Privacy Policy

Aimy Limited is a New Zealand company that provides the AimyOne and aimyPlus programme-management platforms, related applications, websites and support services. This Privacy Policy explains how Aimy Limited and its relevant affiliates (Aimy, we, our or us) collect, hold, use, disclose and protect Personal Information. We comply with privacy laws that apply to our activities, including the New Zealand Privacy Act 2020 and, where applicable, the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs). Where the General Data Protection Regulation (GDPR) or another privacy law applies, we will also comply with that law.

 

1. OUR ROLE AND THE ROLE OF ORGANISATION SUBSCRIBERS

Aimy handles Personal Information in different capacities depending on the context. For information we collect for our own business purposes - such as account administration, website use, billing, sales and support - Aimy determines how and why that information is handled. For much of the information entered into AimyOne or aimyPlus by a school, childcare provider, programme provider or other subscribing organisation (Subscriber Data), the subscribing organisation determines why the information is collected and how it is used. Aimy generally processes that information to provide the Service on the organisation’s behalf and in accordance with our contract with that organisation. If you ask us to exercise privacy rights in relation to Subscriber Data, we may need to refer the request to, or coordinate with, the relevant organisation because it controls the underlying relationship and may be legally responsible for responding.

 

2. PERSONAL INFORMATION WE COLLECT

Depending on how you interact with Aimy or an organisation using our Service, we may collect: ● account and identity information, such as name, username, role, address, email address, telephone number and authentication information; ● information about children, parents, legal guardians, caregivers, emergency contacts, teachers, staff and other programme participants; ● sensitive information where needed for programme administration, safety or legal requirements, such as health conditions, allergies, medication, disability information, incident information or other health-related information; ● booking, enrolment, attendance, programme, invoice, subsidy, payment-status and account information; ● information submitted through support tickets, helpdesk services, chat, forms, surveys or other communications; ● usage and security information, such as login events, pages or functions used, reports generated, audit logs, IP address, device and browser information, timestamps and diagnostic data; ● business contact, sales, billing and contract information for organisations that deal with Aimy; and ● other information reasonably necessary to provide the Service, respond to a request, comply with law or protect the security of our systems. We do not intentionally store full debit or credit card details. Card payments are processed by third-party payment providers. Depending on the payment method, we may receive transaction identifiers, payment status, limited account information or other records needed for reconciliation and support.

 

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect Personal Information directly from you, from an organisation using our Service, from another authorised user, from a parent or caregiver, from an integration or service provider, or automatically when you use our Service or websites. Where information is collected indirectly, we and our subscribing organisations are responsible for providing any notice required by applicable law. In New Zealand this includes, where applicable, the notification requirements for indirect collection under Information Privacy Principle 3A. In Australia, APP 5 may require individuals to be notified of the circumstances and purposes of collection, usual disclosures and likely overseas disclosures.

 

4. WHY WE USE PERSONAL INFORMATION

We may collect, hold, use and disclose Personal Information where reasonably necessary to: ● provide, configure, administer, secure, maintain and support AimyOne, aimyPlus and related applications; ● create and manage accounts, authentication, permissions and user profiles; ● process bookings, enrolments, attendance, communications, invoices, payments, subsidies and other programme-management workflows requested by an organisation or user; ● provide customer support, diagnose faults and respond to enquiries; ● maintain audit records, prevent fraud, monitor security and investigate misuse; ● improve service performance, reliability, usability and product functionality; ● conduct internal business planning, reporting, research and service analytics using information that is appropriately protected and, where practicable, aggregated or de-identified; ● administer billing, contracts and business relationships; ● comply with legal, regulatory, accounting, tax, audit or law-enforcement obligations; ● protect the health or safety of an individual or respond to an emergency where permitted by law; and ● send service communications and, where permitted, marketing communications. We do not treat acceptance of this Privacy Policy as blanket consent to all processing. Where consent is legally required - for example for particular uses of sensitive information, direct marketing or optional processing - we will seek consent in a form appropriate to the circumstances. Other processing may be based on contract, legal obligation, legitimate interests where that concept applies, or another lawful basis permitted by the relevant privacy law.

