Privacy Policy

HazNode Software Limited

Updated March 2026

Your privacy matters to us, and so does being clear about how we handle information. This policy explains:

• what information we collect about you and why;
• how we use and share that information;
• how we store and protect it;
• your rights and how to exercise them; and
• how international data transfers are managed.

This Privacy Policy applies to HazNode Software Limited ("HazNode", "we", "us", "our") and covers information collected through our platform, website, and any other interaction you have with us. "Services" means the HazNode platform and website, collectively.

"Subscriber" means an organisation or individual that has subscribed to use the Services. "User" means any individual who accesses the Services under a Subscriber's account. "End Client" means a client of a Subscriber whose information may be entered into or processed through the Services.

Where HazNode provides the Services to a Subscriber organisation, that organisation controls the information processed through the Services for its own business purposes. Please see the Notice to Subscribers and End Users section below for more detail.

If you do not agree with this policy, please do not use the Services or interact with us.

1. What Information We Collect

1.1 Information You Provide to Us

Account and profile information: When you register for or access the Services, we collect information including your name, email address, job title, organisation name, and billing details. You may also add a profile photo or other optional details.

Content you enter into the platform: The Services are designed for occupational and industrial hygiene consultancy workflows. This means the content you input may include professional and technical data such as client names and contact details, project descriptions, sampling plans, site visit records, monitoring and exposure data, laboratory results, worker group classifications, and exposure histories. Some of this data may be health-adjacent or professionally sensitive in nature. HazNode treats all such content as Subscriber Data and handles it with the care described in this policy. See Section 4 for more detail on sensitive data.

Communications with us: If you contact us for support, submit feedback, or otherwise communicate with us, we collect the content of those communications and any contact or account information you provide.

Payment information: We collect billing contact details and, where applicable, payment card or banking information through our secure third-party payment processor. HazNode does not store full payment card details on its own systems.

1.2 Information We Collect Automatically

Usage data: We collect information about how you interact with the Services, including features used, pages visited, actions taken, search terms, and how you navigate between areas of the platform. Where you use Elementor by HazNode, we also record the PIN entered and the details of any third-party data retrieval query initiated, as part of your account activity history.

Device and connection information: We collect information about the device and browser you use to access the Services, including IP address, browser type, operating system, and crash or error data. We use IP address to approximate your location for service delivery purposes only.

Cookies and tracking technologies: We use cookies and similar technologies to support secure access, remember your session and preferences, and analyse how the Services are used. See Section 6 for more detail on cookies.

1.3 Information We Receive from Other Sources

Other Users: Other Users within your organisation may provide information about you when entering content into the Services, for example by assigning tasks or recording activities in which you are involved.

Third-party integrations: If you or your organisation connects a third-party service to HazNode (for example, an accounting or calendar integration), we may receive information from that service as permitted by your settings and the third party's own privacy policy. You should review the privacy policies of any third-party services you connect.

Partners and referrals: We may receive information about you from marketing partners, resellers, or referral sources in connection with promotional or sales activity.

2. How We Use Information We Collect

We use the information we collect for the following purposes:

• To provide and operate the Services: processing your transactions, authenticating your login, delivering the platform functionality, and providing customer support.
• To personalise your experience: tailoring content, search results, and notifications to be relevant to you and your organisation's workflows.
• To improve and develop the Services: analysing usage patterns, identifying areas for improvement, testing new features, and monitoring platform performance. Where we use data for analytics and development purposes, we do so using aggregated or de-identified information wherever possible.
• To communicate with you about the Services: sending transactional communications such as account confirmations, invoices, subscription reminders, security alerts, and support responses. These communications are a necessary part of the Services.
• To send promotional communications: with your consent or where we have a legitimate interest, we may send newsletters, product updates, event invitations, or other marketing communications. You can opt out of marketing communications at any time.
• For safety, security, and compliance: monitoring for fraudulent or unauthorised activity, enforcing our Terms of Service, and meeting our legal obligations.
• In connection with business transactions: if HazNode is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will notify affected users of any such transfer.

Note: HazNode does not use Subscriber Data to train machine learning or artificial intelligence models without explicit agreement with the relevant Subscriber.

3. How We Share Information We Collect

We do not sell personal information to advertisers or data brokers. We share information only as described below.

3.1 Within Your Organisation

Information you input into the Services is accessible to other authorised Users within your Subscriber account, in accordance with the permissions and role settings configured by your organisation's administrator.

3.2 Service Providers

We engage third-party service providers to support the operation of the Services, including infrastructure hosting, payment processing, email delivery, analytics, and customer support tooling. These providers access information only as necessary to perform services on our behalf and are bound by confidentiality and data protection obligations consistent with this policy.

