Privacy Policy

1. Who we are and how to contact us

tandym is operated by tandym group limited, a company registered in New Zealand (NZBN: 9429052593154). 

If you have questions about this Privacy Policy or the personal information we hold about you, you can contact our Privacy Officer or support team at:

• Email: privacy@tandym.co

• Post: 

  • PO Box 12198

  • Ahuriri,

  • Napier, 4144

  • New Zealand.

We are always happy to help.

2. What this policy covers

This Privacy Policy applies to any personal information we collect when you:

• Use our website

• Access or log in to the tandym platform

• Create an account

• Take part in shared or group investing

• Get in touch with our support team

• Interact with us in any other way

As we expand beyond New Zealand, we may update this policy or introduce region-specific notices. For now, this policy focuses on our New Zealand operations.

Important Note on Partners: This policy does not cover the privacy practices of independent organisations we work with, such as banks, custodians, identity-verification providers, or advertising platforms. Those organisations have their own privacy policies.

If you choose not to provide certain information, such as identity verification details or bank information, we may not be able to open your account or provide some features.

We collect, use, and protect your personal information in line with the Information Privacy Principles (IPPs) set out in the New Zealand Privacy Act 2020.

3. The information we collect

We collect different types of information to help us provide a safe and reliable investing experience.

Information you give us directly

When you create an account, we ask for details such as your name, date of birth, address, and contact information. This helps us confirm who you are and communicate with you. 

Because we operate in the financial sector, we need to collect verification information such as your ID, proof of address, tax information (IRD number), and other details required for Anti-Money Laundering (AML) and Know Your Customer (KYC) compliance.

We collect the information needed to process deposits and withdrawals securely.

When you join a group, we collect information about your participation, including your contribution amounts and the interactions you have within your group. If you message our support team, complete a survey, or send feedback, we keep a record of that communication.

Information we collect automatically

When you use the tandym website or platform, we automatically collect some information about your device and how you use our services. This may include your device type, IP address, general location (such as your city), and how you navigate the platform. We use this to improve performance, maintain security, and make tandym easier to use.

We also use cookies and similar technologies to keep you logged in, remember your preferences, and understand how people use tandym.

Information from other organisations

We receive information from trusted partners who help us operate securely and meet our legal obligations. These may include identity verification services, banks, payment processors, and our custodian and broker, Alpaca. The tandym platform is hosted on AWS.

We also use Meta’s advertising tools (Facebook and Instagram) to help us understand how our ads perform and to reach people who may be interested in tandym. This relates primarily to our marketing activity. Meta may collect information about how you interact with our ads on their platforms. You can control how Meta uses your information for personalised advertising by adjusting your settings on Facebook or Instagram.

Some of our partners use automated tools to help with identity verification, security, and fraud prevention. These tools support us in meeting our legal obligations. If you ever think something is not right with your account, please contact us and we will look into it.

4. How we use your information

We use your information to:

• Create and manage your account

• Process payments, deposits, and withdrawals

• Operate shared and group investing features

• Maintain accurate transaction and activity records

• Provide support and communicate with you

• Keep the platform secure and meet AML, KYC, and other legal requirements

• Send essential service updates

A key part of tandym is shared investing. To make this work, members of a group can see each other’s username and a combined portfolio. This information is visible within the group only.

If you invite someone to join a group on tandym, we may show them your name or the group name as part of the invitation process so they know who the invitation is from.

In the future, we may introduce optional features such as public profiles or leaderboards. If we do, you will always have clear control over what, if anything, you choose to make visible.

We also analyse platform usage to understand how people use tandym and to improve our services. We may create anonymised or aggregated information that cannot be used to identify you and use it for insights, reporting, or product development.

We may send you marketing messages about new features or offers, but you can opt out at any time.

5. Who we share information with

We only share your information when it is necessary for tandym to operate or when the law requires it. This includes sharing information with:

• Alpaca, our custodian and broker

• Identity-verification and fraud-prevention partners

• Professional advisers such as lawyers, auditors, and compliance specialists when required

• Regulators or law enforcement agencies when required

• Other members of your shared investment groups, as described earlier

We may also share anonymised or aggregated information that does not identify you. We require our service providers to protect your information and to use it only for agreed purposes.

6. International transfers

Some of the service providers we work with store or process personal information outside New Zealand, including in countries such as the United States and Australia. When this happens, we take reasonable steps to make sure your information is protected in a way that is comparable to the protections under New Zealand privacy law. This includes working with reputable providers and putting appropriate contractual and organisational safeguards in place.

7. Cookies and similar technologies

We use cookies and similar technologies to keep tandym running smoothly, maintain security, remember your settings, and understand how people use our website and platform. You can adjust your browser settings to manage or block cookies, but some parts of tandym may not function properly if you do.

8. How we protect your information

We use a range of technical and organisational measures to keep your information safe. These include encryption, secure servers, role-based access controls, monitoring, and regular reviews of our security practices. Our team is trained to handle personal information responsibly.

Please let us know immediately if you suspect any unauthorised access to your account.

9. How long we keep your information

When you close your tandym account, we will deactivate it and stop using your personal information for anything other than meeting our legal, regulatory, or record-keeping obligations. You will not be able to log in once your account is closed.

Because tandym is a financial service, we are required to keep certain records for a set period of time. In most cases, we keep personal information for as long as you have an account, and then for at least seven years after your account is closed. We may keep it longer if the law requires it or if we need it to resolve disputes, meet audit requirements, or maintain accurate business records.

When personal information is no longer needed, we remove it from our active systems and either securely delete it or convert it into permanently anonymised data that cannot identify you.

10. Children and minors

tandym is for people aged 18 or over. We do not knowingly collect personal information from anyone under 18, and we do not allow minors to create accounts. If we discover that someone under 18 has created an account or provided personal information, we will close the account and remove their information as soon as reasonably possible.

11. Your rights

Under the Privacy Act 2020, you have the right to access the personal information we hold about you and to request a correction if anything is wrong or incomplete. If you ask to access or correct your information, we will respond as soon as we can, typically within 20 working days, which is the standard timeframe under the Privacy Act.

To exercise your rights, contact us at privacy@tandym.co. We may need to verify your identity before we can help.

If you are not satisfied with how we have handled your personal information, you can make a complaint to the Office of the Privacy Commissioner (OPC). Their contact details are:

Office of the Privacy Commissioner PO Box 10094 Wellington 6140 New Zealand Phone: 0800 803 909 Website: www.privacy.org.nz

12. Changes to this policy

We may update this Privacy Policy as our services evolve or if our legal obligations change. If we make significant updates, we will let you know through the platform or by another reasonable method. The "last updated" date at the top of this policy shows when it was last revised.