Privacy Policy

In this policy, unless the context requires otherwise:

1. (a)“Client” means a business or organisation that engages Taylor Consulting to provide services.
2. (b)“Client Data” means any material a Client provides to us, or to a system we build or maintain, including documents, correspondence, records and files, and any personal information contained in them.
3. (c)“Personal information” has the meaning given in the Privacy Act 2020.
4. (d)“the System” means any software, model or machine supplied, configured or maintained by Taylor Consulting for a Client.

This policy distinguishes throughout between personal information we collect about you directly (as a website visitor or an enquirer) and Client Data we handle on a Client's behalf. Different obligations attach to each, and sections 6 to 8 deal with Client Data specifically.

From website visitors and enquirers, we may collect: your name; your email address; your telephone number; the name of your organisation; and the content of any message or booking request you send us.

We do not operate advertising, tracking or behavioural analytics on this website, and we do not use third-party analytics services. No cookie is set for the purpose of tracking you.

Where you book a call through a third-party scheduling service, that service collects the information you enter into it, under its own privacy terms. We receive only the resulting booking details.

In the course of an engagement, we may collect Client Data and the contact details of a Client's staff for the purpose of operating and supporting the System.

We collect information directly from you, from a Client, or from a Client's staff, in each case where it is provided to us for a purpose connected with our services.

We do not purchase personal information, and we do not collect it from data brokers or by scraping.

We use personal information only for purposes connected with providing our services, namely: responding to enquiries; preparing proposals; delivering, configuring, supporting and maintaining the System; invoicing; and meeting our legal obligations.

We do not use personal information for marketing to you unless you have asked to receive it, and any such communication will carry a means of unsubscribing.

We do not sell personal information or Client Data to anyone, in any circumstances.

Client Data belongs to the Client. We claim no ownership of it and acquire no right to use it for any purpose other than performing the engagement.

We treat Client Data as confidential. We do not disclose it to any third party except as required by law, or with the Client's prior written instruction.

Where an engagement involves documents subject to legal professional privilege or an equivalent professional obligation, we will say so in writing in the proposal and handle those documents on the terms recorded there.

We access Client Data only to the extent necessary to deliver, support or repair the System, and each such access is logged.

This section exists because training a model on a Client's documents is a different act from processing them, and is treated separately.

We will not use Client Data to train, fine-tune or otherwise adapt any model without the Client's specific, informed and written consent.

Consent is sought for an identified purpose and an identified set of documents. It is not general, it is not implied by the engagement, and it is not obtained by a clause in a services agreement.

Where consent is given, we will record in writing: the documents used; the purpose; where training took place; and what becomes of the training dataset afterwards.

An adapter trained on a Client's documents is used only for that Client. It is never applied to another Client's System, offered to anyone else, or incorporated into a general-purpose product.

Any adapter trained on a Client's Client Data is the Client's property. See clause 9 of our Terms of Service.

A Client may withdraw consent for future training at any time. Withdrawal does not reverse training already completed, because a trained adapter cannot be selectively unlearned, but the adapter will be deleted on request, and we will say so plainly rather than implying otherwise.

Where we supply an on-premise System, Client Data is processed on the Client's own machine, on the Client's own premises. It is not transmitted to us and it is not transmitted to any artificial intelligence provider.

A System configured in this way has no outbound network path to any artificial intelligence provider. This is a configuration of the System, not merely a policy commitment, and the System provides a facility by which the Client can verify it.

Software updates are retrieved from a container registry over the internet. This is outbound traffic, and it is disclosed here so that the statement in clause 7.2 is not misunderstood as meaning the machine has no internet connection at all. A container registry is not an artificial intelligence provider and no Client Data is sent to it.

Where a Client elects a configuration in which some requests are referred to an external model provider, that is a material change to clause 7.1 and 7.2. It will be documented in the proposal, the Client's consent recorded in writing, and the categories of data that leave the premises identified before the configuration is enabled.

Personal information we hold about enquirers and Clients' staff (names, email addresses, correspondence) is held by us in New Zealand and, where a service provider is used, as set out in clause 10.

Some engagements involve configuring an artificial intelligence tool the Client already subscribes to in its own name, rather than supplying a System. The whole of clause 7 concerns on-premise Systems and does not apply to such a tool.

To build a configuration we may be given templates, standards, worked examples and sample documents. That material is Client Data and every protection in this policy applies to it.

Once the configuration is in place, what the Client's staff enter in the ordinary use of the tool is transmitted to its operator under the Client's own agreement with that operator. It does not pass through us and we do not receive, hold or retain it.

What that operator does with such material, including whether it retains it or uses it to train its models, is governed by its terms and not by this policy. We will identify the operator and point the Client to its current terms before configuration begins, and we will say plainly where in our assessment those terms are unsuitable for a category of the Client's work.

We will advise in writing on the categories of information that in our assessment should not be entered into such a tool. That advice is a recommendation, and responsibility for what is entered remains with the Client.

We use a small number of service providers in operating our own business: an email provider; a website host; a scheduling provider; and an invoicing and tax provider. Each has access only to the information necessary for its function.

We will provide a current list of these providers to any Client on request.

We do not engage sub-contractors on a Client engagement without the Client's prior written agreement.

We may disclose information where required by law, by a court, or by a regulator with jurisdiction. Where we are permitted to tell the affected party that we have done so, we will.

Some of the service providers in clause 9.1 store information outside New Zealand. Before disclosing personal information to such a provider we take reasonable steps to satisfy ourselves that it is subject to comparable safeguards to those in the Privacy Act 2020, as Information Privacy Principle 12 requires.

Client Data held on an on-premise System does not leave New Zealand, because it does not leave the Client's premises.

We take reasonable technical and organisational measures to protect information against loss, misuse and unauthorised access, having regard to its sensitivity.

We do not claim certification against any information security standard, and nothing in this policy should be read as such a claim.

Where we hold credentials for a Client's System, they are held in a password manager and are not shared by email or message.

We keep personal information only as long as it is needed for the purpose it was collected for, or as long as we are required by law to keep it.

Enquiries that do not proceed to an engagement are deleted within twelve months.

Copies of Client Data taken for the purpose of building or repairing a System are deleted when that work is complete, and in any event within thirty days of the engagement ending, unless the Client asks in writing that we retain them.

Records we are required to keep for tax purposes are retained for seven years, as the Inland Revenue Department requires.

Where remote access to a Client's System is available, it is disabled by default.

It is enabled by the Client, for a period the Client determines, and it may be disabled by the Client at any time without reference to us.

Every remote session is logged, and the log is visible to the Client.

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, as Part 6 of the Privacy Act 2020 requires.

Where the breach concerns Client Data, we will notify the Client immediately on becoming aware of it, before and independently of any other notification, and we will not delay that notification in order to complete our own investigation.

You have the right to ask what personal information we hold about you, to be given access to it, and to ask us to correct it. These rights are given by Information Privacy Principles 6 and 7.

Requests should be made to the address in clause 18. We will respond within twenty working days.

We do not charge for access or correction requests.

If you believe we have not met our obligations under the Privacy Act 2020, please raise it with us first, using the contact details in clause 18.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

We may amend this policy. The version number and date at the head of this document identify the current version.

Where an amendment materially reduces the protections given to a Client, we will notify that Client in writing rather than relying on publication of the amended policy.

Privacy enquiries, access requests and complaints may be sent to zavier@thelongwhitecloud.com, or by post to Taylor Consulting, Christchurch, New Zealand.