Privacy Policy

1. Introduction

KIWAMI is a business and construction operations platform operated by Japan Development Support ("Japan Development Support", "KIWAMI", "we", "us" or "our"). We are based in New Zealand and provide KIWAMI to construction and building businesses and their staff, clients, subcontractors and contacts.

This Privacy Policy applies to https://kiwami-jds.com (our website) and https://app.kiwami-jds.com (the KIWAMI application), together with any related services we provide (collectively, the "Service"). It explains what personal information we collect, how we use and share it, and the choices available to you.

This Policy is intended to align with the New Zealand Privacy Act 2020 and its Information Privacy Principles ("IPPs"). If you access the Service from outside New Zealand, other privacy laws may also apply to you, as explained further below.

If you have questions about this Policy or about how we handle personal information, contact us at info@kiwami-jds.com.

2. Information we may collect

Depending on how you use the Service, we may collect the following categories of information:

• Identity and contact information — name, email address, company name and role.
• Authentication and account information — login credentials, account settings and permission levels (passwords are never stored in plain text).
• Contact and lead information entered by users, such as details of prospects, clients and business contacts managed within KIWAMI.
• Project, construction and site information, including project names, addresses, schedules, tasks, site reports, change orders, instructions and payment-related records entered into the Service.
• Documents, photographs and uploaded files associated with projects, sites, health and safety records or client communications.
• Task, schedule and activity information, including records of actions taken within the Service.
• Communications and support requests, including messages sent to us or through the Service.
• Device, browser, IP address and technical logs, collected automatically when you use the website or application.
• Analytics and usage information describing how the Service is used, for performance and improvement purposes.
• Connected social media account identifiers and authorisation information, where a user chooses to connect a third-party service such as Meta/Facebook, Instagram, Threads, X or LinkedIn.
• Billing information, if and when billing functionality is introduced or used.
• Information supplied by an organisation about its staff, clients, subcontractors or contacts, where an organisation using KIWAMI enters that information into the Service.

3. How information is collected

We collect information:

• directly from you, for example when you create an account, fill in a form or contact us;
• from your employer or organisation, where your organisation has added you as a user, staff member, client or contact within KIWAMI;
• through your use of the website and application, including pages visited and features used;
• through connected third-party services, where you have authorised KIWAMI to access them; and
• through cookies, analytics tools and technical server logs, as described in the Cookies and analytics section below.

4. Purposes of use

We use personal information to:

• provide, operate and maintain KIWAMI;
• authenticate users and secure accounts;
• manage organisations, teams and permission levels within KIWAMI;
• provide project, construction and business management features, including scheduling, site reporting, document storage and lead management;
• process publishing or account-management actions that a user has specifically authorised through a connected social platform;
• provide customer support and respond to communications;
• monitor, maintain and improve the performance, reliability and security of the Service;
• detect, investigate and prevent misuse, fraud or security incidents; and
• comply with applicable legal obligations.

5. Legal and authorised basis

Under the New Zealand Privacy Act 2020, we collect and use personal information where it is necessary for a lawful purpose connected with our functions or activities, such as providing the Service under a contract with the organisation you belong to, operating our business, or complying with legal obligations.

KIWAMI is not exclusively governed by the EU General Data Protection Regulation (GDPR). However, if GDPR or another data protection law applies to you because of your location or circumstances, additional rights recognised under that law — such as rights to access, rectification, erasure, restriction, portability or objection — may also apply to your personal information, to the extent that law applies. We do not represent that all KIWAMI processing activities are, or need to be, governed by the GDPR.

6. Social media integrations

KIWAMI may allow a user to connect third-party accounts such as Meta/Facebook, Instagram, Threads, X or LinkedIn, where the user chooses to do so, for example to enable social publishing or account-management features. When a user connects an account:

• KIWAMI receives only the information and permissions authorised by the user and made available by the relevant provider;
• access tokens and refresh tokens are stored server-side and are not intentionally exposed in the browser or to other users;
• tokens are used only to perform the actions the user has authorised, such as publishing content or managing a connected Page or professional account;
• a user may disconnect a connected account within KIWAMI at any time;
• the relevant provider's own terms of service and privacy policy also apply to your use of that platform;
• KIWAMI does not sell social media credentials, access tokens or connected-account data;
• the specific information and permissions available will vary by platform and by what each provider makes available through its interfaces; and
• disconnecting a social account from KIWAMI does not automatically delete content that has already been published to that external platform.

