Privacy Policy

Introduction

Personal Information means information about an identifiable individual, for example, your name and contact details (Personal Information). If an individual cannot be identified from information (for example, where it is aggregated and anonymised), that information is not Personal Information and this Privacy Policy does not apply to it.

By providing us with your Personal Information and/or using our Online Services, you consent to the collection, storage, use and disclosure of your Personal Information in accordance with this Privacy Policy.

This Privacy Policy is governed by New Zealand law and we comply with Applicable Privacy Laws, including the New Zealand Privacy Act 2020 (NZPA). For more information about privacy in New Zealand, visit the Privacy Commissioner’s website at www.privacy.org.nz.

Unless otherwise defined in this Privacy Policy, terms have the same meaning as in our Terms and Conditions (available at blossum.nz) (Terms).

What information do we collect?

Information you provide directly

You may give us Personal Information about yourself when you register on our website, use the Investor Portal, make or consider an investment, contact us via enquiry forms or email, or otherwise interact with our Online Services. This may include:

• your name, addresses, contact details, date of birth, place of birth, tax identification number, tax residency status and citizenship;
• bank account details and financial and personal circumstances, including your source of funds (and in some cases evidence of this), and transactional and financial information relating to your user account;
• documents that verify your identity and other personal details; and
• in the case of prospective employees, occupation, employment history and/or details, education and qualifications, testimonials and feedback.

If you don’t want to provide your Personal Information, you don’t have to, but it may restrict the function of some parts of our Online Services.

Information collected from your use of our Online Services

When you visit our website or Investor Portal, we automatically collect certain information, including:

• clickstream data: a record of how you navigate or click through our Online Services;
• the address of your internet service provider and the web page that directed you to us;
• usage and performance data collected through platform-specific tracking technologies; and
• information obtained through cookies, web beacons and similar storage technologies (see Cookies and Tracking below).

Whenever you lodge a support query using our “Help” or “Contact us” features, we collect your name and email address in order to respond to you.

Information received from third parties

We may receive Personal Information about you from third parties, including:

• third-party affiliates, partner companies, marketing or advertising companies;
• identity verification and security service providers;
• third parties for the purposes of our anti-money laundering and sanctions compliance obligations (for example, an employment reference); and
• publicly available sources and websites.

We may combine information received from third parties with other information we hold about you.

Providing information about another person

If you provide us with Personal Information about another individual, for example, an authorised signatory, trustee, director, beneficial owner, or Investment Entity representative, please ensure that person is aware of this Privacy Policy and understands how their Personal Information may be collected, used and shared by us. By providing us with another person’s Personal Information, you confirm that you have their authority to do so, and that they have been informed of, and consent to, the collection, use and disclosure of their Personal Information in accordance with this Privacy Policy.

Indirect collection of your Personal Information (IPP 3A)

Under the Privacy Amendment Act 2025, which came into force on 1 May 2026, a new Information Privacy Principle (IPP 3A) requires agencies to notify individuals when their Personal Information has been collected from a source other than the individual themselves (indirect collection). This section explains when and how we collect your Personal Information indirectly, and what we are required to tell you about that collection.

When we collect your Personal Information indirectly

We collect your Personal Information indirectly (i.e. from sources other than you) in the following circumstances:

• Identity verification and AML/CFT compliance: we check your identity against government databases including the New Zealand Department of Internal Affairs, the New Zealand Transport Agency, and the Document Verification Service maintained by the Commonwealth of Australia. We also collect information from third parties to fulfil our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act) and the Financial Markets Conduct Act 2013, including source of funds verification and sanctions screening. Collection of this information is authorised or required by the AML/CFT Act, the Financial Markets Conduct Act 2013, the Identity Verification Code of Practice, and other applicable law.
• Credit and financial checks: we may collect information from credit reporting agencies or financial institutions to assess investor eligibility or to fulfil our legal obligations.
• References and professional background: for prospective employees, we may collect information from employment referees or professional background check services.
• Marketing and analytics: we may receive information about you from third-party affiliates, partner companies, and marketing or analytics providers to help us improve our services and communicate relevant information to you.