 

5. CHILDREN AND SENSITIVE INFORMATION

Our Service is used by organisations that provide services to children and young people. Information relating to children may therefore be collected and processed through the Service, including health, allergy, emergency-contact and incident information. Subscribing organisations are responsible for ensuring they have lawful authority to collect and provide that information to Aimy, including any parent, guardian or individual consent required by applicable law. Aimy will use sensitive information only for the purposes for which it was provided, for related purposes permitted by law, or where another legal exception applies.

 

6. COOKIES, ANALYTICS AND ONLINE TRACKING

Our websites and online services may use cookies, local storage and similar technologies to maintain sessions, remember settings, improve functionality, measure traffic, detect security issues and understand how our websites and services are used. We may use analytics providers such as Google Analytics or equivalent services. These providers may collect device, browser, IP-address and usage information and may process that information in countries outside your own. Where required by law, we will provide appropriate notice or consent options for non-essential tracking technologies. You can usually manage cookies through your browser or device settings. Blocking some cookies may reduce the functionality of the Service or website.

 

7. AGGREGATED AND DE-IDENTIFIED INFORMATION

We may create and use aggregated or de-identified information for service analytics, security, benchmarking, capacity planning, product improvement and other legitimate business purposes. We will take reasonable steps to ensure that such information does not reasonably identify an individual and will not intentionally attempt to re-identify it except where permitted by law for security, validation or compliance purposes. Aimy does not sell Personal Information to data brokers or direct marketers.

 

8. DIRECT MARKETING

\Where permitted by applicable law, we may send information about Aimy products, services, events or updates to business contacts or users who have consented or where another lawful basis permits the communication. Marketing emails will provide a way to unsubscribe, and you can also contact privacy@aimy.io. Unsubscribing from marketing does not prevent us from sending necessary service, security, billing or transactional communications.

 

9. WHEN WE DISCLOSE PERSONAL INFORMATION

We may disclose Personal Information where reasonably necessary to: ● the subscribing organisation that controls the relevant account or programme; ● Aimy affiliates, personnel and authorised contractors who need access to provide or support the Service; ● cloud hosting, communications, analytics, accounting, payment, identity, security, customer-support and other technology service providers; ● professional advisers, auditors, insurers and financial institutions where reasonably required; ● government agencies, regulators, courts, law-enforcement bodies or other persons where required or authorised by law; ● a buyer, investor or successor in connection with a proposed or completed merger, acquisition, restructuring, financing or sale of business or assets, subject to appropriate confidentiality and privacy protections; or ● another person where you or the relevant subscribing organisation has authorised the disclosure or where another legal exception applies.

 

10. CROSS-BORDER PROCESSING AND OVERSEAS DISCLOSURES

Aimy operates internationally and uses service providers that may store or process information in more than one country. Core platform systems may be hosted in New Zealand and Australia, and Personal Information may also be accessed or processed in other countries where Aimy affiliates, support personnel or service providers operate. For individuals in Australia, likely overseas recipients may include recipients in New Zealand, Singapore, the United States and other countries in which our contracted service providers operate. Because provider locations can change, Aimy maintains records of its material service providers and will update this Policy where it is practicable and appropriate to identify additional countries of likely disclosure. Where Australian APP 8 applies to an overseas disclosure, we will take reasonable steps required by that principle to ensure the overseas recipient handles the information consistently with the APPs, unless an exception applies. Where New Zealand Information Privacy Principle 12 applies to an overseas disclosure, we will use a permitted mechanism or appropriate contractual safeguards. Offshore storage or processing by a service provider acting solely on our behalf may be treated differently under applicable law from a disclosure to an independent overseas recipient.

 

11. SECURITY

We take reasonable technical and organisational measures to protect Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure. Measures may include access controls, authentication controls, encryption where appropriate, logging and monitoring, backup and recovery processes, security testing, staff training and controls over service providers. No system can be guaranteed to be completely secure, but we regularly review our safeguards having regard to the sensitivity of the information and relevant risks.

