Privacy Policy

Introduction

This Privacy Policy explains how DCX Group LTD (“we”, “us”, “our”) collects, uses, discloses, and protects personal information when you visit dcx.co.nz, contact us, or use our services. We comply with the Privacy Act 2020 (NZ) and its Information Privacy Principles (IPPs). If you are located outside New Zealand, we will also respect the laws that apply to you where feasible (for example, the EU/UK GDPR and the California Consumer Privacy Act). By using our website or services, you agree to the terms of this Privacy Policy.

Who we are

DCX Group LTD provides managed IT services, cybersecurity, cloud, networking, and related consulting for organisations. For any privacy query, contact our Privacy Officer at [email protected].

What we collect

• Identifiers: name, job title, company, email address, phone number.
• Business account data: billing and service records, support tickets, device identifiers, IP addresses.
• Website & analytics data: pages viewed, referring/exit pages, timestamps, general location (city/region), and cookie identifiers.
• Security & operations data: audit logs, access events, and diagnostic information from systems we manage on your behalf.
• Optional data you provide: survey responses, testimonials, meeting recordings (with notice), or files submitted through forms.

We do not intentionally collect sensitive personal information unless it is strictly necessary and you have provided it or consented (for example, when included in support materials).

Where we get it

• Directly from you when you contact us, request a quote, sign a contract, or open a support ticket.
• Automatically via cookies, analytics, and systems we operate or manage.
• From your organisation if we provide services to your employer or business.
• From service providers (e.g., Microsoft 365, ticketing/monitoring platforms) as needed to deliver services.

How we use it

• Provide, operate, and improve our services.
• Respond to enquiries, quotes, and support requests.
• Provision and manage user access, devices, and software.
• Monitor, secure, and back up systems we manage.
• Billing, account administration, and contract performance.
• Analytics, site performance, and service development.
• Compliance with laws, law-enforcement requests, and legal claims.

Legal bases (overseas visitors)

New Zealand’s Privacy Act does not require a “lawful basis” to collect personal information, but where other laws apply (for example, the EU/UK GDPR) we rely on the following bases:

• Contract: processing necessary to deliver our services.
• Legitimate interests: securing systems, improving services, preventing fraud.
• Consent: for specific activities such as certain marketing cookies or testimonials.
• Legal obligation: record-keeping and compliance duties.

Sharing & disclosures

We may share personal information with:

• Service providers / subprocessors that help us deliver services (e.g., Microsoft 365, cloud hosting, ticketing/monitoring, security tools). These providers are bound by contracts and only process data under our instructions.
• Your organisation if the services are provided to your employer or business.
• Professional advisors (lawyers, auditors) under confidentiality obligations.
• Authorities when required by law or to protect rights, safety, or security.

We do not sell personal information.

Sending information overseas

Some of our service providers — including analytics and cloud platforms such as Google, Microsoft, and Cloudflare — store or process information outside New Zealand, including in the United States. In line with Information Privacy Principle 12, we only disclose personal information to overseas recipients where they are subject to comparable privacy safeguards, are bound by contractual protections (such as Standard Contractual Clauses), or you have authorised the disclosure.

Cookies & analytics

We use cookies and similar technologies to operate the website, remember preferences, and measure performance:

• Strictly necessary: required for core site functionality.
• Performance/analytics: help us understand usage and improve the site.
• Functional: remember choices such as language or region.

The analytics tools we use are Google Analytics 4 and Microsoft Clarity (managed through Google Tag Manager). These set cookies and, in Clarity’s case, may capture anonymised session recordings and heatmaps (with form fields masked) to help us understand how the site is used. Analytics load only after you choose “Accept” on our cookie banner; choosing “Decline” loads none of them. You can also control cookies via your browser settings. Disabling certain cookies may impact functionality.

Retention

We keep personal information only as long as necessary for the purposes described in this policy, to comply with legal and accounting obligations, or to resolve disputes. Retention periods depend on the data type and our contractual requirements. When no longer needed, we take reasonable steps to delete or de-identify information.

Security & data breaches

We use technical and organisational safeguards appropriate to the risk, including access controls, encryption in transit (and at rest where supported), logging and alerting, vulnerability management, and staff training. No system is 100% secure; we encourage you to notify us immediately of any suspected incident.

If a privacy breach occurs that is likely to cause serious harm, we will notify the affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

Your rights

Under the Privacy Act 2020, you have the right to request access to, and correction of, the personal information we hold about you. If you are in a jurisdiction with additional rights (for example, EU/UK GDPR or CCPA), you may also have rights to deletion, restriction, portability, or objection, subject to applicable limits.

To exercise your rights, contact us at [email protected]. We may need to verify your identity and, where we process data on behalf of your employer, we may redirect your request to them.

Children

Our services are intended for business customers and are not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps.

Third-party links

Our website may link to third-party sites or services. We are not responsible for their privacy practices, and we recommend reviewing the privacy policies of those third parties.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to laws, technologies, or our services. The “Last updated” date at the top shows when changes were made. Significant changes will be notified on this page and, where appropriate, by email.

Contact us & complaints

If you have questions, requests, or complaints about privacy, please contact:

If your concern remains unresolved, you can contact the Office of the Privacy Commissioner (NZ).