Privacy Policy

This Privacy Policy explains how Managed Hosted Applications Limited, trading as Lucidity (“Lucidity”, “we”, “us”, “our”) collects, uses, discloses, and protects personal information.

It applies to personal information we hold about identifiable individuals (“you”), whether collected through our website, our services, our marketing activities, or any other channel.

We comply with the New Zealand Privacy Act 2020. You can read more about the Act at www.privacy.org.nz.

Managed Hosted Applications Limited (trading as Lucidity)
Auckland, New Zealand
09 363 8888
info@lucidity.co.nz

We have offices in Auckland and Gisborne.

Our Privacy Officer is responsible for compliance with this policy. You can contact the Privacy Officer at privacy@lucidity.co.nz.

The personal information we collect about you depends on how you interact with us. It may include:

• Your name, job title, and the company or organisation you work for
• Business email address, phone number, and postal address
• LinkedIn profile or other public business profiles
• Records of your enquiries, support tickets, communications, and correspondence with us
• Activity on our website and engagement with our emails
• Information about devices, accounts, or systems you ask us to support (where this contains personal information)
• Technical information such as IP address, browser type, and device identifiers
• Any other information you choose to provide

We do not knowingly collect sensitive personal information (such as health, financial, biometric, or political information) unless required for a specific purpose and with your consent.

Directly from you

We collect personal information directly from you when you submit a form on our website, email or call us, raise a helpdesk ticket, engage with us at an event, enter into a service agreement with us, or apply for a role with us.

From other sources

We also collect personal information about you from sources other than you. This includes:

• Apollo.io and Clay.com – B2B data and enrichment platforms used for sales prospecting
• Firmable.com – NZ and Australia focused B2B data platform
• LinkedIn and LinkedIn Sales Navigator – public professional profile information
• Public registers – including the New Zealand Companies Office and similar publicly accessible business registers
• Referrals and introductions – from contacts, partners, or clients

Information we collect from these sources is typically limited to professional details such as name, job title, business contact information, and company. Some of this information is collected on our behalf by our marketing partners (see Section 6).

If you would prefer not to be contacted by us, you can opt out at any time by replying to any communication, using the unsubscribe link in our emails, or emailing privacy@lucidity.co.nz.

We use personal information to:

• Provide, manage, and improve our managed IT services and support
• Respond to helpdesk tickets, enquiries, and service requests
• Communicate with you about projects, services, and account matters
• Carry out business development activities, including outreach to prospective customers
• Send you marketing communications you have consented to receive
• Bill and receive payment for services
• Comply with legal, accounting, and regulatory obligations
• Recruit and assess candidates for roles at Lucidity
• Maintain the security and integrity of our systems and the systems we manage
• Analyse the performance and usage of our website and channels

We share personal information only where necessary, and with parties bound by appropriate confidentiality and data protection obligations. This includes:

• Cloud-based business systems we use to operate, including CRM, accounting, email, helpdesk and ticketing, project management, and marketing platforms
• Microsoft (Azure, Microsoft 365) and other technology vendors whose platforms underpin our services
• Marketing and lead generation partners (currently Roger Roger Marketing, our outbound marketing agency)
• Subcontractors and specialist consultants engaged to deliver projects, bound by confidentiality
• Professional advisers (lawyers, accountants, insurers)
• Regulatory and law enforcement agencies, where required by law

We do not sell, rent, or trade personal information.

As a managed service provider, in the course of supporting our clients’ IT environments we may have access to personal information about their employees, contractors, and end users.

Where this happens, we act as a service provider on behalf of our client. The collection, use, and protection of that information is governed by the service agreement between us and the client, including any data processing terms.

If you are an end user of a client’s systems and have a question about how your personal information is handled, please contact your employer or the organisation that provides you with the system. Lucidity will respond to requests through that organisation.

Some of the systems we use to store and process personal information are based outside New Zealand, primarily in Australia, the United States, and the European Union. This includes Microsoft cloud services, which may store data in regional data centres.

Where personal information is stored or processed overseas, we ensure the recipient is either subject to comparable privacy laws (such as Australia or EU jurisdictions) or is contractually bound to handle personal information in line with the New Zealand Privacy Act.

Information security is core to our business. We are ISO 27001:2022 certified, which means our information security management system has been independently audited against an international standard.

Specific measures we take include:

• Access controls and least-privilege permissions across our systems
• Multi-factor authentication on business-critical platforms
• Encryption of personal information in transit and at rest where supported
• Continuous monitoring of our systems and the systems we manage for security threats
• Vendor due diligence on the privacy and security posture of platforms we use
• Regular staff training on privacy, security, and information handling
• Documented incident response and breach notification processes

The internet is not a fully secure environment. While we take all reasonable steps to protect your information, we cannot guarantee the security of any information transmitted to us over the internet.

We do not keep personal information longer than is necessary, unless we are required to retain it by law (for example, financial records under tax legislation).

In practice:

• Active client records: retained while the relationship is active and for up to seven years after the last meaningful interaction
• Helpdesk and support tickets: retained for up to seven years for service quality, audit, and warranty purposes
• Marketing list members who unsubscribe: a suppression record is retained indefinitely (to honour the unsubscribe), with all other personal data deleted on request
• Indirectly collected prospect data that has not been engaged: reviewed annually and removed if there has been no engagement
• Financial and tax records: retained for at least seven years as required by law

Job applications: retained for 12 months after the recruitment process closes

You have the right to:

• Access the personal information we hold about you. We will respond within 20 working days.
• Correct information that is wrong or out of date.
• Opt out of marketing communications at any time using the unsubscribe link in our emails or by emailing privacy@lucidity.co.nz.
• Request deletion of personal information we hold about you, where we are not required to retain it.
• Complain to us, or to the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.

To make a request, email privacy@lucidity.co.nz. We may need to verify your identity before processing the request.

Our website uses cookies and similar technologies to make the site work, understand how it is used, and support our marketing. We use:

• Strictly necessary cookies required for the site to function
• Analytics cookies (Google Analytics) to understand how visitors use the site
• Advertising cookies (Google Ads, Meta Pixel, LinkedIn Insight Tag) to deliver and measure relevant ads

You can control cookies through your browser settings. Disabling cookies may affect how parts of our website work.

If we send you marketing emails, we comply with the Unsolicited Electronic Messages Act 2007. We only send commercial messages where we have consent, we clearly identify ourselves as the sender, and we provide a functional unsubscribe in every commercial message.

We use automated tools, including AI-assisted tools, to support tasks such as drafting communications, summarising research, analysing data, and assisting with helpdesk and support work. Where automated tools handle personal information, we apply the same controls and protections as for any other system.

We do not make significant decisions about you that produce legal or similarly significant effects based solely on automated processing.

If we become aware of a privacy breach that has caused, or is likely to cause, serious harm to you, we will notify you and the Office of the Privacy Commissioner as soon as practicable. Where the breach affects information we hold on behalf of a client, we will also notify that client in line with our service agreement.

Our services are aimed at businesses and adult professionals. We do not knowingly collect personal information from children under 16.

We may update this policy from time to time. The “Last reviewed” date at the top will reflect when changes were made.

For any privacy-related question, request, or complaint, please contact:

Privacy Officer
Managed Hosted Applications Limited (Lucidity)
privacy@lucidity.co.nz
09 363 8888

You can also contact the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.