What we are required to tell you (IPP 3A matters)

Where we collect your Personal Information indirectly, we are required to take reasonable steps to ensure you are aware of the following matters as soon as reasonably practicable after collection:

• The fact that the information has been collected: this Privacy Policy, together with our Terms and Conditions, serves as our primary means of notifying you of indirect collection. Where we collect information indirectly at the time you engage with us (for example, during onboarding), we will also notify you through our registration and onboarding process.
• The purpose of the collection: the purposes are set out in the “How do we use your Personal Information?” section of this Privacy Policy and include identity verification, AML/CFT compliance, investor eligibility assessment, fraud prevention, and administration of your User Account and investments.
• The intended recipients of the information: the recipients are set out in the “Who do we share your Personal Information with?” section of this Privacy Policy. For identity verification, recipients include government agencies such as the New Zealand Department of Internal Affairs, the New Zealand Transport Agency, and the Commonwealth of Australia Document Verification Service.
• The name and address of the agency collecting and holding the information: Blossum Private Wealth Trust Limited, contactable at info@blossum.nz or via www.blossum.nz.
• Where collection is authorised or required by law, which law: where applicable, collection is authorised or required by the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, the Financial Markets Conduct Act 2013, the Identity Verification Code of Practice issued under the Privacy Act 2020, the Income Tax Act 2007 (for FATCA compliance), and other applicable legislation.
• Your right to access and correct your information: you have the right to request access to, and correction of, Personal Information we hold about you, including information collected indirectly. See the “Your Rights” section below and contact us at info@blossum.nz to make a request.

Exceptions to the notification requirement

In some circumstances, we are not required to notify you of indirect collection. These include where: you have already been made aware of the collection (for example, through our onboarding process or our Terms and Conditions); the information is publicly available; notification would prejudice the purpose of collection (for example, a fraud investigation); or notification is not reasonably practicable in the circumstances. We will rely on these exceptions only where genuinely applicable.

How do we use your Personal Information?

We will not process Personal Information without a lawful basis to do so. We may use your Personal Information (and may authorise third parties to do so) for the following purposes:

Providing and operating our services

• to create, manage and administer your User Account within the Investor Portal;
• to review your eligibility to create or continue to use a User Account;
• to process your application to become an investor, including transfers, deposits, payments, generating reports and record keeping of investment portfolios;
• to provide our Online Services and carry out our obligations under the Terms;
• to bill you and collect money that is owed; and
• to administer your account and for our own internal purposes such as risk management, staff training and billing.

Identity verification and compliance

• to verify your identity, including checking against governmental databases such as the National Register of driver licences, databases maintained by the New Zealand Department of Internal Affairs, the New Zealand Transport Agency, and the Document Verification Service maintained by the Commonwealth of Australia;
• to identify, prevent or investigate any actual or suspected fraud, unlawful activity or threats to our systems;
• to comply with our legal obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), the Financial Markets Conduct Act 2013, FATCA and general tax regulation; and
• to comply with any notification, reporting or access direction obligations imposed on us by a Government agency, law enforcement agency or regulatory authority.

Communications

• to communicate with you, including responding to feedback and information requests, notifying you of technical difficulties, and alerting you to new features or developments;
• to send administrative messages, reminders, notices, updates, security alerts, and other information relevant to your use of our Online Services;
• to keep you informed of investments we consider may be of interest to you, unless you ask us not to; and
• to send you marketing and promotional messages and information where you have consented to receiving such material. You can opt out at any time by using the unsubscribe link in any marketing communication, or by contacting us at info@blossum.nz.

Improving our services

• to develop, improve, manage and facilitate our Online Services and make them more available and user friendly;
• to analyse and report on usage of our Online Services; and
• to conduct market research.

Legal and protective purposes

• to protect and/or enforce our legal rights and interests, including defending any claim; and
• for any other purpose permitted by law, or that you authorise.

We may also process your Personal Information for purposes compatible with those described above. We may anonymise and aggregate information such that no person could be re-identified. This aggregated data is not Personal Information and this Privacy Policy does not apply to it.

Who do we share your Personal Information with?

We do not sell, trade or rent your Personal Information to others. However, we may disclose your Personal Information to:

• your professional advisers, authorised signatories and agents;
• other members of the Blossum group, including related companies and affiliates;
• service providers and suppliers who perform services on our behalf (including identity checks, mail, payment processing, credit checks and debt recovery). They will have access to Personal Information needed to perform those services, but we will not authorise them to use it for other purposes;
• any business that hosts or maintains our software, IT systems or data centres;
• government and identity verification databases, including the New Zealand Department of Internal Affairs, New Zealand Transport Agency, and the Commonwealth of Australia Document Verification Service;
• our professional advisers (such as lawyers), banks and other financial institutions, as part of our obligations when paying or receiving funds;
• reputable third parties for statistical purposes (in aggregated, non-identifiable form);
• anyone who assists us to identify, prevent or investigate fraud, unlawful activity or threats to our systems;
• a person or entity legally empowered to require us to supply Personal Information, such as a Government agency, regulatory authority or law enforcement agency;
• a third party in connection with a sale, merger, consolidation, liquidation, reorganisation or acquisition of our business; and
• any other person or entity authorised by you.

Where we disclose your Personal Information to overseas recipients, we ensure those recipients are required to protect it in a way that provides comparable safeguards to those in the NZPA.

