This Privacy Policy explains how Creditor Bureau of New Zealand Limited, trading as CBNZ (“CBNZ”, “we”, “us”, or “our”), collects, uses, stores, discloses, and protects personal information. CBNZ is a private debt collection, credit management, and debt recovery business. We are not a government agency, regulator, court, or credit reporting agency. This policy applies to personal information we collect about debtors, alleged debtors, guarantors, directors, shareholders, sole traders, business contacts, clients, prospective clients, authorised representatives, referrers, website users, and other people who interact with us.
1. Personal information we collect
We may collect personal information where it is reasonably necessary for our business, legal, compliance, debt collection, credit management, account administration, dispute handling, payment processing, client service, and communication purposes.
The types of personal information we may collect include:
name, date of birth, address, email address, phone number, and other contact details;
current and previous addresses;
identity information and verification information;
information about debts, invoices, accounts, contracts, loans, credit arrangements, payment obligations, guarantees, or disputed amounts;
creditor, client, account, reference, invoice, and case information;
payment history, repayment arrangements, settlement discussions, payment promises, missed payment information, and settlement information;
bank account, payment, transaction, and payment processing information;
credit-related information, including credit checks, credit reports, default information, repayment history, court judgment information, insolvency information, and other credit reporting information where lawful and relevant;
employment, income, business, company, director, shareholder, trading, or guarantor information where relevant;
hardship, vulnerability, affordability, health, family, bereavement, employment, income, insolvency, or personal circumstance information where you provide it or where it is relevant to managing a matter appropriately;
disputes, complaints, evidence, supporting documents, proof of payment, correspondence, and file notes;
call recordings, voicemail recordings, call transcripts, AI-generated summaries, chat logs, SMS messages, WhatsApp messages, emails, letters, and other communications;
information collected through automated systems, AI-assisted tools, CRM systems, phone systems, email systems, workflow systems, payment systems, and communication platforms;
website and device information, including IP address, browser type, device type, pages visited, cookies, analytics information, advertising identifiers, and similar technical data;
information from public registers, publicly available sources, tracing sources, credit reporting agencies, verification providers, courts, tribunals, regulators, government agencies, and other lawful sources.
We may also collect documents or files that you, our clients, or third parties provide to us. These may include contracts, invoices, statements, screenshots, emails, identification documents, proof of address, proof of payment, bank information, hardship evidence, dispute evidence, and other documents relevant to a matter.
2. How we collect personal information
We may collect personal information directly from you when you:
contact us;
visit our website;
complete a form;
make a payment;
provide documents;
dispute a debt;
ask for information;
enter into a payment arrangement;
communicate with us by phone, email, SMS, WhatsApp, post, web form, chat, AI-assisted system, or another channel.
We may also collect personal information indirectly from other sources, including:
creditors and clients who refer debts, accounts, invoices, or matters to us;
accountants, lawyers, insolvency practitioners, advisers, referrers, and authorised representatives;
credit reporting agencies;
payment providers and banking providers;
tracing, verification, fraud prevention, identity, and data service providers;
public registers and publicly available sources;
courts, tribunals, regulators, government agencies, and law enforcement agencies where lawful;
technology, communications, CRM, automation, cloud, and AI service providers;
other people or organisations where it is lawful and relevant to collect the information.
Where we collect personal information about you from someone else, we will take reasonable steps to make sure you are aware of the collection and how we may use and disclose the information, unless an exception applies.
3. Why we collect and use personal information
We may collect, use, and process personal information for the following purposes:
verifying your identity and contact details;
verifying debt, account, invoice, payment, contract, guarantor, or credit information;
assessing, managing, administering, collecting, recovering, settling, or enforcing debts;
contacting you about a debt, account, invoice, payment, dispute, complaint, or arrangement;
arranging, processing, confirming, allocating, reconciling, or reporting payments;
managing payment plans, settlement offers, hardship requests, and affordability discussions;
investigating disputes, complaints, corrections, fraud concerns, or claims that information is incorrect;
obtaining, using, assessing, or reporting credit-related information where lawful and relevant;
assisting clients with lawful credit management and credit reporting activity;
locating or tracing people where lawful and relevant;
recording, transcribing, summarising, analysing, and managing communications;
operating phone, SMS, WhatsApp, email, AI, CRM, workflow, payment, and automation systems;
training staff, monitoring quality, improving services, and maintaining records;
complying with legal, regulatory, contractual, accounting, audit, and compliance obligations;
protecting our rights, our clients’ rights, and the rights of others;
detecting, preventing, investigating, and responding to fraud, misuse, cyber security issues, unlawful conduct, or safety risks;
managing our website, analytics, marketing, business development, and service improvement activity;
any other purpose that is lawful, directly related to the purpose for which the information was collected, or authorised by you.
We will not use personal information for an unrelated purpose unless we are permitted to do so by law or have appropriate authorisation.
