The Kōura KiwiSaver Scheme is issued and managed by Kōura Wealth Limited, trading as Kōura. Kōura is committed to ensuring the privacy of your personal information and handling it in accordance with all relevant privacy laws, including the Privacy Act 2020.
This privacy policy sets out how Kōura collects, uses, stores, discloses and protects personal information, whether we collect it directly from you or indirectly from third parties (e.g. financial advisors or other parties who have referred you to us). Should we ask you to provide information which could be described as personal information, it will only be used in accordance with this privacy policy.
This policy is current as of August 2026. We may change this policy from time to time. If we make a significant change, we will contact you directly by email. For smaller changes, we will post a notice on our website. We recommend that you review this policy regularly.
1. What information we collect and why
We collect your personal information for the purposes outlined below, and we will only use it for the purpose it was collected or otherwise as permitted by law. In some cases, we may collect information directly from you and in other cases indirectly from third parties involved in providing our services.
- Delivering KiwiSaver advice for you
-
To deliver KiwiSaver advice and create your personalised Kōura KiwiSaver portfolio, we collect personal information provided by you through our website or through interaction with Kōura staff or external advisors, which may include, but is not limited to, your name, age, contact details, salary, IRD number, investment objectives and preferences, and current KiwiSaver details.
-
- Verifying your identity and opening your account
-
We collect personal information to verify your identity and enable opening your KiwiSaver account. This information may be provided directly by you or indirectly by a third party (e.g. financial advisors or other parties who have referred you to us), which may include your name, age, IRD number, and identity documentation (e.g. passport or driver’s license).
-
-
-
We will share your information with our identity verification partner to confirm the information you provide.
-
- Administering your account and processing transactions
-
If you agree to join the Kōura KiwiSaver Scheme, we process information necessary for your account to function and for us to perform our contractual and regulatory obligations toward you. The uses of information can range from where to invest your KiwiSaver through to assessing an application for withdrawal of your investment.
-
-
- This may include information provided by you, your previous provider, IRD, or other relevant third parties necessary to administer your account such as:
- Account & Investment Details: Fund selections, prescribed investor rate (PIR), bank account details for withdrawals, and historical contribution data (e.g. employee, employer, government contributions, and scheme transfer history);
- First Home Withdrawals: A copy of your sale and purchase agreement;
- Financial Hardship Applications: Proof of household income, bank statements, arears documentation, or medical quotes for essential treatment;
- Serious Illness Applications: Medical history, details of current conditions/ treatments or health provider information
- This may include information provided by you, your previous provider, IRD, or other relevant third parties necessary to administer your account such as:
- Responding to enquiries and providing support
-
We record all interactions with our customer support team, including, but not limited to, emails and phone calls, to help us respond to enquiries and maintain accurate records. We generate and keep a record of any mandatory statements and/or reports we produce for you.
-
- Improving our website, services and products
-
We are always looking to improve our services and product offering. For this reason, we collect and process data (including profiling) about how you interact with our website. This may be through cookies and analytical tools, to improve our products, services and website functionality. We may also receive information relating to you from third-party analytics providers.
-
- Sending marketing communications, where permitted
-
We may use your personal information such as your name, email address and investment preferences to share marketing information with you. We may also use cookies and similar technologies to help tailor content and marketing communications, where permitted. We will always seek your consent before sharing marketing information with you in accordance with our legal and regulatory obligations.
-
You can manage marketing communications or unsubscribe at any time through our preference centre by clicking the unsubscribe link provided in relevant emails. If you have any questions, please contact [email protected].
-
- Meeting our legal and regulatory obligations
-
We may use and disclose personal information where necessary to comply with our legal and regulatory obligations. We may collect and use personal information including, but not limited to, health and personal circumstances where necessary to provide our services and to support you appropriately.
-
If you do not provide us with the personal information we require, it may affect our ability to provide our services to you.
Some personal information is required by law (e.g. for identity verification under anti-money laundering legislation) or is necessary to enter or perform our contract with you. In other cases, the provision of personal information is voluntary.
2. Indirect collection of personal information
Kōura may collect personal information about you from third parties rather than directly from you. The table below sets out common examples of indirect information collection, the types of information involved and the purposes for which that information may be collected.
Where required, we will take reasonable steps to ensure you are aware that we have collected your personal information indirectly.
|
Indirect collection source |
Types of |
Purpose |
|
Referrers, Facilitators, and Financial Advisors.
|
Your name, contact details, general interest in joining our scheme or reviewing KiwiSaver, and identity documentation (e.g. passport or driver’s license) |
To contact you about our products and services; to process a referral; or to set up and administer your KiwiSaver account |
|
Previous providers |
Current KiwiSaver balance,
|
To transfer your KiwiSaver savings and memberships to us, and to ensure continuity of your investment records. |
|
Inland Revenue Department (IRD) |
Your name, date of birth, address, IRD number, contribution information, and KiwiSaver eligibility information |
To administer your KiwiSaver account, verify your eligibility for government contributions, and meet our reporting obligations under tax and KiwiSaver legislation.
|
|
Identity verification partners |
Your name, date of birth, identity documentation (e.g. passport, driver licence), and in some cases biometric information. |
To verify your identity, meet
|
|
Your Employer |
Employer contribution data If you join Kōura through a Preferred Provider Scheme, your employer will also provide your consent information to open your KiwiSaver account.
|
To set up your KiwiSaver account; and differential between contribution types. |
|
Australian Tax Office (ATO) |
Your name, address, date of birth, value of unclaimed |
To transfer unclaimed funds from the ATO into a member’s KiwiSaver account
|
3. Explicit Consent
Where explicit consent is required under applicable law for us to perform certain activities, we will seek this from you. For example, Kōura will only send you marketing communications where you have given us your explicit consent.
