Legal
Privacy policy
This policy explains what personal information OxygenIT Limited collects, why we collect it, where it is held, who it is shared with and how you can see or correct it. It is written to meet the Privacy Act 2020 and the thirteen information privacy principles in that Act.
Last updated 3 November 2026
1. Who we are
OxygenIT Limited (trading as OxygenIT), NZBN 9429030088610, is a New Zealand company providing managed IT support, cyber security, Microsoft 365 and AI governance services to organisations of 20 to 200 staff. Our business address is 7 Horner Street, Papanui, Christchurch 8053, New Zealand. Our registered office is Level 3, 6 Show Place, Addington, Christchurch, New Zealand, at our accountants.
For the purposes of the Privacy Act 2020, OxygenIT Limited is the agency responsible for the personal information described in this policy. Our privacy officer can be reached at Timothy Clarkson, [email protected], or by calling 0800 242 206 during business hours, 8.00am to 5.00pm Monday to Friday excluding New Zealand public holidays, or by post to the address above.
2. What this policy covers
This policy covers personal information we collect in three settings:
- Visitors to www.oxygenit.co.nz and people who contact us by phone, email, web form or booking link.
- Our clients and the people who work for them, where we collect information to deliver and bill the services we are contracted for.
- Information inside a client’s systems that we see, store or process on the client’s behalf while delivering those services. Section 8 explains how that is treated differently.
It does not cover the websites or services of other organisations we link to. Each of those has its own privacy policy.
3. What we collect
When you contact us or enquire
Your name, organisation, role, email address and phone number, the message or booking details you give us, and notes from any call or meeting we have with you. If you book a call through our website the booking is recorded with the date and time you chose.
When you become a client
The contact details of the people we deal with at your organisation, billing details including the name and address the invoice goes to and the bank account or payment method you pay from, the names, email addresses and job titles of the staff we provide IT support to, and the details of your devices, software licences, network and systems that we need to support them.
When you ask us for support
The details of the request or fault, the device and user it relates to, the steps taken to resolve it, call recordings where our phone system records a call and you have been told so, and remote session records where an engineer connects to a device to fix it.
When you visit our website
Technical information sent by your browser, including your IP address, browser type, device type, pages visited and the site that referred you, collected through cookies and analytics tools. Section 11 lists the tools we use.
What we do not collect
We do not ask for and do not want credit card numbers by email or web form. We do not sell personal information. We do not collect personal information from children knowingly, because our services are for businesses.
4. Why we collect it
We collect personal information only for purposes connected with running an IT services business, which are:
- To answer your enquiry and, if you ask, to book a call with you.
- To scope, quote, deliver, support and invoice the services in our agreement with your organisation.
- To identify a caller on our support line and connect them to the right device, user and ticket.
- To keep the records our ISO/IEC 27001:2022 information security management system and our professional obligations require.
- To send you information about our services, where you have agreed to receive it or where we have an existing business relationship with you. You can opt out at any time, see section 10.
- To meet our legal obligations, including tax, accounting and any lawful request from a regulator or court.
- To improve our website and understand how it is used, in aggregate.
We do not use personal information for any purpose that is not connected to one of these without asking you first.
5. How we collect it and the systems it lives in
We collect personal information directly from you wherever we can: from the forms and booking links on our website, from phone calls and emails, from the onboarding questionnaire a new client completes, and from the support requests your staff send us. Where we collect it from someone else, for example a colleague at your organisation who gives us your details as a new user, we rely on them having the authority to do so.
Personal information we hold is kept in a small number of named systems:
- GoHighLevel, our customer relationship management and marketing platform. Website enquiries, call bookings, contact records, email marketing and opt-out preferences are held here.
- AutoTask, our professional services automation and ticketing platform. Client contacts, support tickets, the devices and systems we support, time records and contract details are held here.
- Microsoft 365, our email, document and collaboration platform. Email correspondence, quotes, agreements, project documents and internal records are held here.
- Xero, our accounting platform. Billing contacts, invoices and payment records are held here.
- Talkify.nz, our phone platform. Calls to and from OxygenIT are recorded for monitoring and training purposes.
Each of these providers is bound by its own contractual and security commitments to us, and none of them is permitted to use the information for its own purposes.
6. Who we share it with
We share personal information only where it is needed to deliver the service, and only with:
- The service providers named in section 5, which hold the information on our behalf.