4. Debt collection communications
We may contact you by phone, email, SMS, WhatsApp, letter, web form, chat, AI-assisted system, or another reasonable communication method.
We may use the information we hold to confirm we are communicating with the correct person before discussing debt-related information.
We will take reasonable steps to avoid disclosing debt-related information to someone who is not authorised to receive it. For this reason, we may limit the information included in emails, SMS messages, WhatsApp messages, voicemails, letters, or other communications until identity or authority has been reasonably confirmed.
You may ask us to use a preferred contact method. We will consider that request and apply it where reasonable and practical.
5. Call recording and communication records
We may record, monitor, transcribe, summarise, and store inbound and outbound calls, voicemail messages, AI-assisted calls, and other communications.
We may use these records for:
verifying instructions;
managing accounts and debts;
training and quality assurance;
dispute and complaint handling;
compliance and audit purposes;
evidence of communications, agreements, payment arrangements, or disclosures;
improving our systems, scripts, processes, and service quality.
Where practical, we will notify you that a call or communication may be recorded.
We generally retain call recordings, call transcripts, voicemail recordings, and AI-assisted call summaries for up to 2 years, unless we need to keep them for longer for debt recovery, dispute handling, complaint handling, legal, compliance, audit, security, or legitimate business record purposes.
6. AI-assisted systems and automation
We may use automated systems, AI-assisted tools, workflow automation, and machine-assisted processes to help us operate our business.
These systems may help us:
make or receive calls;
send or receive SMS, WhatsApp, email, or other messages;
verify information;
collect account information;
summarise calls, messages, and documents;
route enquiries;
identify next steps;
schedule follow-ups;
assist with payment arrangements;
support dispute, complaint, and hardship handling;
assist our team with account administration and record keeping.
AI-assisted systems may generate transcripts, summaries, suggested responses, classifications, alerts, or workflow actions. These tools are intended to assist our operations and do not replace your right to contact us, dispute a matter, request correction, or ask for a person to review information where appropriate.
We do not authorise third-party AI providers to use CBNZ personal information to train unrelated third-party AI models. Where we use AI providers, we take reasonable steps to select, configure, and contract with providers in a way that limits use of CBNZ information to providing services to us and protecting or operating those services.
7. Credit checks and credit reporting
CBNZ is not a credit reporting agency. However, we may collect, use, and disclose credit-related information where lawful and relevant.
This may include:
obtaining credit reports or credit-related information from credit reporting agencies;
using credit information to verify identity, locate a person, assess a matter, manage collection activity, investigate disputes, or support lawful credit management;
disclosing information to credit reporting agencies, including Centrix, Equifax, Experian, or any other lawful credit reporting provider;
reporting defaults, repayment information, account information, judgment information, insolvency information, payment status, or other credit-related information where lawful, authorised, and relevant;
assisting clients with lawful credit reporting, credit control, debt recovery, and account management activity;
correcting, updating, withdrawing, suppressing, or disputing credit-related information where required or appropriate.
Credit reporting may affect a person’s ability to obtain credit, goods, services, insurance, finance, or other products. If you believe credit information about you is incorrect, you should contact us so we can review it. You may also contact the relevant credit reporting agency directly.
8. Payments and payment providers
We may collect, use, and disclose payment-related information to process, confirm, allocate, reconcile, and report payments.
Payments may be made to us, to our client, or through a third-party payment provider, depending on the matter.
We may share payment information with banks, payment providers, card processors, payment gateways, clients, creditors, accountants, auditors, and other relevant service providers where necessary.
We do not intend to collect or store full card details unless required for a lawful and necessary purpose. Payment providers may collect and process payment details in accordance with their own security and privacy obligations.
9. Hardship, vulnerability, and sensitive personal information
You may choose to provide information about hardship, vulnerability, affordability, health, disability, family circumstances, bereavement, employment, income, insolvency, or other personal circumstances.
We may use this information to:
assess your situation;
consider payment options;
manage communications appropriately;
refer the matter back to our client;
record relevant circumstances on the file;
respond to disputes, complaints, or legal obligations.
We may share relevant hardship or vulnerability information with our client, advisers, service providers, or other parties where lawful and reasonably necessary to manage the matter.
10. Documents and uploads
If you provide documents or upload files to us, we may collect, store, use, and disclose those documents for the purpose for which they were provided and for related purposes.
This may include verifying information, assessing disputes, confirming payment, supporting hardship requests, investigating complaints, managing legal or compliance issues, and updating our records.
Please do not provide information that is not relevant to the matter unless we ask for it or you believe it is necessary.
