Privacy policy
1. Introduction
Howiiconnect respects your privacy and recognises the importance of protecting personal information, particularly information relating to personal wellbeing, emotional experiences and relationships.
This Privacy Policy explains how we collect, use, store, share, retain and protect personal information when you use our social networking and wellbeing services.
Our principal operations and primary data hosting are based in New Zealand.
We operate internationally and recognise that additional privacy requirements may apply to users in different jurisdictions.
2. Information We Collect
Depending on your activities and the services you use, we may collect the following categories of information.
Account and identity information
- Name and username.
- Email address.
- Date of birth or age-related information.
- Profile photograph and biography.
- Login and authentication information.
- Account preferences and settings.
Content and communication information
- Posts and comments.
- Uploaded photographs and videos.
- Group participation and interactions.
- Private messages and associated metadata.
- Event participation and networking activities.
- Reactions, connections and other engagement records.
Wellbeing information
- Journal entries.
- Mood-tracking records.
- Personal reflections.
- Wellbeing-related preferences.
Sensitive information voluntarily included in content.
This information may include health-related or other sensitive personal data.
Technical and usage information
- IP address.
- Device and browser information.
- Login activity.
- Security logs.
- Pages and features accessed.
- Cookie identifiers.
- Advertising and analytics events where applicable.
Location information
We may infer approximate location from IP addresses or collect location information supplied by users.
Precise device location will only be collected if that feature is implemented and the necessary permissions and legal requirements are satisfied.
Reports and safety information
We may collect information submitted through abuse reports, moderation appeals, complaints and safety investigations.
3. Sources of Personal Information
We primarily collect information directly from you.
We may also receive information from:
- Other users who mention, tag, message or report you.
- Group or event organisers.
- Service providers acting on our behalf.
- Security and fraud-prevention systems.
- Publicly available sources where lawful.
- Advertising or analytics partners, if such integrations are implemented.
Where we collect personal information indirectly, we will provide the notices required by applicable law, including New Zealand's Information Privacy Principle 3A where applicable.
4. Purposes of Processing
We use personal information for purposes including:
- Creating and managing accounts.
- Authenticating users.
- Providing social networking features.
- Delivering private messaging.
- Supporting communities and groups.
- Operating wellbeing journals and mood tracking.
- Managing events and networking functions.
- Applying user privacy settings.
- Detecting abuse, fraud and security threats.
- Reviewing reports and enforcing Community Standards.
- Responding to support requests.
- Maintaining service reliability.
- Complying with legal obligations.
- Providing advertising where permitted.
- Analysing and improving platform performance.
We will not use information for materially incompatible purposes without an appropriate lawful basis and any notice or consent required by law.
5. Legal Bases for Processing
Where the EU GDPR, UK GDPR or comparable legislation applies, we will identify and document an appropriate lawful basis for each processing purpose.
Depending on the activity, this may include:
- Performance of a contract.
- Compliance with legal obligations.
- Legitimate interests, following the required assessment.
- Consent.
- Protection of vital interests where legally applicable.
Processing of special-category information, including health-related data, requires an additional applicable legal condition.
Where explicit consent is necessary, we will obtain it before the relevant processing begins.
Implementation requirement: The final lawful-basis schedule and any special-category processing conditions must be completed and verified before publication.
6. Wellbeing Journals and Mood Information
We recognise that journals and mood records can contain deeply personal information.
We will apply appropriate access restrictions and security controls to such information.
Journal content will be processed for the purposes clearly communicated to users.
Private journal entries will not be displayed publicly without an authorised user action.
We will not use identifiable private journal entries or mood records for behavioural advertising unless a separate, legally valid arrangement has been established and expressly disclosed. Our intended policy is not to permit such targeting.
Access by authorised personnel will be restricted to legitimate operational, safety or legal needs.
The platform must clearly identify which wellbeing information is private and which information users intentionally share.
7. Visibility of Information
Users may share information with different audiences depending on available privacy controls.
These may include:
- Public audiences.
- Approved connections.
- Group members.
- Specific message recipients.
- Private journal access.
The precise controls and default settings must be described accurately within the platform.
Public content may be accessible to people outside Howiiconnect and may be copied or redistributed by third parties.
Other users may retain screenshots or copies even after content is deleted.
8. Private Messages
We process private messages to deliver communication services, maintain system functionality, investigate properly reported abuse and comply with applicable legal obligations.
Private messages are not intended to be publicly visible.
We will not claim that messages are end-to-end encrypted unless that feature has been implemented and independently verified.
Any authorised access to message content will be subject to applicable law, internal access controls and the purposes described in this Policy.
9. Advertising and Personalisation
Howiiconnect displays advertising and sponsored content.
Advertising may be contextual, based on general content or placement, or personalised where lawful and supported by the platform.
Where personalisation is implemented, we will explain the information used, the relevant advertising partners and available user choices.
We will not permit advertisers to access private messages, private wellbeing journals or identifiable mood records for advertising targeting.
We will not use sensitive wellbeing information to infer vulnerabilities for targeted advertising.
Advertising directed at minors will be subject to heightened safeguards and applicable legal restrictions.
