PRIVACY POLICY
Last updated: 15 October 2026
Who we are
Komplylab is operated by Enginiq Limited (NZBN 9429053018748), a company incorporated in New Zealand, registered address 23 Blacklock Road, Tauranga 3112, New Zealand. Komplylab provides a compliance and asset management software platform for industrial organisations in New Zealand and Australia, accessible at komplylab.com (the “Service”). This policy explains how we collect, use, store, and protect personal information when you use the Service.
Information we collect
When you or your organisation uses Komplylab, we collect: account information (name, email address, and organisation details, provided when you or your organisation signs up via our authentication provider, Clerk); billing information (processed directly by our payment provider, Stripe — we do not store your full card details ourselves); compliance and operational data you enter (asset records, inspection results, incident reports, contractor details, risk assessments, and similar information your organisation chooses to record in the Service); team member information (names, email addresses, roles, and, where applicable, licence/qualification records entered by your organisation for its own team management purposes); and usage information (standard technical logs such as IP address, browser type, and pages visited, collected automatically to help us maintain and improve the Service).
How we use this information
We use personal information to: provide and operate the Service, including compliance tracking, alerts, and reporting features your organisation has enabled; process payments and manage subscriptions; send you service-related emails, including compliance reminders, billing notices, and account communications; respond to support requests; maintain the security and integrity of the Service; and comply with our own legal obligations. We do not sell personal information to third parties.
Who we share information with
We share information with the following third-party service providers, each of which processes data on our behalf under their own privacy and security terms:
Clerk — user authentication and account management Stripe — payment processing and subscription billing Supabase — database hosting and storage Resend — transactional email delivery (reminders, notifications) Vercel — application hosting
Your data is processed in the following locations: Supabase (database hosting) and Vercel (application hosting) both run in Sydney, Australia. Resend (email delivery) runs in Tokyo, Japan. Clerk (authentication) and Stripe (payment processing) operate on standard US-based cloud infrastructure. Where personal information is processed outside New Zealand, we take reasonable steps to ensure it receives comparable protection, consistent with the Privacy Act 2020.
We may also disclose information if required by law, or to protect the rights, safety, or property of Komplylab or others.
Data retention
Data associated with your organisation’s account is retained for the duration of your active subscription. If a subscription lapses (through cancellation or payment failure), your organisation’s data is retained for up to 90 days to allow for reactivation, after which it may be permanently deleted from our systems.
Your rights
Under the Privacy Act 2020 (New Zealand), individuals have the right to: request access to personal information we hold about them; request correction of inaccurate personal information; and make a complaint to the Office of the Privacy Commissioner if they believe their information has been mishandled.
To exercise these rights, contact us at compliance@komplylab.com.
[CONFIRM: whether equivalent rights disclosures under Australian Privacy Principles are needed for Australian customers — genuine open legal question, not yet resolved]
Security
We take reasonable technical and organisational measures to protect personal information, including encryption in transit, access controls, and tenant data isolation between organisations using the Service. No system is completely secure, and we cannot guarantee absolute security.
Children’s information
The Service is intended for business use by adults. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated to account administrators.
Contact us
ENGINIQ LIMITED, trading as Komplylab 23 Blacklock Road, Tauranga 3112, New Zealand compliance@komplylab.com