11. Who we may share personal information with
We may disclose personal information where lawful and reasonably necessary to:
our clients, creditors, and referrers;
authorised representatives;
guarantors, directors, officers, employees, or relevant business contacts where lawful and relevant;
credit reporting agencies;
tracing, verification, fraud prevention, identity, and data service providers;
payment processors, banks, card processors, and payment gateways;
phone, SMS, WhatsApp, email, CRM, automation, AI, cloud, website, analytics, document storage, and IT service providers;
lawyers, accountants, auditors, insolvency practitioners, process servers, collection agents, field agents, and professional advisers;
courts, tribunals, regulators, government agencies, law enforcement agencies, and dispute resolution bodies where required or permitted by law;
insurers, business advisers, financiers, purchasers, or potential purchasers in connection with a business transaction, restructuring, sale, or transfer;
any other person or organisation where you have authorised disclosure or where disclosure is permitted by law.
We will take reasonable steps to ensure that disclosures are limited to what is relevant for the purpose of the disclosure.
12. Overseas storage and overseas service providers
Some of our systems, providers, contractors, and service providers may be located outside New Zealand or may store, access, or process information outside New Zealand.
This may include cloud hosting, CRM systems, communication tools, AI systems, analytics tools, payment tools, automation platforms, email systems, document storage systems, support tools, and other technology providers.
Where we disclose personal information to an overseas recipient, we will take reasonable steps to ensure that the information is protected in a way that is comparable to the safeguards under the New Zealand Privacy Act 2020, unless another lawful basis applies.
13. Website, cookies, analytics, and marketing technology
Our website may use cookies, pixels, analytics tools, tags, advertising technologies, and similar tools.
We may use these tools to:
operate and secure our website;
understand website traffic and performance;
improve pages, forms, and user experience;
measure marketing effectiveness;
support business development and client acquisition;
create advertising audiences based on visits to general website pages;
detect misuse, security issues, or technical problems.
We may use advertising or remarketing tools for general business marketing, creditor acquisition, and trust-building education.
We do not use visits to payment pages, dispute pages, hardship pages, document upload pages, account-specific pages, or other sensitive debtor interactions to create advertising audiences where doing so could reveal or imply a person’s debt, financial status, payment difficulty, dispute, or relationship with CBNZ.
You can disable cookies through your browser settings, but some parts of our website may not work properly if cookies are disabled.
14. Accuracy of information
We will take reasonable steps to ensure that the personal information we use is accurate, up to date, complete, relevant, and not misleading.
If you believe information we hold about you is incorrect, incomplete, outdated, or misleading, you can ask us to correct it.
If the information relates to a debt, account, invoice, payment, dispute, or credit reporting matter, we may need to check the issue with our client, a credit reporting agency, a payment provider, or another relevant source before updating our records.
15. Accessing or correcting your information
You have the right to ask whether we hold personal information about you and to request access to that information.
You may also ask us to correct your personal information.
To make a request, contact us using the details below. We may need to verify your identity before providing information or making changes.
We may refuse or limit a request where permitted by law, including where disclosure would affect another person’s privacy, breach legal privilege, prejudice a legal process, create a safety risk, reveal commercially sensitive information, or otherwise fall within a lawful withholding ground.
16. Retention of information
We keep personal information for as long as reasonably necessary for the purposes for which it was collected or used.
We generally retain closed debt collection files, client files, account records, dispute records, payment records, and related business records for up to 7 years after the relevant matter is closed, unless we need to keep them for longer for debt recovery, dispute handling, complaint handling, credit reporting, legal, compliance, audit, accounting, tax, fraud prevention, evidence, limitation period, security, or legitimate business record purposes.
Different types of information may be kept for different periods. When information is no longer required, we will take reasonable steps to securely delete, destroy, de-identify, or archive it.
17. Security
We take reasonable steps to protect personal information from loss, misuse, interference, unauthorised access, unauthorised disclosure, alteration, or destruction.
Our security measures may include:
access controls;
password protection and authentication;
secure cloud systems;
role-based access;
staff and contractor confidentiality obligations;
system monitoring;
backups;
data minimisation;
secure disposal processes;
vendor due diligence;
internal policies and procedures.
No system is completely secure, and we cannot guarantee absolute security. However, we take privacy and data protection seriously and will respond to security issues when they arise.
18. Privacy breaches
If a privacy breach occurs, we will assess the breach and take reasonable steps to contain it, reduce harm, and prevent recurrence.
Where required by law, we will notify affected individuals and the Office of the Privacy Commissioner.
19. Complaints
If you have concerns about how we have handled your personal information, contact us first so we can review and respond.
Please include enough information for us to understand the issue and identify the relevant matter.
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner.
20. Contact us
For privacy requests, corrections, complaints, or questions, contact:
Privacy Officer
Creditor Bureau of New Zealand Limited
Trading as CBNZ
Email: support@cbnz.co.nz
21. Changes to this policy
We may update this Privacy Policy from time to time.
The latest version will be published on our website and will apply from the date it is posted, unless stated otherwise.
Privacy questions
For privacy requests, corrections, complaints, or questions, contact our Privacy Officer.
support@cbnz.co.nz