Key service providers and their roles include:

• DigitalOcean: cloud infrastructure and data hosting across multiple regions (see Section 5).
• Clerk: user authentication and identity management.
• HubSpot: marketing, sales CRM, and customer communications.
• Google Analytics: website usage analytics.
• Meta (Facebook): advertising measurement via the Meta Pixel on our website.
• Mailtrap: transactional email delivery.
• Xero: accounting integration (where enabled by Subscriber).

This list may be updated from time to time. Significant changes to key sub-processors will be communicated to Subscribers.

3.3 Third-Party Integrations

Where you or your organisation enables a third-party integration within the Services, information may be shared with the relevant third-party provider to the extent necessary for that integration to function. We are not responsible for the privacy practices of third-party providers. We encourage you to review their privacy policies before enabling any integration.

3.4 Legal and Regulatory Disclosure

We may disclose information where we reasonably believe it is necessary to: comply with applicable law, regulation, or legal process; respond to a lawful request from a government or regulatory authority; enforce our Terms of Service or other agreements; protect the rights, property, or safety of HazNode, our users, or the public; or prevent or address fraud, security, or technical issues.

3.5 Business Transfers

In the event of a merger, acquisition, financing, or sale of all or part of HazNode's business, Subscriber information may be transferred to the relevant party as part of that transaction. We will provide notice to affected Subscribers where required by law.

3.6 With Your Consent

We may share information in other circumstances where you have given us explicit consent to do so, for example where we publish a customer testimonial or case study with your permission.

4. Occupational Hygiene and Sensitive Professional Data

HazNode is purpose-built for occupational and industrial hygiene consultants. As a result, the content entered into the platform may include data that is professionally sensitive or health-adjacent, including:

• monitoring and exposure measurements for named or grouped workers;
• long-term exposure histories by worker group, task, or site;
• sampling results and laboratory data linked to specific projects or sites;
• health and safety risk records associated with specific workplaces or individuals.

HazNode acts as a data processor in relation to this content — it is entered and controlled by Subscribers for their own professional and consultancy purposes. HazNode does not access, analyse, or use this content for any purpose other than operating and improving the Services, except where instructed by the Subscriber or required by law.

Subscribers are responsible for ensuring they have appropriate authority and, where required by applicable law, consent to enter individual-level data into the platform. Where worker-level exposure data is linked to identifiable individuals, Subscribers should satisfy themselves that their use of the platform complies with applicable privacy and health information laws in their jurisdiction.

HazNode applies the same technical and organisational security measures to all Subscriber Data, including occupational hygiene records. See Section 5 for details on how data is stored and secured.

5. How We Store and Secure Information

5.1 Infrastructure and Hosting

HazNode's platform infrastructure is hosted on DigitalOcean. Data may be stored and processed in any of the following regions, depending on infrastructure configuration at the time: Australia, Singapore, United States of America, United Kingdom, Germany, Netherlands, and Canada.

HazNode does not currently offer single-region data residency as a default. Subscribers with specific data residency requirements should contact us at support@haznode.com to discuss available options.

5.2 Security Measures

We implement technical and organisational measures designed to protect information against unauthorised access, loss, disclosure, or destruction. These measures include:

• TLS encryption for data in transit;
• encryption at rest for stored Subscriber Data;
• role-based access controls within the platform;
• authentication via Clerk, with support for secure credential management;
• regular infrastructure and application security reviews.

No security system is entirely impenetrable. While we work hard to protect your information, we cannot guarantee absolute security of data transmitted over the internet or stored on our systems. We encourage Subscribers to use strong passwords, manage User access carefully, and contact us promptly if they suspect any unauthorised access to their account.

5.3 How Long We Keep Information

Account and subscription data: We retain account and billing information for as long as your account is active and for a reasonable period thereafter to allow for account reactivation, and as required to meet our legal obligations including tax and financial record-keeping requirements.

Subscriber Data (platform content): Following termination or cancellation of a subscription, Subscriber Data is retained for 60 days to allow for export. After that period, Subscriber Data will be permanently deleted from active systems. Residual copies in backup systems will be deleted in accordance with our backup retention schedule.

Support and communications data: Records of support interactions and general communications are retained for as long as reasonably necessary to manage the relevant matter and for up to seven years thereafter.

Analytics and usage data: Aggregated or de-identified usage data may be retained indefinitely for the purposes of service improvement and product development.

6. Cookies and Tracking Technologies

HazNode uses cookies and similar technologies on our website and within the platform. These fall into the following categories:

• Strictly necessary cookies: required for the Services to function, including session management and secure authentication. These cannot be disabled without affecting the usability of the Services.
• Performance and analytics cookies: used to understand how visitors use our website and platform. We use Google Analytics for website analytics. These cookies collect information in aggregated form and help us identify areas for improvement.
• Marketing and communications cookies: used to support our marketing activity, including HubSpot tracking on our website to identify visitor interest and personalise follow-up communications, and the Meta Pixel, which lets us measure the effectiveness of our advertising on Facebook and Instagram and reach people who have visited our website. Both are only enabled once you accept cookies.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Services. For marketing cookies, you may also opt out directly through the relevant platform (e.g. Google Analytics opt-out tools).