4. Cookies
- What are cookies?
-
A cookie is a small file that a website saves on your computer or mobile device to remember your actions and preferences over time. There are two main types: persistent cookies (that remain on your hard drive and your browser for an extended period) and session cookies (that expire and delete when you close your browser).
-
- What cookies do we use?
-
Necessary Cookies. These cookies are essential because they enable you to navigate our website, use our features and access secure areas. They also help us maintain our website services. Disabling them means some parts of Kōurawealth.co.nz will not be fully functional.
-
Functionality and Analytical Cookies. These cookies collect information about how you use our website, allowing us to provide you with a more enhanced and personalised experience. They also allow us to perform analytics, such as counting the number of visits or the most popular webpages. They also remember your preferences, such as your username and password, and provide certain content services, such as allowing you to watch videos. We also use other tracking technologies like web pixels that contain a unique identifier, enabling us to recognise when you have visited our website or opened an email that we have sent you.
-
Targeted Advertising Cookies. These enable us to deliver advertising and marketing that is relevant to your interests. They also help us measure how well our marketing campaigns are working so that we do not spam you with ads that you do not care about.
-
- How can you control cookies?
-
You can accept or reject cookies at any time by amending your web browser settings.
-
5. Your right to access and correct personal information
You have the right to request access to, and the correction of, personal information that Kōura holds on you. You may seek to exercise these rights by emailing us at [email protected].
6. Referred to us by a third party
If you have been referred to us by a third party (e.g. a Financial Advisor or referral partner), information about your KiwiSaver (e.g. your balance, contribution history, fund selection preferences) will be shared with that financial advisor for as long as you retain a relationship with us.
You will need to inform us if you do not want that information shared with that referral partner.
7. Sharing your information with third parties
We may share your personal information with third parties where it is necessary to provide our services, operate your account, meet our legal and regulatory obligations, or otherwise carry out our business activities. This may include government agencies, regulators, supervisors, service providers, partners and other organisations we work with.
Public Trust, as our Supervisor, lawfully receives customers personal information to perform their supervisory functions.
We may also share your personal information with certain suppliers or financial advisors, as detailed below:
- Data, service and software providers to help improve, develop and maintain our products and website (for example, customer data modelling or statistical and trend analysis);
- Data, service and software providers to deliver an interest-based web journey.
- Financial advisors or facilitators may receive regular account updates (e.g. your KiwiSaver balance) or information to support annual reviews (e.g. your fund allocations and KiwiSaver forecast scenario).
We may also disclose personal information where:
- We are required to do so by law;
- You have expressly consented to the disclosure, or the consent may be reasonably inferred from the circumstances; or
- We are otherwise permitted to do so under applicable privacy laws.
Where we share your personal information, we take reasonable steps to ensure it is protected and used only for the relevant purpose, or as otherwise permitted by law. We will endeavour to anonymise your personal information and minimise the amount of your information we share with these third parties, where possible. Prior to sharing any of your personal information with these third parties, we will ensure the appropriate contractual, technical and organisational measures are in place to safeguard your personal information.
Some third parties may keep information for their own legal, regulatory, or business purposes, which means it may be subject to their own data retention periods and privacy practices.
For the purposes set out above we may transfer personal information to parties located in other countries (some of which may not have an equivalent level of data protection laws as those in New Zealand). Before transferring any personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the overseas recipient complies with the principles contained in applicable privacy laws or is bound by substantially similar privacy laws, unless you consent to the disclosure or it is otherwise required or permitted by law.
We will not sell or lease your personal information to third parties.
8. Links to other websites
Our website may contain links to other websites. Once you leave our site, we are not responsible for the protection and privacy of any information which you provide whilst visiting such sites. External sites are not governed by this privacy policy. You should review the privacy policy of any website you visit and exercise caution when sharing personal information.
9. Security
We are committed to ensuring that your personal information is retained securely by us. To prevent unauthorised access to or disclosure of your personal information, we have put in place physical, electronic and managerial procedures to safeguard and secure the information we collect.
Using the internet comes with risks, we cannot guarantee that any information sent to us by email or via our website will not be intercepted or tampered with. Any communication you send to us is at your own risk.
10. Data Retention
Kōura is required to retain certain data records to comply with the Financial Markets Authority general recording keeping requirements. In general, we are required to retain information for at least seven years. Otherwise, we will not keep personal information for longer than it is required for the purpose it may lawfully be used.
11. Privacy Breaches
Kōura must report notifiable privacy breaches to the Office of the Privacy Commissioner. Notifiable privacy breaches are breaches that have caused, or are likely to cause, serious harm to affected individuals. Where a notifiable privacy breach occurs, we will also notify individuals whose information was affected.
Breach notifications to the Office of the Privacy Commissioner can be made by email, telephone or by using their online enquiry form: https://www.privacy.org.nz/privacy-for-agencies/privacy-breaches/.
12. Privacy Officer
Our Privacy Officer is responsible for ensuring that we comply with the Privacy Act, handling any complaints related to potential privacy breaches and requests to access or correct personal information.
If you have any questions or concerns, are not satisfied with how we have handled your request or complaint, or believe your privacy has been compromised, you may contact our Privacy Officer at [email protected].