Privacy & Cookie Policy

We may collect and process the following personal information about you when you request mortgage adviser services, lead services, or information from us:

• Information provided by completing forms on our sites, including contact details (name, email, postal address), financial information (income, expenses, assets, liabilities, mortgage details), unique identifiers (username, account number, password) and preferences.
• Where you engage with a mortgage adviser through our services, information about your property and financial position such as property type, location, valuation and loan-to-value ratio.
• Information you provide when you write to us, including by email.
• Information shared with us by telephone. We may make and retain a record of that conversation.
• Responses to surveys we conduct.
• Details of transactions you carry out through our sites, including adviser credit top-ups and lead purchases.
• Information obtained from third parties in accordance with this policy, for example verification of adviser registration details or property details via relevant registries.

We also automatically gather technical data such as IP addresses, browser type, operating system, referring pages and clickstream data for site administration and analytics. This data does not identify individual users.

In accordance with the Privacy Amendment Act 2025 and Information Privacy Principle 3A, which came into force on 1 May 2026, we are required to notify you when we collect your personal information from a source other than you directly.

We may collect your personal information indirectly from sources such as:

• Real estate agents, valuers or property data services
• Lenders, banks or other financial institutions
• Government registries, for example Land Information New Zealand and the Companies Office
• Referral partners, introducers and calculator or enquiry websites
• Publicly available sources

When we collect your personal information indirectly, we will take reasonable steps to ensure you are made aware of:

• The fact that your information has been collected and the source it came from
• The name and address of the agency collecting and holding the information
• The purposes for which the information is being collected
• The intended recipients of the information
• Whether providing the information is required by law, and if so which law
• Your right to access and correct your personal information

Notification will be provided as soon as reasonably practicable after collection. In some cases IPP 3A exceptions may apply, for example where you have already been made aware of the collection, or where notification would be impracticable or undermine a lawful purpose. We will document our basis for relying on any exception.

We use the information we hold about you for the following purposes:

• To present content on our sites in the most effective way for you.
• To allow a mortgage adviser to understand your situation so they can provide you with advice.
• To provide the mortgage information, products or services you request from us, where you have consented to be contacted.
• To fulfil our obligations under any contract between you and us.
• To notify you about changes to our services.
• To assess the suitability of an enquiry for adviser follow-up.
• To comply with our legal and regulatory obligations, including obligations under the Financial Markets Conduct Act 2013 and the Credit Contracts and Consumer Finance Act 2003.

Where you have asked for adviser assistance, we may use your information to identify an appropriately matched mortgage adviser and to provide that adviser with the relevant information they need to respond to you. We may also contact you by electronic means or mail about services similar to those you have asked for, and you can ask us to stop at any time.

If you do not wish us to use your information for marketing, or to pass your details to third parties, please contact us at info@riverhorse.io or refer to the "Access and your choices" section below.

We share your personal information with third parties only in the ways described in this policy. This includes providing relevant authorised information to a mortgage adviser who will use it to respond to your request and advise you on your mortgage situation. We may charge that adviser a fee for access to the opportunity or introduction, as explained in section 03B. We do not sell personal information as a commodity.

We may disclose personal information to members of our corporate group, including subsidiaries and our ultimate holding company. We may also disclose your information to third parties in the following circumstances:

• If we sell or purchase any business or assets, we may share your information with the prospective buyer or seller.
• If Riverhorse Technologies Limited or substantially all of its assets are acquired by a third party, personal information held about customers will form part of the transferred assets.
• If we are legally required to disclose your information, or to enforce our terms, or to protect the rights, property or safety of Riverhorse Technologies, our customers or others, including sharing information for fraud prevention and credit risk reduction.
• To lenders, banks, mortgage advisers and other financial institutions as necessary to provide our services to you.
• To service providers who help us operate ClientConnection, including hosting and database providers, email and text message delivery providers, and payment providers. They may only use the information to provide those services to us.

We may share your information with companies that help us run our business. Those companies are only authorised to use your information as necessary to provide those specific services.

We do not disclose information about identifiable individuals to advertisers, but we may share aggregate, anonymised statistics about our users.

Where we share your information with third parties who will themselves collect, hold or use it, we will ensure those parties are identified in this policy or in a specific notice to you, in compliance with IPP 3A.

Where you have consented to be contacted about your mortgage enquiry, we pass your information to one approved New Zealand mortgage adviser so that adviser can contact you and discuss your options. Your enquiry is provided to that adviser only. It is not sold to multiple advisers, and it is not shared with any other adviser or lead buyer.

We then email you to tell you which adviser has received your information, so you know who will be contacting you. That email includes:

• The adviser's name.
• The adviser's company or adviser business.
• The adviser's phone number.
• The adviser's email address.
• Where relevant, a copy of the graph and the potential savings prepared from the information you gave us.

Any graph, figure or potential saving we show you is based only on the information you have provided to us and on indicative published lender rates at that time. It is indicative only. The final outcome will only become known once the adviser has discussed your options with you. It is not financial advice and should not be relied on as financial advice.

The adviser who receives your information must contact you only through the methods you consented to, must stop contacting you if you ask them to, and must handle your information in accordance with the Privacy Act 2020.

If you would prefer your information was not passed to an adviser, contact us at info@riverhorse.io before an adviser makes contact and we will remove your enquiry.

We want to be clear about how ClientConnection.io operates commercially, because you are entitled to understand why your information is provided to an adviser.

Where you have asked for mortgage or adviser assistance, Riverhorse Technologies Limited may provide relevant information you have authorised to an appropriately matched or selected New Zealand mortgage adviser, so that adviser can respond to your request and help you.

