Privacy Policy
Cello Group Limited
1. About This Policy
Cello Group Limited (Cello), together with its Related Companies (as defined in section 2(3) of the Companies Act 1993), are committed to protecting the privacy of individuals whose personal information we collect and hold. References in this Policy to we, us, or our include GKC Limited (GKC) and other Related Companies where relevant. References to Cello or GKC are references to those entities specifically.
For the avoidance of doubt, although this Policy refers to Cello and GKC collectively as 'we', 'us', or 'our', each remains a separate legal entity for the purposes of the Privacy Act 2020. Personal information shared between Cello and GKC is disclosed in accordance with the Related Companies basis set out in clause 5.
This Privacy Policy describes our general privacy practices – it explains how we collect, use, store and disclose personal information in connection with:
- your use of our website at www.cello.co.nz or GKC's website at www.gkc.co (each a Website);
- our provision of services to customers; and
- engagement with suppliers, partners, Related Companies and other professional advisers.
Despite the general practices set out in this Policy, where we have specifically agreed with a customer or other party a different approach to the collection, use, disclosure, or purpose of personal information, including more prescriptive confidentiality or information-handling requirements, that agreement will apply to the extent of any inconsistency with this Policy, provided that it does not result in a lower standard of protection for individuals than is required under the Privacy Act. For example, where a customer has specific confidentiality requirements, we may deliberately limit the personal information we collect or use, compared to what is otherwise described in this Policy.
This Policy is issued in accordance with the Privacy Act 2020 (New Zealand) (Privacy Act). By using our Website or engaging with us, you acknowledge the practices described in this Policy.
2. What Personal Information We Collect
Personal information is any information about an identifiable individual.
We may collect the following types of personal information:
- Contact and identity details – names, job titles, business addresses, telephone numbers and email addresses.
- Enquiry and correspondence information – information you provide when you contact us through our Website, including via our contact form.
- Expression of interest information – if you register an interest in working with us, we will collect relevant professional details such as your CV, work history and qualifications.
- Gated content registrations – if you register to access content such as white papers or technical resources, we will collect your name, email address, and organisation.
- Marketing preferences – your communication preferences, and information about how you engage with our marketing communications and events.
- Website usage data – if you access our Website, we may collect technical information such as your IP address, browser type, pages visited and visit duration, including through cookies and analytics tools (see clause 7 below).
- Customer and supplier contact data – names, contact details and professional information of individuals at customer and supplier organisations, collected in the course of providing or receiving services.
We do not intentionally collect sensitive personal information (such as health, financial or identity document information) through our Website or standard business engagement. If you provide such information to us for a specific purpose, we will handle it in accordance with this Policy and the Privacy Act.
3. How We Collect Personal Information
We collect personal information:
- directly from you, when you complete a contact or registration form on our Website, correspond with us by email or phone, or engage with us in the course of business;
- directly from you or indirectly from your organisation, when you are a contact person in a contract or business (or prospective business) relationship with us or a Related Company;
- indirectly from Related Companies, where that information relates to the customers, suppliers, or other contacts of that Related Company;
- from publicly available sources, such as company websites, LinkedIn and business registers, where relevant to establishing or maintaining a business relationship;
- automatically, through your use of our Website via cookies and analytics tools (see clause 7); and
- automatically, through software tools (including artificial intelligence functionality within our customer relationship management systems) that identify, verify, or update information about existing business contacts, drawing on publicly available sources or internal systems.
4. Why We Collect and Use Personal Information
We collect and use personal information for the following purposes:
- to respond to enquiries submitted via our Website or by other means;
- to provide and manage the products, services and licences we supply to customers;
- to communicate with customers, suppliers, partners and professional advisers about our services, proposals and contractual obligations;
- to send invoices and manage payments and accounts;
- to consider expressions of interest and applications for employment or contracting roles;
- to provide access to gated content or resources you have requested;
- to comply with our legal and regulatory obligations;
- to protect the security of our systems, networks and premises;
- to develop and improve our products and services, including by considering feedback and insights provided by customers;
- to send you information about our products, services, events and resources that may be of interest to you, and to tailor that information to your role, organisation and interactions with us; and
- to improve our Website and understand how it is used.
