Privacy Policy
This policy explains what personal information Suretiform collects, why we collect it, the legal grounds we rely on, who we share it with, how long we keep it, and the rights you hold over it. We wrote it to be read, not skimmed past: it applies to every interaction with the suretiform.org website and the services introduced through it, and it is handled consistently with the applicable New Zealand privacy framework, including the Privacy Act 2020.
Definitions
"Personal information" means any information about an identifiable individual, from a name and phone number to usage records tied to your account. "Processing" covers anything we do with that information: collecting, storing, reading, sharing or deleting it. "We", "us" and "Suretiform" mean the operator of this website, and "you" means the visitor or member the information is about.
Personal information we collect
When you register we collect your first name, last name, email address and phone number, plus the password you choose (stored only as a salted hash). When you communicate with us we keep the content of your requests and our replies. When verification applies, we collect identity documents and address confirmation under our KYC/AML policy. When you use funded account functions, we collect transaction and activity records necessary to operate the service.
Usage data
As you browse the site, standard technical information is recorded: pages visited, approximate region derived from your IP address, browser and device type, referring page and timing. This comes from server logs and similar mechanisms and serves operational purposes such as performance, security and diagnosing faults. Usage data is aggregated for analysis and is not used to build profiles for sale to anyone.
Cookies
The website uses a small set of cookies and equivalent browser storage: strictly necessary cookies that keep your session working and protect forms against abuse, and, with your consent, measurement and, where applicable, marketing cookies that help us understand which pages help visitors. You can refuse or clear non-essential cookies at any time through your browser settings or the cookie notice; the site keeps functioning. We do not use cookies to make automated decisions about you.
Who is responsible for your information
Suretiform is the organisation that decides why and how your personal information is processed and is responsible for it under the applicable framework. Where we engage service providers that process information only on our documented instructions, such as hosting or identity verification, they act under contract that binds them to confidentiality and security requirements at least equivalent to ours. We remain answerable for what they do on our behalf.
How we use information
We use your registration details to create and secure your account, contact you about it, and connect you with a personal manager. We use contact details and query content to answer support requests and complaints. We use verification data to meet identity and anti-money-laundering obligations. We use usage data to operate, protect and improve the platform. And where you opt in, we use your email for marketing about services that relate to your membership.
Legal grounds for processing
We process personal information because it is necessary to perform the service you asked for (registration, support, account operation); because a legal obligation requires it (verification, record keeping, regulatory reporting); because we have a legitimate interest in operating securely and understanding how the site is used; and, for marketing messages and non-essential cookies, because you consented. Where processing rests on consent, you may withdraw it at any time without affecting processing that already lawfully happened.
How long we keep information
Registration and account data are kept while your membership is active and for a reasonable period after closure in case of follow-up questions. Verification records are retained for the period the applicable anti-money-laundering framework requires, which generally means years rather than months. Support and complaint files are kept while a complaint can still be escalated and for a fixed archival period after resolution. Marketing consents are kept until withdrawal plus a short evidential period. Usage logs rotate on short technical cycles. When retention ends, information is deleted or irreversibly anonymised.
Transferring information
Your information may be transmitted to the systems that operate the platform, some of which are located outside New Zealand. Where that happens, transfers are protected by contractual safeguards consistent with the applicable framework, limited to what the service needs, and recorded so we can tell you, on request, where your information is processed and under what protections.
Disclosure to others
We disclose personal information only to: the licensed entity providing the trading services you are connected with, so your account can actually operate; affiliated companies involved in providing those services; IT and payment providers acting on our instructions; identity-verification providers; and regulators, supervisors or other authorities where New Zealand law requires or lawfully permits disclosure. We do not sell personal information, and we do not share it for third-party advertising.
Security of information
Personal information is protected by the measures described on the Security page: encryption in transit and at rest, access limited to staff who need it for their role, logged administrative actions, and verification steps before sensitive changes. No system is perfectly secure, so we also maintain an incident process that informs affected people and the relevant authorities as the applicable framework requires.
Your rights over your information
You may ask to access the personal information we hold about you; to correct it where it is wrong or incomplete; to delete it where no legal obligation requires us to keep it; to restrict processing while a dispute about accuracy is resolved; and to object to processing based on legitimate interests, including marketing. Requests go to [email protected], are answered within a reasonable period, and are free unless manifestly repetitive. We may need to verify your identity before acting, using a lighter version of the standard checks.
Service providers we rely on
Day-to-day operation depends on a deliberately short list of providers: hosting and content delivery, email delivery, identity verification, payment processing and analytics. Each receives only the data its function requires, is bound by contract to process it solely for that function, and is reviewed as part of our security programme. The current list is available on request.
Analytics
We use privacy-respecting, aggregate analytics to understand which pages inform visitors and where the site fails them. Analytics runs without individual cross-site profiling; if a measurement cookie is used, it is consent-based and can be refused without losing site functionality. Analytics data informs design and content decisions, nothing else.
Advertising and retargeting
Where we run advertising, we may use consented retargeting to show our own pages to people who visited before, through advertising platforms acting as processors of the minimum data needed. We do not buy or sell audience profiles from data brokers, and our advertising never uses your account, trading or verification data in any form.
Links to third-party websites
Our pages link to third-party websites such as payment providers and official bodies. Once you follow a link, the destination site's own privacy policy governs what happens there; we cannot control it and our policy does not cover it. We link only to providers actually involved in the services or to official sources, never to unrelated commercial sites.
Children's privacy
The services are intended for people aged 18 and over, and the website is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it promptly once identified, and if you believe a child provided information to us, tell us at the contact address below so it can be handled immediately.
Changes to this policy
We may update this policy as the platform, providers or applicable framework change. The current version is always published on this page with its effective date, material changes are announced in the platform before they take effect, and past versions are available on request. Continuing to use the website after a change takes effect means the updated policy applies to that use.
Contact us about privacy
Privacy questions, requests and concerns go to [email protected], marked "Privacy", or by post to Level 14, 120 Albert Street, Auckland CBD, Auckland 1010. The Client Support & Compliance department handles them during Monday to Friday, 9:00–17:30 NZST, and nothing in this policy limits rights you hold under the applicable New Zealand framework.