MyAndGo and New Zealand's Privacy Act 2020
New Zealand's Privacy Act 2020 sets how organisations handle personal information. Here is how that maps to using MyAndGo, and where responsibility sits.
The Privacy Act 2020 is New Zealand's privacy law. It governs how personal information is collected, stored, used, disclosed, accessed and corrected, and it applies to any agency carrying on business in New Zealand. It sets out 13 Information Privacy Principles that shape how that information must be handled.
When you use MyAndGo, your organisation is the agency responsible for the personal information in your workspace. We hold and process that information on your behalf and on your instructions, and you decide what goes in and who may see it.
Where responsibility sits
You are the agency in charge
Your organisation decides what personal information to collect and how it is used. The obligations under the Privacy Act 2020 sit with you, and we give you the tools to meet them.
We process it on your behalf
MyAndGo holds and processes personal information on your instructions and protects it, rather than using it for our own purposes.
Your content, in Australia
For a New Zealand workspace your documents, records and files are stored in Australia, on Google Cloud in Sydney, with sign-in and payments in the United States.
Where MyAndGo helps you meet the Act
- Security: your content is encrypted in transit and at rest, with access controls and two-factor sign-in, supporting the principle on keeping personal information safe.
- Access and correction: your data stays yours to view, export and correct inside your workspace.
- Retention: you can delete records, and our deletion flows remove them on a defined schedule, so personal information is not kept longer than needed.
- Transparency: we name plainly where your content is stored and which services run overseas.
Your own obligations
The Privacy Act 2020 requires every agency to appoint at least one privacy officer, and to handle requests to access and correct personal information. It also includes a notifiable breach regime: if a privacy breach has caused, or is likely to cause, serious harm, you must notify the Office of the Privacy Commissioner and the affected people as soon as you can.
MyAndGo gives you the records and the security to support those obligations. It does not replace your own compliance, and nothing here is legal advice. For the current rules and timeframes, read the guidance published by the Office of the Privacy Commissioner at privacy.org.nz.