publicly available professional profiles, public registers, or another RUC on Rails brand.

Where Information Privacy Principle 3A applies, we will take reasonable steps to notify you as soon as reasonably practicable that we have collected the information, why it was collected, its intended recipients, who is collecting and holding it, any law requiring or authorising the collection, and your rights to access and request correction. We may not provide a separate notice where you have already been made aware of those matters or another statutory exception applies.

If you provide us with personal information about another person, such as a referee or business contact, you should ensure you are entitled to do so and, where appropriate, make them aware of this Privacy Policy.

5. Cookies and Tracking Technologies

We may use cookies, pixels, local storage, and similar technologies to:

• operate and secure the Site;
• understand user behaviour and traffic patterns;
• improve performance and usability;
• measure engagement;
• support marketing and brand visibility activities.

Cookies may be first-party or third-party.

You may disable cookies through your browser settings, but doing so may affect functionality.

Some technologies are necessary for security and core Site operation, while others help us understand performance and engagement. Your browser or device may allow you to delete stored cookies, block future cookies, or limit certain tracking. Any controls made available on the Site will apply in addition to those settings.

6. Behavioural Analytics and Interaction Recording

To understand how the Site is used and to improve performance, usability, and reliability, we may use behavioural analytics tools that record interaction events occurring during a visit.

These tools may capture technical interaction data such as page navigation, clicks, scrolling behaviour, cursor movement, interface interactions, and page loading events. This information is used to generate visual reconstructions of user sessions for the purpose of analysing how visitors engage with the Site.

Interaction recordings are used for internal product improvement, diagnostics, fraud prevention, performance monitoring, and user experience optimisation.

Where interaction recording tools are used, reasonable measures are implemented to avoid capturing sensitive information entered into forms or fields where such information would not normally be required for analytics purposes.

Interaction data may be processed by third-party analytics service providers acting on our behalf.

7. How We Use Personal Information

We may use personal information for purposes including:

• operating, maintaining, and improving the Site;
• responding to enquiries and communications;
• assessing recruitment or contractor applications;
• preventing fraud, abuse, or security threats;
• internal analysis and reporting;
• developing products, brands, or services;
• supporting commercial strategy and decision-making;
• complying with legal obligations;
• preparing aggregated business insights.

Personal information may be combined with other data to improve our understanding of engagement and performance.

If you ask to receive updates, or we otherwise have a lawful basis to contact you, we may send communications about RUC on Rails, relevant company news, opportunities, or events. Commercial electronic messages will identify the sender and include a functional unsubscribe facility where required by law. Opting out of marketing will not prevent us from responding to an enquiry or sending a non-marketing communication that is reasonably necessary.

8. Cross-Brand and Ecosystem Use

RUC ON RAILS LIMITED operates multiple brands and digital platforms.

Personal information collected via this Site may, to the extent permitted by law, be:

• shared internally across our brands;
• used to improve ecosystem-level analytics;
• used to coordinate partnership discussions;
• used to understand cross-platform engagement trends.

We do not automatically transfer personal information between brands for unrelated purposes without lawful basis.

When you move from this parent Site to a brand website, app, or service, that brand's privacy policy may provide more specific information about the collection and use of personal information in that context. This policy continues to govern information collected through the parent Site.

9. Commercial Use and Business Operations

To the extent permitted by law, personal information may be used in connection with the commercial activities of RUC ON RAILS LIMITED, including:

• analytics and product development;
• marketing and outreach;
• business intelligence;
• investor reporting;
• strategic planning.

We do not use personal information collected through this Site to make automated decisions that produce legal or regulatory effects on individuals.

10. Disclosure of Personal Information

We may disclose personal information to:

• hosting providers and cloud infrastructure providers;
• analytics and performance monitoring services;
• recruitment platforms or HR service providers;
• email or communication service providers;
• professional advisers such as lawyers, accountants, and auditors;
• potential purchasers or investors in connection with due diligence, subject to confidentiality;
• regulators, courts, or authorities where required by law.

