Privacy Notice
This notice explains who controls your personal information, what we collect and why, who processes it on our behalf, how long we keep it, and how to exercise your rights. We describe what we actually do — not a compliance template.
Version 2026-08-v1 · Last reviewed August 2026 · Owner: privacy@ekot.nz
ēkotrace is a pilot-stage platform. New Zealand holds an EU adequacy decision under GDPR, so the initial transfer of EU/EEA data to ēkot Circular Solutions Ltd (our NZ controller) is covered by that decision. However, we use service providers in Singapore and the United States for onward processing, and we have not yet confirmed standard contractual clauses or other GDPR safeguards for those onward transfers (see Section 5). If you are in the EU, EEA or UK and this is a concern, please email privacy@ekot.nz before submitting your details. We do not claim GDPR compliance — we describe what we do honestly so you can make an informed decision.
Controller and contact
The data controller for all personal information processed through the ēkotrace platform is:
Aotearoa New Zealand
Privacy enquiries: privacy@ekot.nz
General enquiries: connection@ekot.nz
ēkotrace is operated by ēkot Circular Solutions Ltd, a New Zealand-registered company. We are subject to the New Zealand Privacy Act 2020. This notice also describes how we handle data from people in other jurisdictions, including the EU, EEA and UK — we do so by being clear about what we do, not by claiming legal certification.
What we collect and why
We collect the minimum information needed for each purpose. The table below covers the lead, demo and platform data flows described in this notice.
| Purpose | Data collected | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries and access requests | Name, email, organisation, message, country, submission metadata | Legitimate interest (NZ) / contract performance — or explicit consent where provided | Manual review target: 2 years after the enquiry is resolved |
| Issuing and managing demo access | Email, name, organisation, NDA acceptance record (timestamp + version) | Contract performance / legitimate interest | Manual review target: 12 months after last access |
| Internal sales pipeline (CRM) | Email, name, organisation, pipeline stage, source, internal notes | Legitimate interest | Manual review target: 3 years from last pipeline activity, or earlier on an accepted deletion request |
| Marketing communications (if you opted in) | Email, name | Consent — separately and explicitly given, never pre-ticked | Current permission while active; withdrawal history retained for accountability |
| Transactional emails (team notifications) | Email, name, organisation (in notification body only) | Legitimate interest (operating the service) | Not retained by us beyond email delivery; no marketing tracking applied |
| Weighbridge ticket OCR processing | Weighbridge ticket image (may contain vehicle registration) | Contract performance | Raw ticket image discarded after extraction; extracted data retained per operator contract |
| Privacy and data-subject rights requests | Subject email, request type, resolution notes (team-side only) | Legal obligation / legitimate interest | 6 years from completion for legal accountability |
For the lead and demo-facing flows covered by this notice, ēkotrace does not collect payment data or precise location tracking, and does not run marketing analytics on the transactional emails it sends. Operator platform data (such as weighbridge records) is handled under the relevant operator contract.
Acknowledgement, consent and how we record it
When you submit an enquiry you acknowledge how we will use your details; when you opt in to marketing you give separate consent. In both cases we record:
- The exact version of this Privacy Notice that was in effect at the time (e.g. 2026-08-v1)
- The timestamp of consent
- The source page where the form was submitted
- Whether marketing consent was separately and explicitly given (it is never pre-ticked)
Your acknowledgement that we may use your details to respond to your enquiry, and your (optional) marketing consent, are stored separately with separate timestamps. The acknowledgement is not marketing consent. You can withdraw marketing consent at any time by emailing privacy@ekot.nz.
Service providers (processors)
We use the following third-party service providers to operate the platform. Each processes personal information only as directed by us and under their published privacy terms.
| Provider | Purpose | Location | Privacy policy |
|---|---|---|---|
| Replit, Inc. | Application hosting — autoscale runtime, TLS edge | United States (Google Cloud Platform) | Privacy policy |
| Supabase | Primary PostgreSQL database | Singapore (AWS ap-southeast-1) | Privacy policy |
| OpenAI | Document OCR only — no training on API inputs per provider terms | United States | Privacy policy |
| Resend | Transactional email — team notifications only, not marketing | United States | Privacy policy |
We do not sell personal information to any third party. We do not share personal information with partners, advertisers, or data brokers.
