Privacy and Cookies Policy
Last updated: 18 June 2026
1. Introduction and Scope
This Privacy and Cookies Policy explains how OnPoint Talent Limited (trading as OnPoint and OnPoint Talent) (NZBN: 9429053727787) of Suite 15211 / 17 B Farnham Street, Parnell, Auckland 1052 ("we", "us", or "our") collects, uses, stores, discloses, and protects your personal information when you access or use our website at www.onpointtalent.co.nz and the OnPoint Talent recruitment platform (together, the "Platform").
This Privacy and Cookies Policy applies to all users of the Platform, including:
- "Job Seekers": individuals who register for a free or premium account to search for and apply for employment opportunities;
- "Contractors": individuals who are employed by OnPoint Talent and placed on assignments with host organisations through the Platform;
- "Employers": organisations and their authorised representatives who use the Platform to advertise job vacancies, browse candidates, and manage recruitment activities; and
- "Visitors": individuals who browse or otherwise access the Platform without registering for an account.
We are committed to protecting your personal information in accordance with the Privacy Act 2020 (NZ) and the thirteen Information Privacy Principles ("IPPs") set out in that Act.
This Privacy and Cookies Policy should be read together with our Terms and Conditions, which govern your use of the Platform. Where this Privacy and Cookies Policy and the Terms and Conditions are inconsistent, the Terms and Conditions prevail to the extent of the inconsistency.
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy and Cookies Policy. Your continued use of the Platform following any changes to this Privacy and Cookies Policy constitutes your acceptance of those changes.
2. Privacy Officer
Our Privacy Officer is responsible for ensuring our compliance with the Privacy Act 2020 and for handling all privacy-related enquiries and complaints.
Our Privacy Officer is:
- Priya Dwivedi
- Email: askus@onpointtalent.co.nz
- Address: Suite 15211 / 17 B Farnham Street, Parnell, Auckland 1052
You may contact the Privacy Officer at any time if you have questions about this Privacy and Cookies Policy, wish to exercise any of your privacy rights, or have a concern about how we handle your personal information.
3. Information We Collect
We collect personal information in accordance with Information Privacy Principle 1 (IPP 1), which requires us to collect personal information only for a lawful purpose connected with our functions and activities, and only where the collection is necessary for that purpose.
3.1 Information You Provide Directly
The types of information you provide to us depend on how you use the Platform and which user category you fall into.
Job Seekers (Free and Premium Accounts):
- account registration details, including your full name, email address, phone number, and location;
- your CV or resume, professional profile information, and any supporting documents you upload;
- job application details and application history;
- job alert preferences and search criteria;
- information you provide when using AI-powered features, including AI Interview Prep responses and AI Resume Feedback submissions (see clause 5 for further details);
- payment information if you subscribe to a Premium Account (processed securely through our third-party payment provider); and
- any other information you choose to provide through the Platform, including messages and correspondence.
Contractors:
In addition to the information described in clause 3.1 above, if you are a Contractor employed by OnPoint Talent and placed with a host organisation, we also collect:
- employment records, including your employment agreement, work arrangement details (remote, office-based, hybrid, casual, fixed-term, or ongoing), and assignment history;
- host organisation assignment records, including the identity of the host organisation, your role, start and end dates, and work location;
- tax information, including your IRD number, tax code, and KiwiSaver details;
- payroll information, including your bank account details and pay records;
- participation details for our contractor perks and discounts programme; and
- any other information required for us to fulfil our obligations as your employer under New Zealand employment law.
Employers:
- company or organisation registration details, including legal name, trading name, business registration number, and industry;
- authorised user account details, including the full name, email address, phone number, and job title of each person authorised to use the Platform on behalf of the organisation;
- job advertisement content, including job descriptions, requirements, salary ranges, and work arrangements;
- candidate browsing, shortlisting, and selection activity on the Platform;
- verification check credit purchases and usage records; and
- payment and billing information (processed securely through our third-party payment provider).
3.2 Information Collected Automatically
When you access or use the Platform, we automatically collect certain technical and usage information. This applies to all users, including unauthenticated Visitors who browse the Platform without an account. The information we collect includes:
- your device type, operating system, and browser type and version;
- your Internet Protocol (IP) address and approximate geographic location;
- pages visited, features used, and actions taken on the Platform;
- the date, time, and duration of your visits;
- referring and exit URLs;
- information collected through cookies and similar tracking technologies (see clause 8 for further details); and
- error logs and performance data relating to your use of the Platform.