We take reasonable steps to ensure third-party service providers are subject to appropriate contractual safeguards.

Service providers that process information on our behalf are expected to use it only for the services they provide to us and in accordance with our instructions, their contractual obligations, and applicable law. We do not sell personal information collected through this Site.

11. International Storage and Transfers

Personal information may be stored in New Zealand or overseas, including in cloud-based systems.

Where information is transferred overseas, we take reasonable steps to ensure comparable safeguards consistent with the Privacy Act 2020.

Where a disclosure to an overseas person is governed by Information Privacy Principle 12, we will use a permitted basis for that disclosure. This may include having reasonable grounds to believe the recipient is subject to the Privacy Act 2020 or comparable privacy safeguards, requiring the recipient to protect the information through binding contractual safeguards, or obtaining your express authorisation after informing you that comparable safeguards may not apply. An overseas provider acting solely as our agent may process information on our behalf without that processing being treated as a disclosure, and we remain responsible for the information in that situation.

12. Data Security

We implement reasonable technical and organisational safeguards designed to protect personal information against:

• loss;
• misuse;
• unauthorised access;
• unauthorised disclosure;
• alteration.

No system can guarantee absolute security. By using the Site, you acknowledge inherent internet risk.

We maintain processes for assessing and responding to privacy incidents. If a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as we are practically able, except where the Privacy Act 2020 permits a notification to be delayed or withheld.

13. Data Retention

Personal information is retained only as long as reasonably necessary to:

• fulfil the purposes described in this policy;
• comply with legal, regulatory, or accounting requirements;
• resolve disputes;
• protect our legal interests.

Recruitment data may be retained for future opportunities unless you request deletion, subject to legal obligations.

Information may be anonymised or aggregated for long-term analytical use.

When personal information is no longer required, we will take reasonable steps to securely delete it or de-identify it. Residual copies may remain for a limited period in secure backups or records that must be retained by law, but will not be used for a new purpose merely because they remain in those systems.

14. Your Rights

Under the Privacy Act 2020, you have the right to:

• request access to personal information we hold about you;
• request correction of personal information.

Requests may be made using the contact details below. We may ask for information reasonably necessary to verify your identity or authority before releasing personal information.

We will respond as soon as reasonably practicable and will ordinarily make a decision on an access request within 20 working days, subject to any extension permitted by the Privacy Act 2020. We may refuse or limit a request only where permitted by law and will explain the applicable reason. If we do not make a requested correction, you may ask us to attach a statement of correction to the information.

15. Third-Party Websites

The Site may link to third-party websites.

We are not responsible for the privacy practices, security, or content of those websites. You should review their privacy policies independently.

16. Children

The Site is not directed at children. We do not knowingly collect personal information from children.

If you believe a child has provided personal information to us, please contact us and we will take reasonable steps to address the issue.

Where we become aware that information concerns a young person, we will take particular care that the means of collection is fair and does not intrude unreasonably on their personal affairs, having regard to their age and the surrounding circumstances.

17. Business Transfers

In the event of a merger, acquisition, restructuring, capital raise, or asset sale, personal information may be disclosed to relevant parties as part of due diligence or transaction execution, subject to confidentiality obligations and applicable law.

18. Changes to This Policy

We may update this Privacy Policy from time to time.

Changes take effect when published on the Site. The date at the top of this page identifies the latest revision, and we will provide any additional notice or seek any authorisation required by law where a change materially affects how personal information is handled.

19. Contact

If you have questions or requests relating to privacy, contact:

Our Privacy Officer can be contacted using the details above. We will try to resolve any privacy concern directly and within a reasonable time. If you are not satisfied with our response, you may make a complaint to the New Zealand Office of the Privacy Commissioner at privacy.org.nz. Nothing in this policy limits your right to contact the Commissioner at any time.