Privacy Policy

1. About this policy

This privacy policy explains how Team Duality ("Duality", "we", "us") handles personal information collected through our website, duality.nz (also reachable via teamduality.co.nz). We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). By using the website, you accept the practices described here.

2. Who we are

Duality is a New Zealand-based organisation. For any privacy question or request, contact our Privacy Officer at privacy@teamduality.co.nz.

3. What information we collect and why

3.1 If you contact us. The website does not have a contact form. If you choose to use the email link on the site, your message goes to hello@teamduality.co.nz and we receive whatever you include – typically your name, your email address, and the content of your message. We use this only to respond to you.

3.2 Customer relationship records. If our contact leads to an ongoing relationship, we may keep a contact-management record (CRM) — typically name, email, phone, organisation and role — together with a log of our interactions, so we can manage our business relationship with you. So we can stay focused on your discussion, some of our meetings use a secure AI notetaker (Granola) to capture notes and a summary of the meeting — no audio recording is kept, only the notes. You'll be told this when the meeting is booked, and again verbally at the start of the call; if you'd prefer we don't use it, just let us know and we'll take notes manually instead. The notes are processed in the United States before being stored securely within our Microsoft 365 environment (data stored in New Zealand) once finalised. Our AI assistant (Claude, by Anthropic) may access these notes to help us prepare for and manage our relationship with you — it only reads what's needed and does not use your information to train its models. We use this information only to manage our relationship with you; we do not sell it or use it for marketing without your consent, and it is not disclosed outside Duality except to the processors named in Section 5.

3.3 Information collected automatically. When you visit the site, we collect standard analytics information through Google Analytics 4 — such as pages viewed, date and time of visit, approximate location (from your IP address), and basic device and browser information — used in aggregate to understand how the site is used. We use Google Tag Manager to manage these tags. Where you accept non-essential cookies, we may also use Google signals — a Google Analytics setting that links this aggregate visit data with Google's own signed-in-user information, so that visits across your devices can be counted together, we can see broad demographics/interest reporting, and we can build advertising audiences to share with our Google Ads advertising (see 3.5). This does not involve us collecting any new information about you — it changes how Google may use the data already described above, under Google's own terms.

3.4 If you book a meeting with us. Some of our team use an online scheduling tool (Calendly) that lets you book a meeting via a booking link. If you book this way, Calendly collects your name, email address and any details you choose to add about the meeting, and creates the meeting in our calendar. This information is processed and stored by Calendly in the United States (see Section 5). We only use it to arrange and hold the meeting, and we ask that you don't include sensitive or confidential information when booking.

3.5 Advertising and measurement. When you accept non-essential cookies, we use advertising and conversion-measurement tags — the Meta Pixel (Meta), the LinkedIn Insight Tag (LinkedIn) and Google Ads tags (Google, for remarketing and conversion measurement across Google Search, Display and YouTube, including automated bid optimisation) — to measure how our ads perform and to show relevant ads to people who have visited the site. These tags may set cookies and share limited event data (such as pages viewed and actions taken) with Meta, LinkedIn and Google, who process it on their platforms (stored in the United States). We do not send your name, email address or other identifying information to Meta, LinkedIn or Google through these tags. They do not run unless you accept. Where these tags build an advertising audience of people who’ve engaged with our site (for example, by visiting certain pages), that audience is held for a limited period and refreshes automatically — up to 180 days under the platforms’ standard settings — after which membership expires. If you decline or later withdraw cookie consent (Section 4), we stop adding you to these audiences and stop refreshing your place in them; this doesn’t remove you instantly, so any existing membership still expires on its own within that same period rather than disappearing straight away.

Where you accept non-essential cookies, we also use the TikTok Pixel, provided by TikTok Pte. Ltd. — a Singapore-based company in the ByteDance group — in the same way: to measure how our TikTok ads perform and to show relevant ads on TikTok to people who have visited the site. We disclose TikTok separately from the providers above because it is not a United States provider — your information is processed by TikTok Pte. Ltd. in Singapore, and may be stored or accessed in other countries where the ByteDance group operates, under TikTok's own privacy policy (see Section 5). As with the other tags, we do not send your name, email address or other identifying information to TikTok, the tag does not run unless you accept, and the audience-expiry and consent-withdrawal position described above applies in the same way.

3.6 If we reach out to you. We sometimes use LinkedIn Sales Navigator to identify and contact people who may be interested in working with us, using publicly available professional profile information (such as your name, job title, company and location). We do not collect your email address or phone number this way. If you'd rather we didn't contact you, let us know at privacy@teamduality.co.nz and we'll stop.

3.7 If you engage us or make a payment. If you become a client, we issue invoices through Xero, our accounting software, and accept payment by bank transfer or by card via Stripe. Card details are provided directly to Stripe and are never stored or seen by Duality; Stripe is certified to PCI-DSS Level 1. Xero holds your billing contact details, GST information and your billing and payment records, retained as required by NZ tax law. Xero stores information in Australia, New Zealand and the United States.

4. Cookies and analytics

The site uses cookies and similar technologies for website analytics (Google Analytics 4, managed via Google Tag Manager) and, where you consent, for advertising and conversion measurement (Meta Pixel, LinkedIn Insight Tag, Google Ads remarketing/conversion tags and the TikTok Pixel), including Google signals (see 3.3). When you first visit, a consent banner lets you accept or reject non-essential cookies. Before you make a choice, and if you reject, no analytics or advertising cookies are set, Google signals is not used, and we do not identify you or build a profile. Google Analytics runs in a privacy-preserving "consent mode" — until you accept, it may send Google a basic, cookieless signal (with no identifiers) so we can see aggregate visit numbers. Cookies, profiling and any advertising tags run only after you accept. If you change your mind, you can always adjust your cookie choice at any time using the “Cookie preferences” link in the footer of the Duality website. You can also control or block cookies through your browser settings; some parts of the site may not function as intended if you do.

5. Who we share information with, and overseas storage

We use the following providers to run the website. Some store or process information outside New Zealand; we disclose this under IPP 12.

We do not otherwise disclose your personal information except where required or permitted by law. We do not sell personal information.

6. How we store and protect your information

Emails you send us, and any CRM records, are held in our Microsoft 365 environment (New Zealand) and accessible only to the people who need them. We take reasonable steps – including encrypted connections (HTTPS), multi-factor authentication on administrative accounts, and limiting administrative access to authorised personnel – to keep personal information secure and to retain it only as long as needed. No method of transmission over the internet is completely secure.

7. Your rights

Under the Privacy Act 2020 you may ask to access the personal information we hold about you and to correct it. Contact privacy@teamduality.co.nz (please include "Privacy Enquiry" in the subject line; we aim to respond within 10 working days). If you are not satisfied with how we have handled your information, you can contact the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

8. Children

The website is intended for a business audience and is not directed at children.

9. Changes to this policy

We may update this policy from time to time; the current version and its effective date are always available on the website.

10. Contact

General enquiries: hello@teamduality.co.nz
Privacy requests and questions: privacy@teamduality.co.nz