OpenAI processes weighbridge ticket images for OCR extraction only. Per OpenAI's API terms, inputs via the API are not used to train models. The human-in-the-loop review process is described in our public AI Use Statement.
International data transfers
Honest disclosure for EU, EEA and UK visitors
Your data is controlled by ēkot Circular Solutions Ltd, a New Zealand company, and processed on servers in Singapore (database) and the United States (application hosting). New Zealand holds an EU adequacy decision under GDPR, so the initial transfer of EU/EEA data to ēkot (NZ) is covered by that decision. The onward transfers from New Zealand to our providers in Singapore and the US do not currently use standard contractual clauses or another confirmed GDPR transfer safeguard — that review is in progress, and it is not a transfer mechanism in itself. If this is a concern, please contact privacy@ekot.nz before submitting your details.
The current pilot deployment uses:
- Singapore — primary database (Supabase on AWS ap-southeast-1). Singapore has a Personal Data Protection Act (PDPA) comparable in intent to New Zealand's Privacy Act.
- United States — application runtime (Replit on Google Cloud) and transactional email (Resend). Both providers operate under standard commercial data-processing terms.
NZ/AU data residency is on our roadmap for commercial and Crown deployments. See the Trust Centre for the full residency roadmap.
Retention and deletion
Indicative manual review targets are shown in Section 2. The application records a retention marker for new enquiry records, but it does not currently run an automatic deletion or anonymisation job. Our team must review and action records in each source system. The periods below are therefore operating targets, not a claim that deletion has already been technically enforced:
- Enquiries and community sign-ups: manual review 2 years after last contact.
- Demo access records and NDA acceptances: manual review 12 months after the demo window expires.
- CRM pipeline records: manual review 3 years from last activity, or sooner following an accepted request.
- Marketing permission: the current permission is changed when withdrawal is recorded; acknowledgement and withdrawal history is retained for accountability.
- Privacy and rights-request records: 6 years from completion for legal accountability.
- Weighbridge ticket OCR images: discarded immediately after extraction; the operator's extracted data follows the operator contract schedule.
You can request earlier deletion at any time — see Section 7. Until an automated retention executor is introduced, completion depends on a team member manually locating, actioning and verifying the affected records.
Your rights
Under the New Zealand Privacy Act 2020 you have the right to access personal information we hold about you and to request correction. If you are in the EU, EEA or UK, additional rights may apply (see note in Section 5). We handle all requests as described below regardless of jurisdiction:
- Access: request a copy of personal information we hold about you.
- Correction: ask us to correct inaccurate or incomplete information.
- Deletion / erasure: ask us to delete your information (subject to any legal obligation to retain).
- Objection: object to processing for marketing or where we rely on legitimate interest.
- Withdraw consent: withdraw any consent given at any time, without affecting lawfulness of prior processing.
To exercise any right, email privacy@ekot.nz with the subject line "Privacy request". Please include your name and the email address you used when contacting us. We will acknowledge within 5 business days and respond within 30 calendar days.
Requests are logged in an internal tracking tool. That tool does not itself access, correct or delete records in the enquiry, demo, CRM or consent systems. A team member performs the required action manually and records a verification note before marking the request completed.
Contact and complaints
Privacy enquiries and rights requests: privacy@ekot.nz
If you are not satisfied with our response, you may complain to the relevant supervisory authority:
- New Zealand: Office of the Privacy Commissioner — privacy.org.nz
- EU / EEA: your national data protection authority (DPA). A list is available at edpb.europa.eu.
- UK: Information Commissioner's Office — ico.org.uk
Changes to this notice
Material changes to this notice will be re-versioned (new date suffix in the version string) and the "Last reviewed" date above will be updated. Existing consent records are always linked to the version of the notice in effect at the time of submission — a version bump does not retroactively change what you agreed to. If a change materially affects how we use data you have already provided, we will contact you directly.
Version history: 2026-07-v1 — initial published version. 2026-08-v1 — corrected cross-border transfer framing (New Zealand adequacy vs onward transfers), clarified acknowledgement and marketing-consent language, and scoped data-flow statements to the lead and demo-facing flows this notice covers.