Privacy Policy

1. Introduction

Growth Arc (operated by NextGen AI Marketing Ltd, NZBN 9429052722073) is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020, the Privacy Amendment Act 2025, and the 13 Information Privacy Principles (IPPs).

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website (growtharc.ai), use our services, or interact with us in any way.

Privacy Officer: Amrit Sandhu, amrit@growtharc.ai

2. Information We Collect

2.1 Information You Provide Directly

When you interact with us through our website contact form, email, or other channels, we may collect your name, email address, company name, phone number, the service you are interested in, and any message or enquiry details you provide.

2.2 Information Collected Automatically

When you visit growtharc.ai, we automatically collect certain technical information including your IP address, browser type and version, device type, operating system, pages visited and time spent on each page, referring website, and approximate geographic location (country/region level only).

2.3 Cookies and Tracking Technologies

We use the following third-party services that may place cookies on your device:

• Google Analytics 4 (GA4): We use GA4 to understand how visitors use our website. GA4 collects anonymised usage data including page views, scroll depth, outbound clicks, and session duration. GA4 data is processed by Google LLC. For more information, see Google's Privacy Policy.
• HubSpot Tracking: We use HubSpot's tracking code to understand visitor behaviour and connect website activity to CRM records when you submit an enquiry. HubSpot is operated by HubSpot, Inc. For more information, see HubSpot's Privacy Policy.

You can manage or disable cookies through your browser settings. Disabling cookies may affect your experience on our website.

3. How We Use Your Information

In accordance with IPP 10 (Limits on Use of Personal Information), we only use your personal information for the purposes for which it was collected, or for directly related purposes. Specifically, we use your information to:

• Respond to your enquiries and provide the services you request
• Communicate with you about our services (including follow-ups and proposals)
• Improve our website and user experience
• Analyse website traffic and usage patterns
• Comply with our legal obligations
• Protect our legitimate business interests

4. Legal Basis for Collection

Under IPP 1 (Purpose of Collection), we only collect personal information for a lawful purpose connected to our business functions and where collection is necessary for that purpose.

Under IPP 3 (Collection of Information from Subject), wherever possible we collect personal information directly from you. Under IPP 3A (Notification of Collection from Third Parties), introduced by the Privacy Amendment Act 2025, if we collect your information from a third party, we will take reasonable steps to notify you.

Under IPP 4 (Manner of Collection), we collect information by lawful means that are fair and do not unreasonably intrude upon your personal affairs.

5. Disclosure of Your Information

In accordance with IPP 11 (Limits on Disclosure), we do not sell, rent, or trade your personal information. We may share your information with trusted third-party service providers who assist us in operating our business, specifically:

• Google LLC (analytics)
• HubSpot Inc (CRM and marketing)
• Vercel Inc (website hosting)

These providers are contractually required to protect your information and may only use it for the purposes we specify.

Under IPP 12 (Disclosure of Personal Information Outside New Zealand), if your information is transferred outside New Zealand, we will ensure the recipient is subject to comparable privacy safeguards as required by Schedule 8 of the Privacy Act 2020.

6. Data Security

In accordance with IPP 5 (Storage and Security), we take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure. Our security measures include:

• HTTPS/TLS encryption on all website communications
• Secure access controls for our CRM and business systems
• Regular review of data handling practices
• Limiting access to personal information to authorised personnel only

7. Data Retention

Under IPP 9 (Retention of Personal Information), we do not keep your personal information for longer than is necessary for the purpose for which it was collected. Contact and CRM records are retained for the duration of any business relationship and for a reasonable period thereafter (typically up to 7 years for financial and tax compliance purposes). Website analytics data is retained in anonymised form.

8. Your Rights

Under the Privacy Act 2020, you have the following rights:

• Right of Access (IPP 6): You have the right to request access to the personal information we hold about you. We will respond within 20 working days.
• Right of Correction (IPP 7): You have the right to request correction of any personal information that is inaccurate, incomplete, or misleading.
• Right to Complain: If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.

To exercise any of these rights, please contact us at amrit@growtharc.ai.

9. Privacy Breaches

In accordance with Part 6 of the Privacy Act 2020, if a privacy breach occurs that is likely to cause serious harm to any affected individual, we will notify both the affected individual(s) and the Office of the Privacy Commissioner as soon as practicable.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any third-party websites you visit.

11. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

• Privacy Officer: Amrit Sandhu
• Email: amrit@growtharc.ai
• Website: growtharc.ai
• Entity: NextGen AI Marketing Ltd (NZBN 9429052722073)
• Location: New Zealand

Office of the Privacy Commissioner: www.privacy.org.nz