Riverhorse may charge an adviser, or an adviser business, a fee for access to an adviser opportunity, for the introduction, or for related ClientConnection services. That fee is paid by the adviser. There is no cost to you.

• We do not sell databases or lists of personal information as a commodity.
• Your enquiry is provided to one adviser at a time, not distributed to multiple buyers.
• Before an adviser secures an opportunity, your name, email address, mobile number and street address are withheld from them.
• Your full details are released only through the authorised opportunity workflow, and that release is recorded.

The existence of a commercial arrangement with an adviser does not expand the purposes for which your information may be used or disclosed. Your information is still only disclosed consistently with your request, your recorded authority and this policy.

We keep a record of the authority or permission you gave, including what you agreed to, when, and through which form or channel, so we can demonstrate the basis on which your information was provided to an adviser.

Under the Privacy Act 2020 you have the right to access and correct personal information we hold about you. If your personal information changes, or you no longer wish to use our services, you may correct, update, amend or request deletion of your information by:

• Updating your details in your account settings.
• Emailing us at info@riverhorse.io.
• Contacting us by post at the address in the contact section.

We will respond to access requests within 20 working days, as required by the Privacy Act 2020. A fee may apply to cover the reasonable cost of providing details of the information we hold about you, and we will advise you of any fee before processing your request.

We retain your information for as long as your account is active or as required to provide services. Where financial data is collected and processed, we may retain records for up to seven years to meet our legal obligations under applicable financial and tax legislation.

You may unsubscribe from our newsletters or marketing emails at any time by following the unsubscribe link in the email, updating your account preferences, or contacting us at info@riverhorse.io.

You also have the right to ask us not to process your personal information for marketing purposes at any time. You may make a complaint to the Office of the Privacy Commissioner (www.privacy.org.nz) if you believe we have interfered with your privacy.

We may collect information about your device, including IP address, operating system and browser type, for system administration. This is statistical data about browsing behaviour and does not identify individuals.

We use cookies, small files stored on your device, to improve our sites and deliver a personalised experience. Cookies enable us to:

• Estimate our audience size and usage patterns.
• Store your preferences and customise the site to your interests.
• Speed up your searches.
• Recognise you when you return to our sites.

You may refuse cookies by adjusting your browser settings, though doing so may limit access to parts of our sites. Unless you adjust those settings, our system may issue cookies when you log on.

Cookies set by our partners, affiliates, advertisers or service providers are not covered by this policy. We do not have access to or control over those cookies.

Information we collect may be transferred to, and stored at, a destination inside or outside New Zealand. It may also be processed by staff operating inside or outside New Zealand who work for us or our suppliers, for example in fulfilling service requests, processing applications or providing support services.

By submitting your personal information you agree to this transfer, storage and processing. We take all steps we consider reasonably necessary to ensure your information is treated securely and in accordance with this policy. Where information is transferred overseas, we take steps to ensure the overseas recipient is subject to privacy obligations comparable to those in New Zealand, in accordance with Information Privacy Principle 12 of the Privacy Act 2020.

All information provided by email or through our sites is stored on secure servers. When you enter sensitive information such as financial details, we encrypt the transmission using transport layer security.

Where you have a password to access parts of our sites, you are responsible for keeping it confidential. Please do not share your password with anyone.

We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse or disclosure. In plain terms: access to personal information is restricted according to role and purpose, customer identity and contact information is masked from advisers before the appropriate entitlement exists, full customer information is released only through the authorised opportunity workflow, adviser and administrative access is authenticated, appropriate database access controls are applied, sensitive server credentials are kept out of ordinary browser code, and important system actions and handoffs are recorded so they can be audited.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we follow generally accepted standards to protect your information during transmission and once received.

In the event of a privacy breach that is likely to cause serious harm to individuals, we will notify affected individuals and the Office of the Privacy Commissioner as soon as practicable, in accordance with our obligations under the Privacy Act 2020. For security questions, contact us at info@riverhorse.io.

Links to third-party sites. Our sites may contain links to websites operated by our suppliers, partners, advertisers, affiliates and other third parties, including CalcStudio. We are not responsible for the privacy practices or content of those websites. Please review their policies before submitting any personal information.

Social media features. Our sites may include social media features such as sharing buttons. These features may collect your IP address, record which page you are visiting and set a cookie to function. Your interactions with these features are governed by the privacy policy of the company providing them.

Single sign-on. You may be able to log in using a third-party sign-in service. This authenticates your identity and may give you the option to share personal information, such as your name and email address, to pre-populate our sign-up form.

Privacy Officer. Riverhorse Technologies has appointed a Privacy Officer to oversee compliance with the Privacy Act 2020 and this policy. If you have any concerns or queries about how we handle your personal information, you may contact our Privacy Officer at info@riverhorse.io.

We may update this policy from time to time to reflect changes in our information practices or in applicable law. If we make any material changes we will notify you by email, sent to the address on your account, or by posting a notice on this site before the changes take effect.

We encourage you to review this page periodically for the latest information on our privacy practices.

Questions, comments or requests regarding this privacy policy are welcome. If you believe your privacy rights have been interfered with, you may also contact the Office of the Privacy Commissioner at www.privacy.org.nz or by calling 0800 803 909.

• Riverhorse Technologies Limited
• Office: Soho Offices, Suite 1, 142 Hurstmere Road, Takapuna, Auckland
• Postal: PO Box 33-1263, Takapuna, Auckland 0740
• Email: info@riverhorse.io
• Office hours: Monday to Friday, 9:00 am to 5:00 pm. Closed weekends and public holidays.