Where required, optional advertising cookies and tracking will not activate before valid consent is obtained.
10. Sharing Personal Information
We may disclose information to authorised recipients where reasonably necessary and lawful.
These may include:
- New Zealand hosting and infrastructure providers.
- Technical maintenance and security providers.
- Customer support providers.
- Content moderation providers.
- Email and communication service providers.
- Analytics and advertising providers.
- Professional advisers.
- Regulators, courts and law enforcement authorities.
- Parties involved in a lawful corporate transaction.
Service providers must be subject to appropriate confidentiality, security and data protection requirements.
We will not sell private wellbeing journals or private message contents to advertisers or data brokers.
11. International Data Transfers
Our primary data hosting location is New Zealand.
However, information may be accessed, transmitted or processed outside New Zealand through international communications, users, service providers or approved business operations.
Where cross-border disclosure is subject to New Zealand Information Privacy Principle 12 or other applicable law, we will apply the required safeguards.
For transfers subject to the GDPR or UK GDPR, we will use an applicable transfer mechanism where required.
We will maintain an internal record of relevant providers, processing locations and transfer arrangements.
Implementation requirement: The final published policy must identify actual material international processing arrangements and any additional legally required disclosures.
12. Data Security
We will maintain technical and organisational safeguards appropriate to the sensitivity and risks of the information we process.
These may include:
- Encryption in transit and at rest.
- Role-based access controls.
- Secure authentication.
- Restricted administrative access.
- Security logging and monitoring.
- Backup and recovery arrangements.
- Vulnerability management.
- Staff confidentiality obligations.
- Incident response procedures.
- Appropriate vendor assessments.
The final security measures must reflect actual deployed controls.
No online service can guarantee complete protection against every security incident.
13. Data Retention
We retain personal information only for as long as reasonably necessary for legitimate operational purposes, security, legal compliance and dispute resolution.
Different retention periods may apply to:
- Active account records.
- Deleted accounts.
- Public content.
- Private messages.
- Wellbeing journals.
- Mood records.
- Moderation evidence.
- Security logs.
- Advertising and analytics records.
- Backups.
When retention is no longer necessary, information will be deleted, anonymised or otherwise handled according to applicable law.
Implementation requirement: A retention schedule stating specific periods or objective retention criteria must be approved and implemented before launch.
14. Access, Correction and Deletion
Subject to applicable law, users may request access to personal information held about them.
Users may request correction of inaccurate information.
Where applicable, users may also request deletion, restriction, portability or objection to certain processing activities.
We may need to verify identity before fulfilling a request.
Some information may be retained where legally required or where a lawful exception applies.
Requests can be submitted to admin@howicare.co.nz
15. Consent and Marketing Choices
Where processing relies on consent, users may withdraw that consent using the available controls or by contacting us.
Withdrawal does not necessarily affect processing lawfully completed before withdrawal.
Users may opt out of promotional email communications using the unsubscribe mechanism provided.
Transactional, account security and essential service messages may still be sent where lawful.
16. Children and Young People
Howiiconnect's general minimum registration age is 13, subject to higher applicable legal requirements.
We recognise that younger users require additional protection.
Where required, we will implement:
- Age-appropriate privacy settings.
- Restrictions on sensitive advertising.
- Appropriate parental or guardian authorisation.
- Safeguards against unwanted adult contact.
- Child-friendly privacy explanations.
- Reporting and blocking mechanisms.
- Restrictions on unnecessary collection of information.
We will not knowingly permit children to use features where applicable legal requirements cannot be satisfied.
17. Automated Processing
Howiiconnect may use automated processes to support platform functionality, security, content ranking or advertising.
Any automated profiling, AI-assisted moderation or consequential decision-making must be separately assessed and disclosed before implementation.
Where applicable law provides rights concerning automated decisions, we will honour those rights.
We do not claim that automated systems are currently deployed unless confirmed in the platform's technical documentation.
18. Cookies and Similar Technologies
We may use cookies and related technologies to maintain sessions, remember preferences, protect accounts, measure performance and support advertising.
Our Cookies Policy explains these technologies and relevant choices.
Non-essential tracking will be subject to applicable consent requirements.
19. Privacy Breaches
We will investigate suspected privacy breaches and take appropriate steps to contain and address incidents.
Where a breach meets applicable notification thresholds, we will notify the relevant regulator and affected individuals as required.
Under New Zealand law, qualifying serious-harm privacy breaches are subject to notification requirements.
20. Complaints and Regulatory Rights
Privacy concerns should initially be directed to our Privacy Officer.
We will assess complaints fairly and respond within applicable legal timeframes.
Individuals may also raise concerns with the New Zealand Office of the Privacy Commissioner or another competent regulator where applicable.
21. Changes to This Policy
We may update this Policy as our services, technologies, legal obligations or processing activities change.
Material changes will be communicated appropriately.
Where new processing requires consent, we will obtain that consent before commencing the activity.
22. Contact Details
Howiiconnect Privacy Officer
Legal Entity: HIC - Hear It Change Limited
Email: admin@howicare.co.nz
Address: 343 Flat Bush School Road, Flat Bush Auckland 2016 New Zealand
Website: https://www.howiiconnect.com