3.3 Information from Third Parties
We may receive personal information about you from third-party sources, including:
- verification check results from our third-party verification providers (see clause 6 for further details);
- outputs generated by third-party AI service providers used to deliver AI-powered features on the Platform;
- information from referees nominated by you as part of a reference check; and
- publicly available information relevant to your profile or application.
Google Sign-In (Google OAuth). Where you choose to sign in using your Google account (Google OAuth), we receive basic account details from Google, such as your name and email address, in order to create or access your account on the Platform.
3.4 Sensitive Information
In certain circumstances, we may collect information that is considered sensitive, including:
- criminal history information obtained through NZ Criminal / Police Checks;
- copies of identity documents (such as driving licences or passports) provided for verification purposes; and
- health or disability information, but only where you choose to disclose such information or where it is required in connection with your employment as a Contractor.
We only collect sensitive information where we have your consent, where collection is authorised or required by law, or where collection is necessary for the purposes of our functions and activities in accordance with the Privacy Act 2020.
4. How We Use Your Information
We use your personal information only for the purposes for which it was collected, or for directly related purposes, in accordance with Information Privacy Principle 10 (IPP 10). The purposes for which we collect and use personal information include:
4.1 Providing and Improving Platform Services
We use your information to:
- create and manage your account on the Platform;
- provide the services you have requested, including job matching, application processing, and profile hosting;
- personalise your experience on the Platform, including tailoring job recommendations and search results;
- operate and improve the Platform, including troubleshooting, data analysis, testing, and research; and
- communicate with you about your account, applications, and use of the Platform.
4.2 Processing Job Applications and Matches
If you are a Job Seeker or Contractor, we use your profile, CV, and application information to:
- submit your applications to Employers;
- enable Employers to search for and view your profile (in accordance with your privacy settings);
- match you with relevant job opportunities based on your profile, preferences, and application history; and
- provide you with job alert notifications.
4.3 Conducting Verification Checks
Where you or an Employer requests a verification check, we use your personal information to facilitate that check through our third-party verification providers (see clause 6).
4.4 Operating AI-Powered Features
We use the information you provide when using our AI-powered features (AI Interview Prep and AI Resume Feedback) to generate personalised feedback and recommendations (see clause 5 for further details).
4.5 Managing Contractor Employment Relationships
If you are a Contractor, we use your personal information to:
- manage your employment relationship with OnPoint Talent, including payroll, tax, and KiwiSaver administration;
- facilitate your placement with and assignment to host organisations;
- comply with our obligations under the Employment Relations Act 2000, the Holidays Act 2003, and other applicable employment legislation; and
- administer contractor perks and discounts.
4.6 Processing Payments and Invoicing
We use your payment information to process transactions for paid services, including Premium Account subscriptions, verification check fees, and job advertising packages.
4.7 Service Communications
We use your contact information to send you important service-related communications, including:
- account notifications and security alerts;
- application status updates;
- changes to our services, Terms and Conditions, or this Privacy and Cookies Policy; and
- responses to your enquiries or support requests.
Service communications are not marketing communications and you cannot opt out of receiving them while your account remains active.
4.8 Marketing Communications
With your prior consent, we may use your contact information to send you marketing communications about our services, features, promotions, and events (see clause 13).
4.9 Analytics and Platform Improvement
We use aggregated and anonymised usage data to analyse trends, monitor Platform performance, and improve our services. We use Google Analytics and similar tools for this purpose (see clause 8).
4.10 Compliance with Legal Obligations
We may use your personal information where necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests, including our obligations under employment, tax, and privacy legislation.
5. AI-Powered Features
The Platform offers AI-powered features designed to assist Job Seekers with their career preparation:
- AI Interview Prep: a tool that simulates interview scenarios and provides personalised feedback on your responses. Free Account holders may access up to one (1) session only; Premium Account holders may have access to one (1) session per calendar month.
- AI Resume Feedback: a tool that analyses your CV or resume and provides a score and recommendations for improvement. This feature is available to Premium Account holders only.
What Data AI Features Process. When you use an AI-powered feature, the following information may be processed:
- your CV or resume content (for AI Resume Feedback);
- your interview responses and inputs (for AI Interview Prep);
- your job preferences and target roles; and
- relevant profile information to provide contextualised feedback.
How AI Generates Outputs. Our AI features are powered by Anthropic PBC (the "Claude" AI model), an AI service provider located in the United States. When you use an AI-powered feature, the content you submit is sent to Anthropic's systems in the United States over an encrypted connection, where it is processed to generate personalised feedback, scores, and recommendations. The AI applies algorithms to the information you provide to produce its outputs. The AI does not make decisions about your employment or applications: it provides suggestions only. AI features are optional and are clearly identified on the Platform.