7. Facebook and Meta data

Where a user connects a Facebook or Meta account to KIWAMI, we receive the information and permissions that the user and Meta authorise through Meta's login and permissions flow. This information is used to connect authorised Facebook Pages or professional accounts to KIWAMI and to enable the specific publishing or account-management features the user has requested, such as scheduling or posting content on their behalf.

We do not access private messages through Facebook or Meta integrations unless a specific feature that requests and uses that permission is actually built into KIWAMI. We do not access friends lists or other personal information unrelated to the Pages, accounts or permissions a user has explicitly authorised.

If you wish to remove KIWAMI's access to your Facebook or Meta account, or to request deletion of information KIWAMI holds as a result of that connection, see our User Data Deletion Instructions.

8. Sharing and disclosure

We do not sell personal information. We may share personal information with:

• hosting, database, authentication and other infrastructure providers that help us operate the Service;
• connected third-party platforms that a user has chosen to authorise, such as Meta/Facebook, Instagram, Threads, X or LinkedIn, to the extent needed to perform the actions the user has requested;
• our professional advisers, including lawyers, accountants and auditors, where reasonably necessary;
• regulators, courts or other authorities, where we are legally required to do so; and
• a prospective or actual acquirer or successor, in the event of a merger, acquisition, financing or sale of some or all of our business or assets.

We do not publish a definitive, named list of every technology provider used to operate KIWAMI. Where a specific technology is confirmed as part of our infrastructure, we describe it here where appropriate; for example, KIWAMI may use providers such as Supabase for backend and authentication services and Vercel for hosting and deployment.

9. Overseas storage and disclosure

KIWAMI is based in New Zealand, but the hosting, database, authentication, analytics and third-party integration providers we use may store or process information on servers located outside New Zealand. Where this occurs, we take reasonable steps consistent with the cross-border disclosure requirements of the New Zealand Privacy Act 2020, including seeking to use providers that are themselves subject to privacy laws providing comparable safeguards, or that are otherwise required to protect personal information to a comparable standard. We do not guarantee that all personal information will remain within New Zealand at all times.

10. Security

We use reasonable administrative, technical and organisational safeguards designed to protect personal information, including access controls, authentication requirements, restricting sensitive credentials such as access tokens to server-side storage, and monitoring for suspicious activity. No method of transmission or storage is completely secure, and we cannot guarantee absolute security of information transmitted to or stored within the Service.

11. Data retention

We retain personal information only for as long as reasonably necessary to provide the Service, to meet contractual, security and legal obligations, or to resolve disputes. Retention periods can vary depending on the type of data, the settings and instructions of the organisation that submitted it, and applicable legal requirements. We do not apply a single fixed retention period across all data types.

12. Access and correction

You may request access to, or correction of, personal information we hold about you by contacting us at info@kiwami-jds.com. We may need to verify your identity, and the identity of the organisation associated with your account, before actioning a request. If information was submitted about you by your employer or organisation, we may direct certain requests to that organisation where appropriate.

13. Deletion

To request deletion of personal information, including data associated with a connected social media account, please see our User Data Deletion Instructions at https://kiwami-jds.com/data-deletion. Some information may need to be retained even after a deletion request, for example where retention is required for legal compliance, fraud and security prevention, resolving disputes, maintaining backups, or other legitimate business record-keeping purposes.

14. Privacy breaches

We handle privacy breaches that meet the threshold for notification in accordance with the requirements of the New Zealand Privacy Act 2020, including assessing whether a breach is likely to cause serious harm and notifying the Office of the Privacy Commissioner and affected individuals where required.

15. Cookies and analytics

We use essential cookies and similar technologies required for authentication, session management and core functionality of the website and application. We may also use analytics tools to understand how the Service is used and to improve performance. We do not currently operate a dedicated cookie-consent management platform; if that changes, or if additional non-essential tracking technologies are introduced, this Policy will be updated to describe them accurately.

16. Children

KIWAMI is a business service intended for use by companies and their authorised staff, clients, subcontractors and business contacts. It is not directed to, and is not intended for use by, children.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to KIWAMI, our practices, or legal requirements. Material changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this Policy periodically.

18. Complaints

If you have a concern about how we have handled your personal information, please contact us first at info@kiwami-jds.com so that we can try to resolve the matter directly. If you are not satisfied with our response, you may also contact the Office of the Privacy Commissioner in New Zealand.