Privacy Policy

1. About this policy

This Privacy Policy explains how The Contractor Hub ('TCH') collects, uses and protects personal information, under the Privacy Act 2020 (NZ) and its 13 information privacy principles. It is in effect from 9 August 2026.

TCH is run by The Contractor Hub Limited, a New Zealand company (company number 9462988, NZBN 9429053999221). The company is the agency responsible for the information described here, including information given to TCH before the company was incorporated on 1 October 2026.

2. Information we collect

Account details you provide directly, such as name, email, phone, region, and for trade & business accounts, company and trade information. Job and tender listings, messages, reviews and gallery images you post. Basic usage data (pages visited, device type, and on the public pages how far you scroll and what you press, as section 10 describes) for site reliability and analytics. If you use the careers part of TCH, we also collect what is set out in section 5, including CVs.

If you join the waiting list, we collect your name, email address and region, the role you choose, and your trade or what you are looking for if you tell us. We also record the link that brought you, such as an Instagram post, so we can see which posts bring people in. We use it to send you a receipt and one email when TCH opens (or, if you are looking for work, when jobs and apprenticeships open), and for nothing else. We keep it until you join TCH or ask us to remove you, which you can do at any time through our Privacy Officer. If you are under 16, please ask a parent or caregiver before joining.

If we email your business an invitation to TCH, we record whether it arrived, whether it was opened, which link in it was pressed and when, and the visit to our site that followed, with the town and type of device it came from. We use this to see who has had the invitation and to decide who to follow up, and for nothing else. Opening an email can be recorded by a small image in it; you can block that by turning off images in your email app. Use the unsubscribe link in the email and we will not email you again.

3. How we use it

To operate your account and the directory, jobs and project features. To connect customers with trades and businesses. To send service-related communications (e.g. when TCH opens to everyone) and, with consent, marketing updates. To meet legal and accounting obligations, including via our service providers.

4. Who we share it with

Directory profile information (name, services, region, reviews) is public by design once a listing goes live. Job and tender details are shared with businesses eligible to respond. We use third-party service providers for hosting, the database, payments, the emails TCH sends and the drafting features in the project workspace; they are named, with where they are, in section 6. If you connect Xero, it receives what you choose to send it. We do not sell personal information.

5. Careers, applications and CVs

Personal information reaches us two ways through the careers part of TCH. If you publish a career brief, you give us a headline and description, your trade category and region, the skills and tickets you say you hold, when you're available, the kinds of work you want, your contact email and phone, and optionally a CV. If you apply for an advertised role, you give us your name, email, phone, a message and optionally a CV.

Skills and tickets on a career brief are shown as declared. We don't check them, and they're labelled that way everywhere they appear.

A published career brief, including your contact details and CV, can be read by TCH members with careers access: during the founding period that is every member, and after it, members on the Professional tier and above. An application for a specific role goes to the business advertising that role, and is visible to them and to us.

CVs are held in a private store. They are never public and never linked from a page. A member entitled to read one is given a link that stops working after ten minutes.

We keep a career brief while you keep it published, and an application while the business that received it keeps it. You can ask us to take either down, and the CV with it, through our Privacy Officer. Closing your TCH account does not by itself withdraw an application you have already sent, because the business that received it holds its own copy of what you sent them.

6. Storage, security, and information that leaves New Zealand

The database, including uploaded files and CVs, is hosted with Supabase on infrastructure in Sydney, Australia. The site itself runs on Vercel, whose network serves pages from wherever the reader is, so requests are handled outside New Zealand as a matter of course.

Most of the companies we rely on are overseas. Supabase and Vercel as above; Stripe for payments; Resend for the emails TCH sends; Anthropic for the drafting features in the project workspace, which means the project text you ask it to draft from is sent there; Vercel Analytics for the usage counts in section 10; and Meta Platforms, for measuring TCH's Facebook and Instagram ads (section 10).

Where a provider only holds or processes information on our behalf, the Privacy Act treats that information as still held by us. It is not a disclosure, and we stay answerable for it. Where information genuinely goes to an overseas company for its own purposes, information privacy principle 12 applies, and we rely on the data-processing terms those companies publish, which commit them to safeguards comparable to the Act.