AI Outputs Are Not Professional Advice. The outputs generated by AI features are general guidance tools only and do not constitute professional career advice, employment advice, or any other form of professional advice. You should exercise your own judgement and, where appropriate, seek independent professional guidance before making decisions based on AI outputs.
Data Retention and Training by AI Providers. We require Anthropic to process your data in accordance with our contractual requirements and applicable privacy law. We take reasonable steps to ensure that our AI provider does not retain your personal information beyond what is necessary to deliver the service. We do not permit your content to be used to train AI models without your consent.
Right to Opt Out. You may opt out of AI feature processing at any time by:
- choosing not to use the AI-powered features;
- contacting our Privacy Officer to request that your data not be processed by AI features; or
- adjusting your preferences within your account settings (where available).
If you opt out of AI processing, you will no longer be able to access AI Interview Prep or AI Resume Feedback, but this will not affect your access to other Platform features.
6. Verification Services
The Platform facilitates access to a range of verification checks performed by independent third-party verification providers, not by OnPoint Talent directly.
Types of Checks Available. The following verification checks may be requested through the Platform, subject to availability:
- NZ Criminal / Police Check;
- NZ Driving Licence Check;
- NZ Employment Verification Check;
- NZ Reference Check;
- International Qualification Check; and
- International Professional Membership Check.
Third-Party Providers. Verification checks are conducted by independent third-party providers. When you or an Employer requests a verification check, your relevant personal information is shared with the applicable provider to facilitate the check. These providers are bound by their own privacy policies and by any contractual obligations we have agreed with them.
How Verification Data and Results Are Stored and Shared. Verification check results are stored securely on the Platform and are accessible to:
- the individual who is the subject of the check;
- the Employer who requested the check (or to whom the results are shared by the individual); and
- OnPoint Talent, for the purposes of administering the verification service and complying with our legal obligations.
Verification results are not shared with any other party unless you provide your consent, or unless disclosure is required or authorised by law.
Retention of Verification Data. Verification check results and any supporting documents are retained for a period of three (3) years from the date of the check, after which they are securely deleted unless a longer retention period is required by law or for the purposes of an ongoing employment or contractual relationship.
7. Sharing Your Information
We share your personal information only in accordance with Information Privacy Principle 11 (IPP 11) and only to the extent necessary for the purposes described in this Privacy and Cookies Policy. We may share your information with the following categories of recipients:
- Employers. If you are a Job Seeker, your profile information, CV, and application materials are shared with Employers when you apply for a role or when your profile is visible to Employers in accordance with your privacy settings.
- Host Organisations. If you are a Contractor, relevant details about your assignment (including your name, role, contact details, and work arrangement) are shared with the host organisation to which you are assigned.
- Verification Check Providers. Your personal information is shared with third-party verification providers to facilitate verification checks you or an Employer have requested (see clause 6).
- AI Service Providers. Information you provide when using AI-powered features is processed by our third-party AI service providers to generate outputs (see clause 5).
- Payment Processors. Payment information is processed by our third-party payment processors to complete transactions. We do not store your full credit card or bank card details on our systems.
- Analytics Providers. We use Google Analytics and similar analytics tools to collect and analyse usage data. Analytics providers receive anonymised or pseudonymised data (see clause 8).
- Professional Advisers. We may share your information with our legal, accounting, and other professional advisers where necessary for the management of our business and the provision of our services.
- Law Enforcement and Regulatory Bodies. We may disclose your personal information to law enforcement agencies, courts, regulatory authorities, or other government bodies where required or authorised by law, or where we reasonably believe disclosure is necessary to:
- comply with a legal obligation or legal process;
- protect the rights, property, or safety of OnPoint Talent, our users, or the public; or
- detect, prevent, or address fraud, security, or technical issues.
We do not sell your personal information to third parties.
Business Transfers. If our business is sold, merged, or otherwise restructured, your personal information may be transferred to the acquiring or successor entity as part of that transaction. Any such transfer will remain subject to this Privacy and Cookies Policy.
9. International Data Transfers
Some of your personal information is stored or processed outside New Zealand. On 15 June 2026, our primary database (which stores all user accounts, job applications, CVs, and company profiles), operated by Supabase, was migrated from the United States to Sydney, Australia (AWS region ap-southeast-2). Australia is now the primary data residency location for the personal information of our New Zealand users. The Platform and its content are delivered from Sydney through our web hosting provider, Vercel.
