1. Introduction
StolosIQ ("we", "us", "our") is committed to protecting the privacy of individuals in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the StolosIQ GPS asset tracking platform and related services.
2. Information We Collect
2.1 Personal Information
- Name, email address, and contact details provided during account registration
- Organization name and business contact information
- Login credentials (passwords are securely hashed and never stored in plain text)
- User role and access permissions within your organization
2.2 Device & GPS Data
- GPS coordinates and location data transmitted by tracking devices
- Device identifiers (IMEI, terminal IDs)
- Device status, battery level, and signal strength information
- Historical movement and location data
2.3 Usage Data
- Log data including IP addresses, browser type, and access times
- Feature usage patterns within the platform
- Error logs and performance data for service improvement
3. How We Use Your Information
We use your personal information for the following purposes:
- Providing and maintaining the StolosIQ asset tracking service
- Authenticating users and managing access controls
- Displaying real-time and historical GPS tracking data
- Sending alerts and notifications configured by your organization
- Providing customer support and responding to inquiries
- Improving and developing our platform and services
- Complying with legal obligations under New Zealand law
4. Information Privacy Principles Compliance
In accordance with the New Zealand Privacy Act 2020, we adhere to the following principles:
- Purpose of Collection (IPP 1): We only collect personal information for the lawful purposes described in this policy.
- Source of Information (IPP 2): We collect personal information directly from the individual concerned, or from authorized representatives of their organization.
- Collection of Information (IPP 3): When collecting information, we inform you of our identity, the purpose of collection, and your rights of access and correction.
- Manner of Collection (IPP 4): We collect information by lawful means that are fair and not unreasonably intrusive.
- Storage and Security (IPP 5): We take reasonable steps to protect personal information from unauthorized access, use, modification, or disclosure.
- Access to Information (IPP 6): You have the right to access your personal information held by us.
- Correction of Information (IPP 7): You may request correction of any personal information we hold about you.
- Accuracy (IPP 8): We take reasonable steps to ensure personal information is accurate before use.
- Retention (IPP 9): We do not keep personal information longer than necessary for the purposes for which it was collected.
- Use of Information (IPP 10): We use personal information only for the purpose for which it was collected.
- Disclosure (IPP 11): We do not disclose personal information except as permitted under the Privacy Act 2020.
- Cross-Border Disclosure (IPP 12): If personal information is transferred outside New Zealand, we ensure comparable privacy protections are maintained.
- Unique Identifiers (IPP 13): We do not assign unique identifiers unless necessary for the efficient operation of the service.
5. Data Security
We implement appropriate technical and organizational measures to protect your personal information, including:
- Encryption of data in transit (TLS/SSL) and at rest
- JWT-based authentication with secure token management
- Role-based access controls (RBAC) with tenant isolation
- Regular security assessments and monitoring
- Secure cloud infrastructure hosted on AWS
6. Data Sharing & Third Parties
We do not sell, trade, or rent your personal information. We may share data with:
- Service providers: Trusted third parties who assist in operating our platform (cloud hosting, database services) under strict confidentiality agreements
- Legal requirements: When required by law, subpoena, or government request under New Zealand legislation
- Business transfers: In the event of a merger, acquisition, or sale of assets, with appropriate notice
7. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected:
- Account data: Retained while your account is active, plus a reasonable period after termination
- GPS tracking data: Retained according to your organization's configured retention period
- Audit logs: Retained for a minimum of 12 months for security purposes
8. Your Rights
Under the New Zealand Privacy Act 2020, you have the right to:
- Request access to your personal information
- Request correction of inaccurate or incomplete information
- Request deletion of your personal information (subject to legal obligations)
- Lodge a complaint with the Office of the Privacy Commissioner if you believe your privacy has been breached
9. Cookies & Analytics
Our platform uses essential cookies for authentication and session management. We may use analytics tools to understand usage patterns and improve the service. You can manage cookie preferences through your browser settings.
10. Children's Privacy
StolosIQ is a business-to-business platform and is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our platform and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to make a complaint, please contact us:
You may also contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz if you have concerns about how your personal information has been handled.