We will not use your personal information for other purposes without your consent, unless required or permitted by law.
We send marketing communications in accordance with the Unsolicited Electronic Messages Act 2007. We may use tools to manage these communications and to understand how recipients engage with them, for example whether an email has been opened. You can opt out of marketing communications at any time by using the unsubscribe link in any marketing email, or by contacting us at the details in clause 9. Opting out will not affect service-related communications, such as those about your contract, account or the services we provide.
5. Disclosure of Personal Information
We may share your personal information with:
- our employees and contractors who need it to carry out their roles;
- network operators, resellers, partners and subcontractors who assist in the delivery of our services;
- third-party service providers who support our business operations (such as IT systems, cloud platforms and professional advisers), who are required to handle personal information in accordance with our instructions and applicable law;
- regulatory and law enforcement agencies, where required by law;
- Related Companies, for purposes connected with the management, administration, reporting and operation of our group of companies; and
- other parties with your consent.
We take reasonable steps to ensure that third parties to whom we disclose personal information protect it in a manner consistent with the Privacy Act.
Cello's information is primarily stored and processed in New Zealand. Some information is held in Australia, where Cello uses third-party platforms subject to privacy or data protection standards broadly comparable to the Privacy Act.
GKC's information is primarily stored and processed in Australia and the United States, through third-party platforms including HubSpot, Projectworks, Xero, and Jira. A small amount of GKC's information may also be processed in Europe through some of these platforms.
6. Security and Retention
Cello holds ISO 27001 certification for information security management.
GKC applies two-factor authentication and role-based access controls.
We apply appropriate technical and organisational measures to protect personal information from unauthorised access, disclosure, alteration or loss.
We retain personal information for as long as is necessary for the purpose for which it was collected, or as required by law. In general:
- customer and supplier contact information is retained for the duration of the relevant business relationship and for a reasonable period after it ends;
- enquiry and registration information is retained for a period appropriate to the nature of the enquiry; and
- expression of interest and employment application information is retained for a period of up to 12 months from receipt, unless an ongoing employment relationship results.
When personal information is no longer required, we securely destroy or de-identify it.
7. Cookies and Website Analytics
Our Websites use cookies and analytics tools to collect information about how visitors use the site. This may include your IP address, browser type, pages visited and time spent on the site.
Cello uses the following tools:
- Google Analytics, to understand how visitors navigate and engage with our Website. For information on how Google handles this data, see https://policies.google.com/privacy.
- Webflow, our website hosting platform, which also collects certain technical and usage data as part of its standard operation. For further information, see https://webflow.com/legal/privacy.
When you first visit Cello’s Website, you will be asked to consent to the use of non-essential cookies. You can accept or decline. You can also control cookies through your browser settings, though disabling cookies may affect the functionality of some parts of the Website.
GKC's Website uses:
- Google Analytics, to understand how visitors navigate and engage with the Website. For information on how Google handles this data, see https://policies.google.com/privacy.
- Cloudflare Turnstile, a security tool on our contact form that helps distinguish genuine visitors from automated bots. It collects limited technical information about your browser and device for that purpose. For further information, see https://www.cloudflare.com/privacypolicy.
8. Your Privacy Rights
Under the Privacy Act, you have the right to:
- access personal information we hold about you (subject to limited exceptions); and
- request correction of personal information that is inaccurate or out of date.
To make a request, please contact us at the details in clause 9. We may ask you to verify your identity before responding.
If you have concerns about how we have handled your personal information and are not satisfied with our response, you may contact the Office of the Privacy Commissioner at www.privacy.org.nz.
9. Contact Us
For privacy-related enquiries, requests or complaints, please contact: legal.counsel@cello.co.nz, Legal Counsel, Cello Group Limited Level 1, 100 Tory Street Wellington 6011.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Each version will be dated, and the current version will always be available on our Website.
Version: 2.1
Last updated: 28 September 2026
How to get in touch
If you have any questions about this privacy, please contact our Legal