Privacy policy

Last updated: 30 October 2026

Who we are

Good to Go Digital Ltd trading as ihub provides the ihub website, web dashboard, mobile app and related services. This policy explains how we handle personal information in connection with those services.

Our Privacy Officer is Joel Wilkinson. Contact Joel at joel@goodtogo.nz or +64 27 684 2004 about privacy questions, requests, complaints or suspected privacy incidents.

What we collect and why

We collect and use personal information as reasonably necessary to conduct our business and provide, administer, support and secure the service, process payments and orders, communicate with customers and meet legal obligations. Collection and use must also be permitted by applicable privacy law.

Depending on the features used, information may include account and contact details; organisation membership and permissions; site attendance and location records; equipment and vehicle allocations; qualifications and certifications; installation inspections, notes and photos; safety and incident records; billing and transaction information; support communications; and technical or diagnostic information. These are examples, not an exhaustive list. Any other collection or use must be reasonably necessary for a lawful purpose connected with our business or services.

Information may come from you, your employer or another organisation you work with, authorised users, participating testers, service providers or your use of ihub. Some information is needed to operate your account or a requested feature; without it we may not be able to provide that functionality.

Your organisation and access to records

Authorised users and administrators may see information according to their organisation’s permissions. Employers and other customer organisations are responsible for their own lawful use of workplace records and for informing people about their collection and use. When an employer adds an employee, the employee receives a signup invitation. Where required, appropriate privacy information must also be provided to the person concerned.

Leaving an organisation or closing an account does not necessarily remove workplace records the organisation lawfully needs to retain. Where we hold information solely on an organisation’s behalf, we will assist with requests or direct them to that organisation as appropriate.

Storage, passwords and payments

Customer records are stored in databases and, for uploaded files, associated storage systems. We take reasonable security measures to protect personal information from loss, misuse and unauthorised access or disclosure. Account passwords are stored as password hashes, not plain text. No internet service can guarantee absolute security.

Credit-card storage and payment processing are handled by PayPal Braintree. ihub uses payment tokens or references and billing and transaction information to administer payments. We do not use ihub as a store for full credit-card numbers or security codes. Limited card information, such as masked card details, may be available for billing and support.

Service providers and overseas processing

We use providers for hosting, database and file storage, communications, payments and technical support. Providers used for these functions include Heroku (hosting and databases), Amazon Web Services (file storage), Twilio SendGrid (email), PayPal Braintree (payments), Google Firebase (notifications and analytics where enabled), Rollbar (error reporting where enabled) and YouTube (embedded videos).

We may add, replace or discontinue providers without individual notice or separate approval for routine changes. Provider changes must remain consistent with this policy and applicable law. We will update relevant policy information as appropriate and provide any notice or authorisation required by law or an applicable agreement.

Our primary customer database is hosted by Heroku in the United States. Other service providers may store or process information in other countries. We take reasonable steps to ensure appropriate privacy and security safeguards apply. We remain responsible for obligations that apply when providers act on our behalf. Where an overseas disclosure is subject to specific legal requirements, we will meet those requirements, including appropriate safeguards or informed authorisation where required.

We may disclose information as reasonably necessary to provide the service, with appropriate authorisation, or as otherwise permitted or required by law. A business sale or transfer may involve information being transferred subject to applicable privacy obligations. We do not sell personal information for third-party marketing.

Browser storage, devices and communications

The service may use cookies, browser storage, device identifiers and technical logs as reasonably necessary for functionality, security, diagnostics and service operation. For example, browser storage supports sessions, organisation selection and shopping-cart functions. Mobile analytics and notifications depend on the features enabled. Embedded content may send technical information to its provider.

Device permissions, such as camera or location access, may be needed for selected functions. Location information is collected only while the app is actively in use; we do not collect location information while the app is running in the background or is closed. You can manage browser storage and device permissions through your settings, although this may affect related features.

Promotional messages will provide a way to unsubscribe, and we will action unsubscribe requests within five working days. Essential service, security and account messages are separate from marketing.

Retention and deletion

We retain personal information for as long as reasonably necessary for a purpose for which it may lawfully be used. Seven years of inactivity in an organisation’s ihub account is the maximum retention period under our inactivity policy. Records may be deleted sooner upon request or when they are no longer reasonably necessary for a lawful purpose. Any retention beyond that maximum is limited to what applicable law requires; we will explain any such requirement when responding to a deletion request. We assess individual records and deletion requests separately from account inactivity.

Deletion is handled manually. Submit a request through our data deletion request page, or contact Joel. We may verify your identity and authority, clarify the scope of the request and coordinate with the organisation responsible for workplace records. We will explain any records that must be retained and why. Deletion is not necessarily immediate; residual backup copies may remain until securely removed or overwritten.

Access, correction and complaints

You can ask Joel for access to personal information we hold about you or request a correction. We may need to verify your identity. We respond as soon as reasonably practicable and within applicable legal timeframes, generally 20 working days for New Zealand access and correction requests, subject to lawful extensions. If we refuse a request, we will explain the reason and available options. If a correction is declined, you can ask for a statement of the correction sought to be attached.

Deletion and export requests are assessed according to applicable law, the records involved and our role. Any additional rights that apply under relevant law remain available.

Contact Joel first with any complaint. If you are not satisfied, you may contact the New Zealand Office of the Privacy Commissioner.

Privacy incidents and changes

Joel coordinates assessment, containment, investigation and remedial action for privacy incidents. If a breach has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and affected people as soon as practicable, unless a lawful exception applies.

We may update this policy as our practices or requirements change. The date above identifies the latest revision. We will give appropriate notice of material changes and obtain any authorisation required by law.