Privacy

Fill The Gap Limited (FTG) is a New Zealand company that builds, hosts and supports software for organisations. This page explains how we handle personal information under the Privacy Act 2020.

Last updated 17 October 2026

Two kinds of information

• Information we collect for ourselves: from people who contact us, our clients' and suppliers' staff, and people who work with us. We are responsible for it, and the rest of this page is about it.
• Information we hold for our clients: in the systems we build, host or support for them. The client is responsible for it, and its own privacy statement explains how it is used. We hold it on the client's behalf, follow our agreement with them, and use it for nothing else. If your question is about one of these systems, ask the organisation that runs it. We will help them answer you.

What we collect, and why

• When you email us: your name, email address and what you tell us, so we can reply.
• Clients and suppliers: names, roles and work contact details, agreements and invoices, so we can do business with you and keep our accounts.
• People who work with us: what we need to employ or engage you and pay you.
• This website: no cookies, no analytics and no forms. Our hosting providers may keep standard server logs, including IP addresses, for security and to keep the site running.

We don't sell personal information, or use it for advertising.

Who we share it with

Only with service providers that help us run our business, and when the law requires it. We use established providers for:

• email and documents, stored in Australia
• cloud hosting, in Sydney, Australia, for the systems we host and this website
• accounting and invoicing
• storing our source code, which holds no personal information about our clients' customers
• managing passwords and keys
• domain names and delivering our websites
• AI services, which help us write software and read our own business documents, such as agreements and invoices

Some of these providers process information outside New Zealand, including in Australia and the United States. We choose providers with strong security, and they may use our information only to provide their service to us. Our clients can ask us for the current list of providers. Where our agreement with a client says where its information must be held, or who may process it, we follow that agreement.

How we protect it

• Multi-factor sign-in, and encrypted laptops.
• Access only for the people who need it, removed the day they stop.
• Systems we host are encrypted, and each client's information is kept separate.
• We build and test with made-up data. Real personal information is used outside a live system only with the client's agreement, for a set purpose and time. We don't give our clients' personal information to AI tools to build or test software. Where a system we run for a client uses AI as one of its features, our agreement with that client covers it.

How long we keep it

Only as long as we need it, or as the law requires. For example, business and tax records are kept for seven years. Information we hold for a client is kept, returned or deleted as our agreement with that client says.

If something goes wrong

If a privacy breach involving information we are responsible for is likely to cause serious harm, we tell the Privacy Commissioner and the people affected, as the Privacy Act requires. If it involves information we hold for a client, we tell that client without undue delay, and within 48 hours of becoming aware of it, and help it notify the people affected.

Seeing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it. We will respond within 20 working days. If you're not happy with how we handle your information, please tell us first. You can also complain to the Privacy Commissioner at privacy.org.nz.