We take reasonable steps to protect information from loss, misuse or unauthorised access, though no system is completely secure.

7. If something goes wrong: privacy breaches

A privacy breach is unauthorised or accidental access to personal information, or its disclosure, alteration, loss or destruction. It also covers being locked out of information ourselves.

When one happens we assess whether it is a notifiable privacy breach, which means asking whether it is reasonable to believe the breach has caused serious harm to someone, or is likely to. Weighing that up, we look at how sensitive the information is, what protections were on it, who holds it now, what harm could follow, and what we have already done to limit it.

If it is notifiable, Part 6 of the Privacy Act 2020 requires us to tell the Office of the Privacy Commissioner as soon as practicable after we become aware of it, and to tell the people affected. We will say what happened, what information was involved, what we have done about it, and what you can do.

Every suspected breach goes to our Privacy Officer, who decides whether it is notifiable and makes the notifications. We keep a record of breaches whether or not they turn out to be notifiable.

If you think your information has been exposed, please tell us. A security flaw, such as a way to reach data you should not be able to, is covered by the responsible disclosure policy on our Security page. Anything else should go straight to the Privacy Officer.

8. Your rights

Under the Privacy Act 2020 you have the right to ask for the personal information we hold about you, and to ask us to correct it. Send the request to our Privacy Officer, whose contact details are in section 12. We must decide on an access request as soon as reasonably practicable, and no later than 20 working days after we receive it.

You can also close your account and have your personal information deleted, from your account page or, if you cannot sign in, by email. How to close your account and delete your data sets out the steps, what is deleted, and what is kept and why.

9. Retention

We keep account and listing information while your account is active, and for a period afterwards to meet legal, accounting and dispute-resolution obligations.

Careers data has fixed periods, and a job runs daily to enforce them. An application for a role is deleted 12 months after you send it. A career brief is deleted 24 months after you last changed it, so editing it starts the clock again. In both cases the CV goes with the record: the file is removed from storage first, then the record itself, and nothing is left behind to anonymise.

Credential checks on a business listing are part of that listing and are kept for as long as it is, under the rule above. What is kept is one record per credential, and only the most recent check: what was checked, the method used, and the date. A re-check overwrites it and a rejected check removes it along with the badge, so we hold no history of earlier checks, and where a check was made by sighting a certificate we hold our record of the sighting rather than the document. The Trust & Safety page describes the same thing in plainer words.

You do not have to wait for those periods. Ask our Privacy Officer and we will take a brief or an application down sooner.

10. Cookies

TCH uses essential cookies to keep you signed in and to remember preview-access status during private preview. For usage counts we use Vercel Analytics, which sets no cookies and does not follow you to other sites, and TCH counts visits to its own pages and the steps through its forms itself, with no name, email address or IP address attached. On its public pages TCH also records how a visit goes: which parts of the page are on screen and for how long, how far down it scrolls, which links and buttons are pressed, and which form fields are reached and whether they are left filled or empty. It never records what you type, and none of this is linked to an account. If we ever add analytics that do use cookies, this section will say so before they run.

TCH also uses the Meta Pixel, from Meta Platforms, to measure its Facebook and Instagram ads. It runs on the public pages only, never in the portal, on the sign-in page, or on a page whose address carries an invitation, a link code or an email address. Where it runs, it sets cookies (_fbp, and _fbc when you arrive from one of our ads) and sends Meta the address of the page you are on and of the site that sent you, with the ad's tags if there were any and your browser's details. Meta uses all this under its own privacy policy, which can include choosing the ads you see elsewhere. You can turn off ad personalisation in your Facebook or Instagram settings, or block the cookies in your browser, and TCH works the same either way.

11. Changes to this policy

We may update this policy as the platform develops and as it undergoes formal legal review. Material changes will be notified to registered users.

12. Our Privacy Officer, and how to complain

Section 201 of the Privacy Act 2020 requires every agency to appoint a Privacy Officer, and we have one. You can reach our Privacy Officer at hello@thecontractorhub.co.nz or through the Contact page. The Privacy Officer handles access and correction requests, questions about this policy, and any complaint about the way TCH has handled personal information.

If our answer doesn't satisfy you, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, or on 0800 803 909. You don't have to come to us first, though raising it with us usually settles it faster.