Certain supporting service providers we use are located in the United States, and so some of your personal information is processed overseas. The providers we engage, the functions they perform, and the locations in which they process personal information are set out in the table below.
Named overseas sub-processors:
| Provider | Function | Processing location |
|---|---|---|
| Supabase | Database, login, and file storage | Sydney, Australia |
| Vercel | Website hosting and delivery | Served from Sydney (provider based in the United States) |
| Stripe | Payment processing | United States |
| Resend | Transactional email | United States |
| Anthropic | AI features (the Claude AI model) | United States |
| Google Workspace | Team email | United States |
| Cloudflare | DNS management only | United States |
| GitHub | Source code hosting (no user data) | United States |
Where we transfer personal information outside New Zealand, we take reasonable steps to ensure that the information is protected in a manner consistent with the Privacy Act 2020, including by:
- ensuring, so far as practicable, that the recipient is subject to privacy laws or arrangements that provide comparable protection to the Privacy Act 2020;
- entering into data processing agreements and other contractual arrangements with our overseas providers that require them to protect personal information to a standard consistent with New Zealand privacy law. Such contractual data-processing arrangements are in place with our overseas providers; and
- complying with the requirements of section 193 of the Privacy Act 2020 and Information Privacy Principle 12 (IPP 12), which govern the disclosure of personal information to recipients outside New Zealand.
By using the Platform, you consent to your personal information being transferred to and processed in Australia and the United States as described in this section.
You have the right to ask us which countries your personal information may be transferred to. To make such an enquiry, please contact our Privacy Officer using the details in clause 2.
10. Data Retention
We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law, in accordance with Information Privacy Principle 9 (IPP 9).
Our general retention periods are as follows:
- Active Account Data. Your account information and profile data are retained for as long as your account remains active on the Platform. If you deactivate or close your account, we will delete or anonymise your personal information within six (6) months of account closure, subject to any legal obligations to retain certain data.
- Job Applications. Records of your job applications (including application history and status) are retained for two (2) years from the date of your last activity on the Platform, after which they are securely deleted or anonymised.
- Contractor Employment Records. Employment records for Contractors (including employment agreements, payroll records, tax records, and assignment details) are retained for seven (7) years following the end of the employment relationship, in accordance with New Zealand employment and tax legislation.
- Verification Check Results. Verification check results and supporting documents are retained for three (3) years from the date of the check (see clause 6).
- Payment Records. Payment and transaction records are retained for seven (7) years in accordance with New Zealand tax requirements under the Tax Administration Act 1994.
- Analytics Data. Data collected through Google Analytics is retained in accordance with Google Analytics default retention settings. We periodically review and adjust these settings as appropriate.
- Marketing Consent Records. Records of your marketing consent (including when consent was given or withdrawn) are retained for the duration of your consent and for a period of two (2) years following withdrawal, to demonstrate compliance with our obligations.
When personal information is no longer required, we take reasonable steps to securely delete or de-identify it, in accordance with IPP 9.
11. Your Rights Under the Privacy Act 2020
Under the Privacy Act 2020, you have the following rights in relation to your personal information:
- Right to Access (IPP 6). You have the right to request access to the personal information we hold about you. Subject to certain exceptions set out in the Privacy Act 2020, we will provide you with a copy of your personal information in a reasonable format.
- Right to Request Correction (IPP 7). If you believe that any personal information we hold about you is inaccurate, incomplete, or misleading, you have the right to request that we correct it. If we do not agree to make the requested correction, you have the right to request that we attach a statement of the correction sought but not made.
- Right to Request Deletion. You may request that we delete your personal information where there is no lawful reason for us to continue to hold it. Please note that we may be required to retain certain information to comply with legal obligations (for example, employment and tax records as described in clause 10).
- Right to Withdraw Consent for Marketing. If you have consented to receive marketing communications, you may withdraw your consent at any time (see clause 13).
- Right to Opt Out of AI Feature Processing. You may opt out of having your data processed by our AI-powered features at any time (see clause 5).
How to Exercise Your Rights. To exercise any of the rights described above, please contact our Privacy Officer using the details in clause 2.
Response Timeframe. We will respond to your access or correction request as soon as reasonably practicable and in any event within twenty (20) working days of receiving your request, as required by the Privacy Act 2020.
Verification of Identity. Before processing your request, we may ask you to verify your identity to protect your personal information from unauthorised access.
No Charge. We will not charge you a fee for making a request or for providing access to your personal information, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline the request.
12. Complaints
If you have a concern or complaint about how we have handled your personal information, we encourage you to raise it with us first so that we have the opportunity to resolve it.