7. How to Access and Control Your Information

Subject to applicable law, you have the following rights in relation to your personal information:

• Access: you may request a copy of the personal information we hold about you.
• Correction: you may request that we correct inaccurate or incomplete information. Many details can be updated directly within your account settings.
• Deletion: you may request deletion of your personal information. Where you are a User under a Subscriber account, deletion requests should be directed to the Subscriber in the first instance, as the Subscriber controls the account.
• Restriction or objection: you may request that we restrict processing of your information or object to particular uses, for example marketing communications.
• Portability: where technically feasible, you may request a copy of your Subscriber Data in a portable format. Subscribers can export data directly from within the platform.
• Withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@haznode.com. We will respond within a reasonable timeframe and in any event within 20 working days, consistent with our obligations under the New Zealand Privacy Act 2020.

Where we are unable to fulfil a request, we will explain why. You also have the right to make a complaint to the New Zealand Privacy Commissioner at www.privacy.org.nz.

8. International Data Transfers

HazNode is a New Zealand company serving customers globally. As described in Section 5, data may be stored in or transferred to infrastructure located outside New Zealand, including Australia, Singapore, the United States, the United Kingdom, Germany, the Netherlands, and Canada.

When transferring personal information outside New Zealand, HazNode takes steps to ensure that information receives adequate protection consistent with the New Zealand Privacy Act 2020. This includes relying on:

• transfers to countries that the New Zealand Privacy Commissioner has recognised as providing comparable privacy safeguards;
• contractual safeguards with service providers that require them to protect information to a standard consistent with New Zealand privacy law; and
• other lawful transfer mechanisms as applicable.

If you have questions about international transfers or wish to understand the safeguards in place for a particular transfer, please contact us at support@haznode.com.

9. Notice to Subscribers and End Users

Where HazNode provides the Services to a Subscriber organisation, that Subscriber controls the information entered into and processed through the Services. HazNode acts as a data processor on behalf of the Subscriber in relation to that content.

If you are a User accessing the Services through your employer or another organisation's account, your use of the Services and the information you enter may be subject to your organisation's own privacy policies and instructions. Please contact your organisation's administrator for information about how your data is managed within the platform.

If you are an End Client whose information has been entered into the platform by a HazNode Subscriber (for example, as part of a consultancy engagement), your rights in relation to that information should be directed to the Subscriber in the first instance, as the Subscriber is responsible for the lawful basis of that data collection. If you are unable to resolve your concerns with the Subscriber, please contact us at support@haznode.com and we will assist where we are able.

10. Elementor by HazNode — Third-Party Data Retrieval

Elementor by HazNode is a module within the Services that enables users to build a chemical and hazardous substance inventory and generate indicative risk ratings and general guidance. This section describes how personal and account data is handled in the context of Elementor's third-party data retrieval functionality.

10.1 PIN-Based Retrieval from the HSNO Register

Where a user enters a PIN into Elementor and initiates an import, Elementor will access the New Zealand Hazardous Substances register at hazardoussubstances.govt.nz on the user's behalf to retrieve the relevant hazardous substance information associated with that PIN. By initiating this retrieval, the user confirms they hold the appropriate authority to access the information associated with that PIN.

10.2 Data Recorded Against Your Account

The PIN entered and the hazardous substance data retrieved from the HSNO register will be recorded against the user's Elementor account as Subscriber Data. This data represents a snapshot of the information available from the register at the time of retrieval and may not reflect subsequent changes to the register. HazNode does not warrant the accuracy, completeness, or currency of data retrieved from the HSNO register or any other third-party source, and accepts no responsibility or liability for errors or omissions in that data.

10.3 Indicative Outputs

Risk ratings, guidance, and any other outputs generated by Elementor are indicative only. They are based on general considerations and information retrieved from third-party sources. They do not constitute occupational health, safety, legal, or compliance advice and should not be relied upon as such. Users should consult a qualified occupational health specialist or safety professional wherever there is any concern about workplace health and safety, or before making decisions that could affect the health, safety, or welfare of any person.

11. Children's Privacy

The Services are designed for professional use by adults operating in occupational and industrial hygiene consultancy. The Services are not directed at, and we do not knowingly collect personal information from, anyone under the age of 16. If we become aware that we have inadvertently collected information from a person under 16, we will take prompt steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. We will notify Subscribers of material changes by email or by prominent notice within the Services at least 30 days before the changes take effect. The date of the most recent update is shown at the top of this document.

Continued use of the Services after the effective date of any update constitutes acceptance of the revised policy.

13. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact us:

We are committed to resolving privacy concerns promptly and in accordance with our obligations under the New Zealand Privacy Act 2020. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner at www.privacy.org.nz.