 

12. DATA BREACHES

We maintain processes for identifying, containing, investigating and responding to suspected privacy and security incidents. Where a breach meets the applicable legal notification threshold, we will notify the relevant regulator and affected individuals as required by law. In New Zealand, notifiable privacy breaches that have caused or are likely to cause serious harm must be notified as soon as practicable. In Australia, the Notifiable Data Breaches scheme requires regulated entities to assess suspected eligible data breaches and, where an eligible breach is established, notify the OAIC and affected individuals as required. Where a breach involves Subscriber Data, we will coordinate with the relevant subscribing organisation in accordance with our contract and applicable law.

​

13. RETENTION, DELETION AND BACKUPS

We retain Personal Information only for as long as reasonably necessary for the purpose for which it may lawfully be used, to provide the Service, comply with contractual or legal obligations, resolve disputes, maintain security and audit records, or establish and defend legal claims. Retention periods vary according to the type of information and the applicable contract. Subscriber Data may be deleted after termination in accordance with the relevant subscription or Services Agreement. Some information may remain in backups or disaster-recovery systems until overwritten or expired in the ordinary course, and some records may be retained longer where required by law. When Personal Information is no longer required, we take reasonable steps to delete, destroy or de-identify it, subject to applicable legal and technical requirements.

 

14. ACCESS, CORRECTION AND OTHER PRIVACY RIGHTS

Subject to applicable law, you may request access to Personal Information we hold about you and ask us to correct inaccurate or incomplete information. Depending on the law that applies, you may also have rights to request deletion, restriction, objection, portability or withdrawal of consent. If your request relates to Subscriber Data controlled by an organisation using AimyOne or aimyPlus, we may refer you to that organisation or work with it to respond. We may need to verify your identity before acting on a request. We will not charge a fee unless permitted by law and reasonable in the circumstances. Requests can be sent to privacy@aimy.io.

 

15. PRIVACY COMPLAINTS

If you believe we have mishandled your Personal Information, please contact our Data Protection Officer at privacy@aimy.io and describe your concern. We will acknowledge and investigate the complaint and aim to provide a substantive response within 30 days, or tell you if we reasonably need more time. If you are not satisfied with our response, you may be entitled to complain to the relevant privacy regulator. In New Zealand this is the Office of the Privacy Commissioner. In Australia this is the Office of the Australian Information Commissioner (OAIC). Other regulators may apply depending on where you are located.

 

16. AUTOMATED PROCESSING AND DECISION SUPPORT

Some Aimy features may automate administrative workflows, apply rules configured by a subscribing organisation, generate alerts, calculate values or provide recommendations. In general, the subscribing organisation determines the underlying programme rules and remains responsible for decisions it makes about individuals. Where Aimy is required by law to provide additional transparency about automated decision-making - including the Australian APP 1 requirements commencing on 10 December 2026 where applicable - we will describe the relevant kinds of Personal Information and decisions in this Policy or an appropriate collection notice.

 

17. GDPR AND OTHER INTERNATIONAL PRIVACY RIGHTS

Where the GDPR applies, individuals may have rights including access, rectification, erasure, restriction, objection, portability and withdrawal of consent. International transfers of Personal Information subject to the GDPR will be protected using an applicable adequacy decision, approved standard contractual clauses or another lawful transfer mechanism. If Aimy has appointed a representative or other contact required by applicable law, current contact details will be made available on our website or on request. Individuals in the EEA may also complain to their local supervisory authority.

 

18. THIRD-PARTY WEBSITES AND INTEGRATIONS

The Service may contain links to, or integrate with, third-party services. Those third parties may have their own privacy practices and terms. Aimy is not responsible for independent third-party handling of Personal Information outside Aimy’s control, although we take reasonable steps to assess providers that process Personal Information on Aimy’s behalf.

​

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in law, technology, our services or our information-handling practices. We will publish the updated Policy and its effective date and will take reasonable steps to notify users of material changes where appropriate. This Privacy Policy is a statement of our privacy practices; continued use of the Service is not treated as consent to processing where consent is legally required.

 

20. CONTACT US

Aimy Limited Data Protection Officer Level 3, 61 Constellation Drive, Rosedale, Auckland 0632, New Zealand Email: privacy@aimy.io

Last updated: September 2026