Overseas transfers of Personal Information

Blossum is located in New Zealand and operates under the New Zealand Privacy Act 2020. Some of the third-party service providers we use to operate our business are located overseas, which means your Personal Information may be transferred to and stored in countries outside New Zealand.

Before transferring your Personal Information overseas, we take reasonable steps to ensure that the overseas recipient is required to protect your Personal Information in a way that provides comparable safeguards to those under the NZPA. This may include contractual protections or relying on the recipient being subject to privacy laws that provide comparable protection.

Cookies and tracking

We use web analytics tools, including Google Analytics and Google Tag Manager, to collect information about use of our Online Services, with the goal of improving them. These tools may issue cookies from their own servers and track visitors across relevant websites. We do not control how those cookies are issued or the data they store.

We may use various technologies to collect and store information when you use our Online Services, including cookies, web beacons (also known as pixel tags or clear gifs), and Local Shared Objects. A cookie is a small piece of information our web server may send to your device when you visit our Online Services. It does not identify you personally, but may link back to a database record.

Types of cookies we may use

• Session Cookies: temporary cookies erased when you close your browser, used to remember activity within a single session.
• Persistent Cookies: remain on your device after your browser is closed, used to remember login information and preferences for future visits.
• First-Party Cookies: set by our Online Services to track your activity during your visit.
• Third-Party Cookies: set by domains other than ours, often by advertising or tracking services, and may track activity across multiple websites.
• Secure Cookies: transmitted only over encrypted (HTTPS) connections.
• HTTP-Only Cookies: not accessible by client-side scripts, providing protection against cross-site scripting (XSS) attacks.
• SameSite Cookies: help prevent Cross-Site Request Forgery (CSRF) attacks.

With most browsers you can erase cookies from your device, block all cookies, or receive a warning before a cookie is stored. You can also unsubscribe from our email and text marketing communications at any time by clicking the “Unsubscribe” link in any marketing message, or by contacting us. If you reject cookies, you will still be able to use our Online Services but some functions may not work as well.

Storage and security

We are committed to protecting the security of your Personal Information. We use industry-standard (or better) administrative, physical and technical safeguards to protect against loss, unauthorised or accidental access, disclosure, alteration, destruction or other misuse.

Staff who handle your Personal Information are provided with training on how to do so appropriately.

If your Personal Information is subject to a privacy breach that is likely to cause you serious harm, we will notify you and the Privacy Commissioner in accordance with our obligations under the NZPA.

How long we keep your Personal Information

We will keep your Personal Information:

• until we no longer have a valid reason for keeping it;
• until you request us to stop using it; or
• for as long as required by law, for example, we keep invoice and financial records for 7 years to fulfil our tax and AML obligations.

When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymise it. If deletion is not immediately possible (for example, because data is stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible.

Links to other websites

Our Online Services may contain links to third-party websites that are not under our control. We have no responsibility for those websites and provide links solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use.

Those third-party websites may use their own cookies and may have their own privacy policies. It is their responsibility to collect any required consents and inform you of their practices. You should review the privacy policy of any third-party website before providing your Personal Information. Your disclosure of Personal Information to third-party websites is at your own risk.

While we take reasonable steps to maintain secure internet connections, the supply of Personal Information over the internet is at your own risk.

Your rights

You have the right to access the Personal Information we hold about you, and to ask for it to be corrected if you think it is wrong. You may do this by setting out your request in writing and contacting us using the details below. We will review your request as soon as reasonably practicable. If we are unable to give you access to the information you have requested, we will give you reasons for this decision.

You also have the right to make a complaint to us directly, or to the Office of the Privacy Commissioner, if you believe we have breached the NZPA in handling your Personal Information.

We will respond to rights requests in accordance with Applicable Privacy Laws. In certain circumstances we may refuse a request where we have the right to do so under Applicable Privacy Law (for example, where a request is manifestly unfounded or excessive).

Contact and complaints

We take your concerns seriously. If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about how we handle your Personal Information, please contact our Privacy Officer:

We will respond as quickly as possible (our target response time is 10 working days) and handle all requests in a way that is fair and consistent.

If you believe we are unlawfully processing your Personal Information, you may also lodge a complaint directly with the New Zealand Privacy Commissioner (www.privacy.org.nz). Information about how to lodge a complaint with the Privacy Commissioner is available at www.privacy.org.nz.

Changes to this Privacy Policy

We may amend this Privacy Policy from time to time, for example to reflect changes to our services or Applicable Privacy Laws. Where a change is significant, we will notify you, usually by displaying a notice on our Online Services or by sending you an email. We will also update the “Last updated” date at the top of this policy.

It is your responsibility to check this Privacy Policy periodically for changes. Continued use of our Online Services after any changes constitutes your acceptance of the updated policy.