- Vendors whose products we supply or support on your behalf, for example Microsoft when we create or administer a licence in your name, and hardware suppliers when a device is shipped to a named person.
- Our after-hours support partner in the United Kingdom, for clients who have purchased after-hours cover. That team works inside the same ticketing system and under the same obligations as our New Zealand team.
- Our professional advisers, auditors and certification body, where they need to see records to do their work and are bound by confidentiality.
- A regulator, court or law enforcement agency where the law requires it.
We do not sell, rent or trade personal information, and we do not give it to anyone for their own marketing.
7. Where it is held
Some of the systems in section 5 store information outside New Zealand. Under principle 12 of the Privacy Act 2020 we may only disclose personal information to an overseas organisation where it is subject to comparable privacy safeguards, and we rely on the contractual commitments and certifications of each provider to meet that test. If you want to know where a specific type of information is stored, ask our privacy officer.
8. Information inside a client’s systems
Delivering managed IT means our engineers have administrative access to a client’s Microsoft 365 tenant, devices, servers and backups. In doing that work we may see, move, back up or restore information that belongs to the client, including the personal information of the client’s own staff, customers or patients. In that setting the client is the agency responsible for the information under the Privacy Act 2020, and we act on the client’s instructions as its service provider. We do not use that information for any purpose of our own, we access it only to the extent the work requires, and the way we handle it is governed by our master services agreement with the client and by our ISO/IEC 27001:2022 certified information security management system.
Where a client is a health agency, the Health Information Privacy Code 2020 applies to the health information in its systems. Our role is to build and maintain the security safeguards the Code expects. The client remains responsible for its obligations under the Code.
9. How long we keep it
- Enquiries that do not become a client relationship: until you ask us to delete them.
- Client contact, ticket, configuration and contract records: for the life of the agreement and for up to one year after it ends, so that we can answer questions about work done and meet our audit obligations.
- Invoices and payment records: seven years, as New Zealand tax law requires.
- Website analytics: according to the retention settings of the tools in section 11.
When information is no longer needed for the purpose it was collected for, it is deleted or de-identified.
10. Marketing and opting out
We send commercial electronic messages only in line with the Unsolicited Electronic Messages Act 2007. Every marketing email we send carries an unsubscribe link, and using it stops marketing email within the time the Act allows. You can also opt out by emailing our privacy officer or calling 0800 242 206. Opting out of marketing does not stop service messages that are part of an agreement, such as ticket updates, invoices or notice of a security incident.
11. Cookies and website analytics
Our website uses cookies and similar technologies for two purposes: to make the site work, and to measure how it is used so we can improve it. The measurement tools we use are Google Analytics 4, Google Tag Manager, Microsoft Clarity and advertising pixels used for remarketing. Each of those providers sets its own cookies and has its own privacy policy. You can block or delete cookies in your browser settings. The site will still work, although some booking and form features may not.
12. How we protect it
OxygenIT Limited is independently certified to ISO/IEC 27001:2022 for information security management and ISO/IEC 42001:2023 for AI management (as at May 2026), audited annually. The controls that certification requires apply to our own systems as well as our clients’: multi-factor authentication on every account, encrypted devices, least-privilege access, logging, tested backups and a documented incident response process. Our staff are bound by confidentiality obligations in their employment agreements.
No system is perfectly secure. If we become aware of a privacy breach involving personal information we hold, we will assess it under the Privacy Act 2020, and where it has caused or is likely to cause serious harm we will notify the Office of the Privacy Commissioner and the people affected as the Act requires.
13. Your rights: access and correction
Under the Privacy Act 2020 you have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong. To do either, contact our privacy officer using the details in section 1. We will need to confirm your identity before we release anything. We will respond within 20 working days, as the Act requires, and we do not charge for a request unless it is unusually large, in which case we will tell you the charge before we start. If we decline to correct information you may ask us to attach a statement of the correction you sought.
If the information you are asking about sits inside one of our clients’ systems rather than our own, we will refer your request to that client, because the client is the agency responsible for it.
14. Complaints
If you think we have handled your personal information in a way that breaches the Privacy Act 2020, tell our privacy officer first and we will investigate and respond in writing. If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz or on 0800 803 909.
15. Changes to this policy
We review this policy at least once a year and whenever our systems or the law change. The date at the top is the date of the current version. Changes apply from the date they are published on this page.
