Wpay Privacy Policy (New Zealand)

10th April 2025

We are Wpay New Zealand Limited (Wpay, we, us) and we are part of the Woolworths Group. We are committed to protecting your personal information in accordance with this Privacy Policy and the Privacy Act 2020 (as amended and replaced from time to time). If you have any questions, please contact us using the details in the “Contact Us” section below.

We acknowledge that most of our customers will be companies or other types of legal entities (for ease we refer to them as “organisations”), rather than individuals. This Privacy Policy covers personal information that we need to collect from individuals, including those that work for or govern those organisations. We need to collect this personal information in order to satisfy our legal obligations, as well as from an operational perspective, as set out below. Where we refer to “you” or “your” in this Privacy Policy, we are referring to the individuals who provide us with their personal information, whether they are individual customers, or individuals from within an organisation which is a customer.

What kinds of personal information does Wpay collect?

The Privacy Act 2020 defines “personal information” as information about an identifiable individual.

In this section, we describe the personal information that we collect. You do not have to provide us, or authorise us to collect, any information that we request, however, if you do not do so, you will be unable to use our services.

Depending on the services or products that you use, and your interactions with us, the personal information that we collect may include the following:

• To meet our legal and compliance obligations, including under Anti-Money Laundering laws (“AML”) and to verify “know your customer” (“KYC”) information, we may collect:
  • contact information (e.g. address, phone number and email addresses)
  • Government identifiers (e.g. drivers licence and passport number)
  • financial information (e.g. business bank account details and credit report)
  • demographic information (e.g. age, name, nationality, gender and date of birth)
  • business structure information (e.g. trust deeds and business partnership agreements)
  • watchlist information (e.g. adverse findings on domestic/international watchlists)
• To provide the Wpay Merchant services and/or services relating to the sale of Woolworths gift cards, we may collect:
  • information about the transactions you make
  • card holder details
• To respond to sales enquiries made through our sales channels, we may collect:
  • name
  • contact information (e.g. phone number and email address)
  • employment information (e.g. the company you work for and your job title)
• To identify and investigate certain transactions, we may collect:
  • information about the transactions you make
  • your Everyday Rewards status (if applicable)
  • customer identifiers
  • shipping information
• When you use your debit or credit card (or alternate payment methods that we accept), to make purchases from us, we may collect and hold your payment information. Any debit or credit card information is held in an encrypted and secure manner and in compliance with the Payment Card Industry Data Security Standards (PCIDSS).

How does Wpay collect personal information?

In this section, we describe how we collect personal information directly from you and, in some cases, from other sources.

Wpay collects personal information:

• directly from you (e.g. when you make an enquiry through our sales channels);
• from third party service providers (e.g. third parties that provide us with KYC/AML verification services, credit bureau reports and fraud detection services);
• from government authorities to confirm the validity of documents provided during the KYC/AML process;
• from other Woolworths Group companies if you have shared information with them and have previously authorised the sharing of your personal information within the Woolworths Group; and
• from merchants who use our products and services.

If you provide us with any personal information about a third party (such as a member of your company), you confirm that you have authority from the relevant individual to disclose their personal information to us and to authorise us to use their information in accordance with this Privacy Policy. You must inform them of their rights to access and request collection of their personal information in accordance with this Privacy Policy.

How does Wpay use personal information?

We may use your personal information to:

• provide services to you, such as processing and delivering Wpay Merchant services and/or sales of Woolworths gift cards;
• meet our legal obligations relating to AML and KYC and to investigate and report certain transactions prescribed by law;
• send you direct marketing, by post and electronic means, including by email, phone and text/SMS relating to our products and services that we think may be of interest to you – you can opt out of receiving direct marketing by telling us in writing, or by email or phone call (refer to the “Contact Us” section);
• improve our services and products to ensure that they remain relevant and of interest to users. For example, we may contact you to request that you respond to market research and surveys and if you contact us we may record your call for quality and training purposes;
• investigate and prevent fraudulent transactions;
• assist us in investigating your claims, complaints and enquiries; and
• for any other purpose that you authorise or that is permitted under the Privacy Act 2020.

Anonymous information - We also use aggregated and anonymous information (where identifiable characteristics are removed, so that you will remain anonymous). Where we do this, we may use that information to present market insights and research, determine preferences and other metrics related to our customers' access to and use of our services.

Who does Wpay share personal information with?

We may share your personal information with:

• Other members of the Woolworths Group, only to provide you with the Wpay merchant services, including the provision of Woolworths Gift Cards;
• government regulators and related agencies, but only when we have a legal obligation to do so;
• regulators or other authorities upon reasonable request;
• card payment schemes;
• third-party service providers who we contract with to assist us in providing the services to you, to enable them to provide those services (for example, ID verification providers and provers we have engaged to assist us with functions including data storage, data processing, security and fraud detection). We contractually require these service providers to adhere to our confidentiality requirements and to the requirements of the Privacy Act; and
• our contractors, affiliates, business partners and other third parties, but only in an anonymised and aggregated way (which is not capable of identifying you).

We may also share your personal information when required or permitted by law.

How does Wpay store and secure personal information?

We take reasonable steps to ensure that any of your personal information which we hold is accurate, complete and up-to-date.

Personal information that we collect is either held by us or on our behalf. Our service providers or their data storage servers may be located, and may store your personal information from time to time, in a number of countries, including Australia, United States and India. The use of these services, and the transfer of information overseas (if applicable) will not relieve us of our obligations under the Privacy Act and this Privacy Policy.

We may collect information from your current device using cookies or other similar technologies, including your online browsers or apps to protect your account security.

Security standards - We will take reasonable technical and organisational precautions, including complying with generally accepted industry standards, to protect personal information that we hold.

Your responsibilities - You are responsible for ensuring your Internet browser and computer system are secure (including, but not limited to, free and secure from viruses) and can support any security measures we use to protect your information. You are also responsible for complying with any security requirements that we notify to you. For example, if you have an online access to your account, you must keep your sign in details safe and confidential at all times.

Contact Us

You can contact us at any time by emailing us at support@wpay.co.nz. Alternatively, you can write to us at:

Woolworths New Zealand Limited
Private Bag 93306
Otahuhu, Auckland 1640

How can I access or update my personal information?

If you want to access any of the personal information that we hold about you or to correct some aspect of it (e.g. because you think it is incomplete or incorrect), please contact us using the contact details set out in the “Contact Us” section above. We rely on you to update us if your contact details change.

Before we provide you with access or correct your personal information, we may require proof of identity.

You can contact us at any time by emailing us at support@wpay.co.nz or write to us (please refer to the Contact Us section above).

How can I make a complaint?

If you are concerned about the way in which we are managing your personal information and think we may have breached the Privacy Act 2020, or any other relevant obligation, please contact us using the details set out in the “Contact Us” section above.

If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved satisfactorily, you can contact us to discuss your concerns. You are also entitled to make a complaint to the Office of the Privacy Commissioner (OPC). Contact details can be found at the OPC’s website: www.privacy.org.nz

Will Wpay change this policy?

We may make changes to this policy from time to time, to take into account changes to our standard practices and procedures, or where necessary to comply with new laws and regulations. The latest version of this Privacy Policy will always be available on our website. By continuing to use our services or products, you will be deemed to agree to our updated Privacy Policy.

This Privacy Policy is effective from 10th April 2025