Issuer of Debcards: Windcave New Zealand Limited, 33 Wilkinson Road, Ellerslie, Auckland, 1060, New Zealand
Privacy and security policy
Debcard team is committed to protecting your data from inappropriate access and loss of data.
It is important that you read this notice, together with any other privacy notice that is provided on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
If you require further clarification about anything contained in this privacy notice, please contact debcard Data Protection Officer, at [email protected].
Data Protection Principles
We will comply with data protection laws. This says that the personal information we hold about you must be:
1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.
The kind of information we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We collect, store, and use the following categories of personal information about you where necessary:
• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Information about your use of our information and systems.
• Transactional information relating to your use of debcard.
How is your personal information collected?
We will collect personal information about card holders and purchasers directly through the web application, card registration and sales process.
If you do not provide personal information, we may not be able to provide some or all of our services in relation to debcard.
Who will receive and store the information
The Issuer is part of a global group of companies consisting of Windcave (New Zealand), Windcave Pty Limited (Australia), and other related companies (together referred to as Windcave), which share information pursuant to an intercompany agreement in order to provide efficient payment services to customers globally.
How we will use information about you
We will only use your personal information in the following circumstances:
1. Where it is necessary for performing the services for the debcard we have sent to you.
2. Where we need to comply with a legal obligation.
3. There can be rare occasions where it becomes necessary to use your personal information to protect your interests (or someone else's interests).
4. We may also process your information for our legitimate interests.
Situations in which we will use your personal information
We need all the categories of information in the list above (see: 3. The kind of information we hold about you) to enable us to perform our role as card supplier, to enable us to comply with legal obligations or where it is necessary to do so in Windcave’s interests.
The situations in which we will process your personal information are listed below.
• Performing the services for the debcard we have sent to you
• Contacting you in the event of a card or fraud issue.
• Conducting compliance audits.
• Complying with regulatory obligations.
• To prevent fraud and other criminal activities.
• To the extent permitted by applicable law and regulation, to monitor your business and personal use of our information and systems.
Some of the purposes will overlap and there can be several grounds which justify our use of your personal information.
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated or new purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we will, if necessary, process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Data sharing
We will in some circumstances have to share your data with third parties, including third-party service providers.
We require third parties to respect the security of your data and to treat it in accordance with the law.
If we do, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary administer the working relationship with you, or where it is necessary for the performance of our functions card issuer.
Which third-party service providers process my personal information?
"Third parties" includes third-party service providers (including contractors, hosting providers, and designated agents). The following activities are carried out by third-party service providers: card issuing and dispatch, software support vendors, Card schemes (Visa, Mastercard). The following third-party service providers process personal information about you:
• Card production company – print and dispatch the debcard
• Software support – supply support services for systems that hold your data
• Visa – scheme provider of the transactions
How secure is my information with third-party service providers?
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
All our service providers adhere to industry PCI-DSS standards.
What about other third parties?
If required, we will need to share your personal information with a regulator or to otherwise comply with the law.
Data security
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How long will you use my information for?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
In some circumstances we will anonymise your personal information so that it can no longer be associated with you, in which case we will use such information without further notice to you.
Your rights in connection with personal information
You have the right to:
• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact [email protected] in writing.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances or if there is a good reason to refuse the request under applicable law.
Use of Google Analytics/ Google Ads/ Meta Pixel
We use Google Analytics, a web analytics service provided by Google LLC, to help us understand how users interact with our website and improve the effectiveness of our advertising campaigns across social media platforms and keyword-based search advertising. We use Google Analytics only for statistical and performance measurement purposes and do not use it to identify you personally. You can learn more about Google Analytics here: Privacy Disclosures Policy - Analytics Help.
We use Google Ads conversion tracking to measure the performance of our Google Ads campaigns. We may use the IP address, for example, to identify your general location, to measure the effectiveness of ads, and, depending on your settings, to improve the relevance of the ads you see. You can find out more about how Google uses data when you use our site at www.google.com/policies/privacy/partners/.
We use Meta Pixel, provided by Meta Platforms, Inc., to measure the effectiveness of our advertising on Meta platforms (including Facebook and Instagram). The Meta Pixel allows us to understand actions taken on our website after users interact with our ads on Meta platforms and to deliver more relevant advertisements. Meta Pixel will track URLs visited, domains visited, and the devices you use. When using Meta Pixel, we and Meta act as joint controllers in respect of the initial collection and transmission of personal data to Meta. Personal data collected via the Meta Pixel may be transferred to and processed in the United States. Meta may use this information in accordance with its own privacy policies which you can learn more about here Terms and Policies - Meta Pixel.
We process personal data collected through analytics and advertising cookies on the basis of your consent. You can manage or withdraw your consent at any time through our cookie settings or your browser controls.
Our lawful basis for processing this information is our legitimate interests in measuring and optimising our advertising spend and marketing effectiveness.
Data protection officer
We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact [email protected]. You have the right to make a complaint at any time to the relevant authority.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time by posting a new version on our website www.debcard.com/privacy-notice.
Further Information
If you have any questions about this privacy notice, please contact [email protected]