One Two Seven : Privacy

127 Privacy Statement

Effective date: 1st January 2026
Last updated: 1st May 2026

1. Our commitment to your privacy

At 127 (One Two Seven), we recognise the importance of protecting your personal information and respecting your privacy.

We are committed to handling personal information responsibly, transparently and in accordance with the New Zealand Privacy Act 2020 (as amended), including its Information Privacy Principles.

This Privacy Statement explains how we collect, use, store, protect and share personal information when you interact with our organisation, website, products and services.

2. Who we are

127 is 127 Midlands Limited operating as One Two Seven.

Organisation: 127 Midlands Limited
Business address: Hiko Hub, Gate 5, 163 Hillcrest Road, Hamilton, 3216
Website: www.127.co.nz
Privacy contact: privacy@127.co.nz

127 is responsible for the personal information it collects and holds, subject to any applicable contractual arrangements and legal obligations.

3. Personal information we collect

Depending on how you interact with us, we may collect:

Identity information: Your name, job title and organisation.
Contact information: Your email address, telephone number and business contact details.
Account information: Information needed to establish, manage and secure your account.
Service information: Information you provide when requesting, purchasing or using our products and services.
Technical information: IP addresses, device information, browser details, access logs and website usage information.
Communications: Information you provide when contacting us, submitting enquiries or requesting support.
Other information: Personal information you voluntarily provide to us for a specific purpose.

We aim to collect only the personal information reasonably necessary for our legitimate business functions and activities.

4. How we collect personal information

We may collect personal information:

Directly from you when you contact us, complete forms, register for services or otherwise interact with 127.
Automatically when you access our website or digital services, including through applicable cookies, analytics and security logging.
From your employer or organisation when they arrange access to our services on your behalf.
From third parties where collection is permitted by law and is reasonably necessary for our business activities.

Where we collect personal information from someone other than the individual concerned, we will take reasonable steps to ensure that the individual is informed of the collection and relevant details, in accordance with Information Privacy Principle 3A, unless an applicable exception applies.

5. Why we collect and use personal information

We collect and use personal information for purposes including:

Providing, operating and maintaining our products and services.
Managing customer relationships, enquiries and support requests.
Establishing and administering user accounts.
Communicating important service, operational and security information.
Processing transactions and fulfilling contractual obligations.
Maintaining the security, reliability and integrity of our systems.
Detecting, investigating and preventing unauthorised activity.
Improving our services and understanding how they are used.
Complying with applicable legal and regulatory obligations.
Sending marketing communications, where permitted by law, and subject to applicable preferences and unsubscribe rights.

We will not use personal information for unrelated purposes unless authorised or required by law or otherwise permitted under the Privacy Act 2020 (as amended).

6. Whether you must provide personal information

In most circumstances, providing personal information to 127 is voluntary.

However, certain information may be necessary for us to provide requested services, establish accounts, process transactions, respond to enquiries or meet legal obligations.

If you choose not to provide information that is necessary for a particular purpose, we may be unable to provide the relevant service or complete your request.

Where the collection of specific information is required or authorised by legislation, we will identify the applicable legal requirement or authority when notifying you about that collection.

7. Who we share personal information with

We may disclose personal information to:

Authorised 127 employees and contractors who require access to perform their responsibilities.
Technology, hosting, infrastructure and other service providers supporting our operations.
Professional advisers, including legal, accounting and auditing providers, where necessary.
Government agencies, regulators or law enforcement authorities where disclosure is required or authorised by law.
Other parties where you have authorised the disclosure or where it is otherwise permitted under the Privacy Act 2020 (as amended).

We take reasonable steps to ensure that third parties handling personal information on our behalf are subject to appropriate confidentiality, privacy and security obligations.

We do not disclose personal information to third parties for their independent marketing purposes unless appropriately authorised.

8. Storage and security

127 recognises the importance of protecting personal information against loss, unauthorised access, misuse, modification and disclosure.

We maintain administrative, technical and organisational security measures appropriate to the nature and sensitivity of the information we hold.

These may include access controls, authentication, encryption, security monitoring, staff awareness and incident management processes.

While we take reasonable precautions to protect personal information, no method of electronic storage or transmission can be guaranteed to be completely secure.

9. Overseas storage and disclosure

Some of the technology providers or service providers used by 127 may process or store personal information outside New Zealand.

Where personal information is disclosed to an overseas recipient, we will comply with the applicable requirements of the Privacy Act 2020 (as amended), including Information Privacy Principle 12 where relevant.

We will take appropriate steps to protect personal information when engaging overseas service providers.

127 generally seeks to use technology and service providers that support data storage and processing within New Zealand or Australia, where appropriate and available.

Some services, including certain AI-enabled capabilities, may involve processing personal information in other geographic locations. Where this occurs, 127 applies appropriate governance, security and contractual controls, taking into account the nature and sensitivity of the information and applicable privacy obligations.

Where 127 processes personal information on behalf of a customer, any geographic or processing requirements agreed with that customer will continue to apply.

10. Retention of personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including meeting applicable contractual, operational and legal requirements.

Where personal information is processed on behalf of customers, retention, return and deletion arrangements may be governed by the applicable customer agreement and associated service requirements.

When personal information is no longer required, we will take reasonable steps to securely delete, destroy or de-identify it, subject to applicable legal retention obligations.

11. Your rights to access and correct information

Under the Privacy Act 2020 (as amended), you have the right to request access to personal information that 127 holds about you and to request correction of information you believe is inaccurate, incomplete or misleading.

To make a request, please contact our Privacy Officer using the details below.

We will respond to requests in accordance with the timeframes and requirements of the Privacy Act 2020 (as amended).

If we do not agree to make a requested correction, you may ask us to attach a statement of correction sought to the relevant information, as provided for under the Act.

12. Cookies and website analytics

Our website may use cookies and similar technologies to support website functionality, maintain security and understand website usage.

Depending on the technologies used, this may involve collecting information such as IP addresses, browser details and interactions with our website.

You can manage certain cookie preferences through your browser settings.

127 only uses basic cookies on public web sites for ease of use, accessibility, or session continuity reasons. Analytics is limited to session use and to help 127 improve key areas of the web estate.

13. Privacy incidents and breaches

127 maintains processes for identifying, assessing and responding to privacy and information security incidents.

Where a privacy breach has caused, or is likely to cause, serious harm, 127 will assess its notification obligations and notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020 (as amended).

We will take appropriate steps to contain incidents, assess their impact and reduce the risk of further harm.

14. Privacy complaints

If you have concerns about how 127 has collected, used, stored or disclosed your personal information, please contact our Privacy Officer.

We will review your concern and respond in accordance with our privacy obligations.

If you are dissatisfied with our response, you may contact the Office of the Privacy Commissioner:

Website: www.privacy.org.nz

15. Changes to this statement

We may update this Privacy Statement from time to time to reflect changes to our operations, services, legal obligations or privacy practices.

The latest version will be available on our website, together with the date it was last updated.

Where appropriate, we will provide additional notice of material changes.

16. Contact us

For privacy enquiries, access or correction requests, or concerns about personal information, please contact:

Privacy Officer
127 - One Two Seven
Email: privacy@127.co.nz
Address: Hiko Hub, Gate 5, 163 Hillcrest Road, Hamilton, 3216
Website: www.127.co.nz