Point Legal Limited

Privacy.

Version 1.3, 3 October 2026. Version 1.2 was published on 20 August 2026, version 1.1 on 19 August 2026 and version 1.0 on 1 July 2026. Section 7 describes the secure onboarding service, and from this version explains how it saves your answers as you go. Section 8 gives the biometric notice required by the Biometric Processing Privacy Code 2025.

This page explains how Point Legal Limited collects, uses, holds and protects your personal information. We take your privacy seriously, and we handle your information in accordance with the Privacy Act 2020.

1Who we are

Point Legal Limited is a law firm based in Birkenhead, on Auckland’s North Shore. In this page, “we”, “us” and “our” mean Point Legal Limited. We are the agency responsible for the personal information we hold about you.

2The information we collect

We collect the personal information we need to act for you, to run our practice, and to meet our professional and legal obligations. Depending on your matter, this may include:

• Your name, contact details and date of birth.
• Identity and address verification documents, which we are required to collect under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009.
• Information about your matter, your assets, your business and your family, where it is relevant to the work you have asked us to do.
• Financial and payment information, including bank account details for trust account transactions.
• Records of our communications with you, and information you provide to us during the course of a matter.

We collect most of this information directly from you. Where it is necessary for your matter, we may also collect it from third parties, such as other parties to a transaction, government registers, banks and other professional advisers.

3How we use your information

We use your personal information to:

• Provide legal services to you and act on your instructions.
• Verify your identity and meet our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and other applicable law.
• Manage our relationship with you, including billing and account administration.
• Check for conflicts of interest before we take on a matter.
• Comply with our professional duties and with any court or regulatory requirements.

4When we share your information

We treat your information as confidential. We do not sell it, and we do not share it for marketing. We will share your information only where it is necessary for your matter or required of us, for example with:

• Other parties and their advisers in a transaction or dispute, where you have instructed us to act.
• Government agencies and registers, such as Land Information New Zealand and the Companies Office.
• Banks, accountants, valuers and other advisers involved in your matter.
• Our service providers, including our practice management and identity verification systems, who are bound to keep your information secure.
• Courts, regulators and law enforcement, where we are required to do so by law.

5How we hold and protect your information

We hold your information in secure electronic systems and, where relevant, in paper files. We take reasonable steps to keep it safe from loss, misuse and unauthorised access. We keep your information for as long as we need it for your matter, and for as long as we are required to retain it under the Lawyers and Conveyancers Act 2006, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, and other applicable law. After that, we dispose of it securely.

6Our website

Most of this website is an information site. If you contact us through it, by email or by phone, we use your message and contact details only to respond to you. We do not run advertising on the site, and we do not use it to build a profile of you.

To understand how the site is used, we use a privacy-friendly analytics tool (GoatCounter) that records aggregate information only, such as how many people visit, which pages they view, which links they click, and the general region and device they use. It does not use cookies, and it does not collect or store any information that identifies you. It does not run on the onboarding pages described in the next section.

7The secure onboarding service

Clients we are acting for are asked to complete an onboarding questionnaire at pointlegal.co.nz/onboarding. This section is set out separately because that questionnaire collects more about you than the rest of the site does, and because it involves services other than our own.

How the page opens. You enter the email address we already hold for you, and we send a one-time sign-in link to that address. The link lasts one hour and works once. There is no password and no account to create. Being able to receive mail at an address we already hold is what shows us it is you, so please use the address your lawyer has been writing to. Nothing about you is stored in the page itself: your questionnaire is put together and sent to your browser only after that link has been used.

What it asks, and why we ask it.

• Your full legal name, date of birth, residential and postal addresses, mobile number and email address, so that we can act for you and so that we can complete the customer due diligence the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 requires of us.
• Your IRD number and your citizenship or residency status, which we are obliged to collect for the land transfer tax statement required by section 79 of the Land Transfer Act 2017, and which is passed to Land Information New Zealand and to Inland Revenue with that statement.
• Your occupation, which we record for our money laundering risk assessment, and so that we do not have to come back to you if a statutory declaration is needed later. It is not part of the tax statement.
• Whether you, or a close family member or close associate, hold or have recently held a prominent public function, which the same Act requires us to consider.
• Whether you have owned property before, including as a trustee, and your KiwiSaver provider, balance and timing, where you are making a first home withdrawal. Your provider will require a statutory declaration from you, and these answers are what let us tell you whether you qualify before you sign it.
• Anything else you choose to tell us about your matter.

Who else handles it. Three providers are involved, and each receives only what it needs.