Internal Complaint Process. To make a complaint, please contact our Privacy Officer using the details in clause 2. We will:
- acknowledge your complaint within five (5) working days;
- investigate the matter and keep you informed of the progress of the investigation; and
- provide you with a written response setting out the outcome of our investigation and any steps we propose to take, within twenty (20) working days of receiving your complaint (or such longer period as is reasonable in the circumstances).
Office of the Privacy Commissioner. If you are not satisfied with our response, or if you wish to make a complaint directly, you have the right to lodge a complaint with the Office of the Privacy Commissioner:
- Office of the Privacy Commissioner
- PO Box 10094, The Terrace, Wellington 6143
- Phone: 0800 803 909
- Email: enquiries@privacy.org.nz
- Website: www.privacy.org.nz
13. Marketing Communications
We will only send you marketing communications where you have provided your prior consent to receive them, in accordance with the Unsolicited Electronic Messages Act 2007.
How to Opt In. You may consent to receive marketing communications by:
- selecting the marketing consent checkbox when registering for an account or updating your profile;
- updating your communication preferences in the preference centre within your account settings; or
- expressly requesting to receive marketing communications by contacting us.
How to Unsubscribe. You may withdraw your consent and unsubscribe from marketing communications at any time by:
- clicking the unsubscribe link included in every marketing email we send;
- updating your communication preferences in the preference centre within your account settings; or
- contacting our Privacy Officer using the details in clause 2.
We will process your unsubscribe request promptly, and in any event within five (5) working days of receiving it.
Unsubscribing from marketing communications does not affect service communications, which we may continue to send as described in clause 4.7.
14. Security
We are committed to protecting your personal information from unauthorised access, use, disclosure, alteration, and destruction, in accordance with Information Privacy Principle 5 (IPP 5).
Technical Measures. We implement appropriate technical security measures, including:
- HTTPS enforced site-wide, with HTTP Strict Transport Security (HSTS);
- Transport Layer Security (TLS) encryption of personal information in transit across all connections;
- encryption of data at rest within our database and storage infrastructure (Supabase / AWS);
- isolation of payment card data through our payment processor, Stripe (PCI-DSS Level 1), so that full card numbers never reach OnPoint Talent's systems;
- JWT-based session authentication;
- role-based access controls; and
- rate limiting on sensitive endpoints.
Organisational Measures. We also implement organisational security measures, including:
- staff training on privacy and data protection obligations;
- access restrictions based on role and need-to-know principles;
- confidentiality obligations for all staff and contractors who handle personal information; and
- regular review and updating of our privacy and security policies and procedures.
Breach Notification. In the event of a privacy breach that is notifiable under section 114 of the Privacy Act 2020 (that is, a breach that it is reasonable to believe has caused, or is likely to cause, serious harm to an affected individual), we will:
- notify the Office of the Privacy Commissioner as soon as practicable after becoming aware of the breach;
- notify the affected individuals as soon as practicable, providing information about the breach, the likely consequences, and the steps we are taking in response; and
- take all reasonable steps to contain the breach and mitigate any harm.
While we take all reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your personal information.
15. Children's Privacy
The Platform is not intended for use by children under the age of eighteen (18) years. This is consistent with the eligibility requirements set out in our Terms and Conditions.
We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without appropriate consent, we will take reasonable steps to delete that information as soon as practicable.
If you are a parent or guardian and believe that your child has provided personal information to us, please contact our Privacy Officer using the details in clause 2 so that we can take appropriate action.
16. Changes to This Privacy and Cookies Policy
We may update this Privacy and Cookies Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make changes to this Privacy and Cookies Policy, we will:
- update the "Last updated" date at the top of this Privacy and Cookies Policy;
- post the revised Privacy and Cookies Policy on the Platform; and
- for material changes, notify you by email to the address associated with your account, or by a prominent notice on the Platform.
We encourage you to review this Privacy and Cookies Policy periodically to stay informed about how we protect your personal information.
Your continued use of the Platform after any changes to this Privacy and Cookies Policy constitutes your acceptance of those changes.
17. Contact Us
If you have any questions, concerns, or requests relating to this Privacy and Cookies Policy or the way we handle your personal information, please contact us:
- Privacy Officer: Priya Dwivedi
- Email: askus@onpointtalent.co.nz
- Address: 15211 / 17 B Farnham Street, Parnell, Auckland 1052
- Website: www.onpointtalent.co.nz
For sales and general enquiries, you may also contact us at info@onpointconsulting.co.nz.