• Netlify hosts this website, sends the one-time sign-in link on our behalf, and holds your completed answers until we copy them onto our own file. Netlify is a United States company, so while your answers sit there they are held on servers outside New Zealand. The link email is at present sent from a no-reply address at netlify.com, although the message itself is ours.
• Didit checks your identity, if that is the way you choose to do it. The form asks each person whether they would rather verify on their phone or in person with Tim, and if you choose in person then nothing goes to Didit at all. Section 8 below sets this out in full, because a photograph of your face needs its own notice.
• Addy suggests addresses as you type, when it is running. If it is, what you have typed into an address box is sent to Addy’s New Zealand service so that it can offer matching addresses. Nothing else you have entered on the form is sent to it.

How long your answers stay with Netlify. We copy your completed answers onto our own file for your matter, and once we have confirmed that copy we delete the one Netlify is holding. That happens within seven days, and usually on the same day. Our own copy is then held, used and disposed of as described in section 5.

Answers saved as you go. So that you can stop and come back, the questionnaire saves your answers securely with Netlify as you go, under your own sign-in, and keeps them only until you press Send or your invitation closes. Nobody at Point Legal looks at those saved answers until you press Send.

If something looks wrong. We will never ask you for a password for this service, and we will never ask you to send your IRD number or your date of birth by reply email or by text message. If a message that appears to come from us asks you to do either, stop and ring Tim Grace on 022 450 6258.

8The identity check, and the photograph of your face

This section is the notice required by the Biometric Processing Privacy Code 2025, which has applied to this kind of check since 3 August 2026. It is set out separately because a photograph of your face is more sensitive than the rest of what we hold, and because you have a choice about it.

What we do, and why. Before we can do the substantive work on your matter, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 requires us to be satisfied on reasonable grounds that you are who you say you are. If you choose the phone check, you photograph your identity document and then your own face, and the two photographs are compared automatically to confirm that you are the person shown in the document. The system also checks that a real person is present rather than a photograph of a photograph, that the document is genuine, and, on a passport, reads the chip inside it. That comparison is the only thing your face is used for.

You do not have to be photographed. The alternative is that Tim Grace verifies your original passport or driver licence in person. It is a real alternative, offered on equal terms, and you do not have to give a reason for choosing it. The onboarding form asks each person which they would prefer. If you choose in person, no photograph of your face is taken and nothing about your face is sent anywhere. If you would rather change your mind after choosing, ring Tim on 022 450 6258.

Whether you have to supply it at all. Verifying your identity is compulsory: we cannot act for you until it is done. Which of the two ways you use is entirely voluntary. If you supply neither, we cannot open your matter.

Who runs the check, and where your photographs go. The check is carried out for us by Didit, which trades as Didit Identity Spain, S.L., Calle Nápoles 227, P. 1, 08013 Barcelona, Spain, and Didit Identity, Inc., 1111B S Governors Ave STE 34855, Dover, Delaware 19904, United States. Didit acts on our instructions and reports the result to us. Your photographs are therefore held and processed outside New Zealand, and Didit is not required to protect them in a way that, overall, provides safeguards comparable to those in the Privacy Act 2020 and that Code. By choosing the phone check you authorise us to send them to Didit on that basis. If that is not acceptable to you, use the in-person alternative.

Who we are. The agency collecting this information, and the agency holding it, is Point Legal Limited, 10 Zion Road, Birkenhead, Auckland 0626.

What we keep, and for how long. We keep the result of the check and a copy of the identity document you presented, on your matter file, for as long as the anti-money-laundering and lawyers’ conveyancing rules require. We do not keep the photograph of your face and we do not keep any face template. Didit holds the material from your session under a retention period we set in its console, and we delete your individual session once the result is recorded on your file. We do not use your face for anything other than this one check: not to search for you among other faces, not to log you in later, and not to estimate your age or anything else about you.

Your rights. You may ask us to confirm whether we hold biometric information about you, what type it is, and for access to it, and you may ask us to correct it. Section 9 below explains how, and the same rights apply to everything else we hold.

If you are not happy about it. Please raise it with Tim Grace directly, on 022 450 6258 or at tim@pointlegal.co.nz, and he will deal with it himself. You may also complain to the Office of the Privacy Commissioner about anything the Code covers, using the details in section 10.

The assessment behind this. The Code requires us to assess, before we collect biometric information, whether the check is necessary, whether the same purpose could be achieved as effectively in a way with less privacy risk, what safeguards we have put in place, and whether the whole thing is proportionate. We have done that assessment and it is what led us to offer the in-person alternative on equal terms. This section is the summary of it, and the full assessment is available on request: ask Tim and he will send it to you.

9Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong. Please contact us using the details below. We will respond as soon as we reasonably can, and within the timeframes set by the Privacy Act 2020. In some cases the law allows us to withhold information, for example where it is subject to legal professional privilege or relates to another person.

10Contact and complaints

If you have a question about your privacy, or you would like to access or correct your information, please contact Tim Grace, Director, at tim@pointlegal.co.nz.