Privacy policy

PRIVACY POLICY

The present personal data protection policy will be applicable to the personal data processed by Global Exchange NZ Limited (hereinafter referred to interchangeably as 'Global Exchange' or the 'Entity') in its capacity as Data Controller.

Global Exchange complies with the current legislation in New Zealand regarding the processing of personal data of its users, and in particular, with the provisions of the Privacy Act 2020 and its Information Privacy Principles (IPP).

To this end, we have adopted the necessary technical and organizational measures to ensure the confidentiality of the information and to prevent the loss, misuse, alteration, unauthorized access, and theft of the personal data provided, taking into account the state of technology, the nature of the data, and the risks to which they are exposed.

I - Who is the Data Controller of your personal data?

Global Exchange NZ Limited, with its registered office at Site S5, Level 2, Ray Emery Drive, Auckland Airport, Auckland, 2022, New Zealand, and New Zealand Business Number: 9429045924071.

II - What personal data do we collect and how do we process it?

The personal data collected and processed by Global Exchange, as the data controller, are the data provided by the user in the context of the execution and management of a foreign exchange purchase contract (hereinafter, the 'Service') and in compliance with the legal requirements derived from the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 of New Zealand (hereinafter, 'AML/CFT'), in accordance with the legitimate basis and retention periods expressed below:

1. EXCHANGE OF CURRENCY AND SERVICES: Personal data collected and processed by Global Exchange in the context of the execution and management of a foreign exchange purchase contract (hereinafter, the 'Service'):

Category of data collected: Name, surname, gender, date of birth, address, full number of the National Identity Document, Foreigner Identification Number or Passport, email, contact phone number, and other data necessary for the provision of the Service. 

Purpose: The personal data will be processed with the purpose of providing currency exchange services.

Legal basis: The Entity is authorized to process the personal data provided by users, as it is necessary to fulfill the currency exchange operations requested and in compliance with the legal requirements derived from the AML/CFT.

Retention periods: The data will be retained for the time necessary for the purpose of processing, and once this is completed, they will be available to federal and state authorities, law enforcement agencies, and the judiciary, when required or authorized by law, for the legally established periods, attending to and defending possible liabilities arising from the processing.

2. PROMOTIONAL MATERIAL/ NEWSLETTERS: The sending of information, news, notices, reminders, and promotions that may be of interest to the data subject, related to the activities of Global Exchange:

Category of data collected: Email address, name, and surname. 

Purpose: The registration of data subjects for the sending of information, news, and promotions, and to establish and maintain business relationships.

Legal basis: Consent of the data subject to Global Exchange for registration in promotional services, and legitimate interest for the development of business relationships.

Retention periods: The data will be retained until the data subject requests the cancellation or deletion of their data, and once deleted, they will be available to federal and state authorities, law enforcement agencies, and the judiciary when required or authorized by law, for the legally established periods, attending to and defending possible liabilities arising from the processing.

3. ACCESS CONTROL AND SECURITY: Data collected by video surveillance cameras

Category of data collected: Images and voice recording. 

Purpose: Access control and internal security management of Global Exchange facilities.

Legal basis: Legitimate interest in ensuring security in the facilities by its owner, which justifies that the images are necessarily captured when accessing these facilities.

Retention periods: The data will be kept for a maximum period of one month, unless it is necessary to keep them for a longer period of time because it is convenient to clarify any infringement or illicit fact detected.

III - What happens if your personal data is updated?

If the personal data you have provided us is updated, for example, if you change your email address or consider that the data in our database is incomplete or incorrect, please let us know by sending a communication to Global Exchange and expressly indicating the reason for your request by filling out our Contact Form.

We are not responsible for any damages that may arise from incorrect, false, deficient, or incomplete data that you have provided.

IV - Who do we share your personal data with?

There are data communications to third parties for the provision of third-party services as data processors with whom Global Exchange has signed the corresponding Data Processor contracts and verified that they meet sufficient guarantees to apply appropriate technical and organizational measures, so that the processing is carried out in accordance with the requirements of the applicable regulations, ensuring the protection of the rights of the data subject.

However, your personal data will not be transferred to any third party without a legal basis that legitimizes such transfer (legal relationship, judicial or administrative order, etc.).

V - Does Global Exchange carry out international data transfers?

Your personal data will not be transferred to any third party without a legal basis that legitimizes such transfer (legal relationship, judicial or administrative order, etc.).

Your personal data may be transferred internationally to service providers, mainly iCloud service providers (e.g., AWS).

However, in the event that the servers are located in countries outside New Zealand, Global Exchange will ensure that the personal data is processed with the same level of protection as if it had remained in the country.

There are data communications to third parties for the provision of services by third parties as data processors with whom Global Exchange has signed the corresponding Data Processor contracts and verified that they meet sufficient guarantees to implement appropriate technical and organizational measures, so that the processing is carried out in accordance with the requirements of Global Exchange's Privacy Policy, ensuring the protection of the rights of the data subject.

VI - What are your rights and how can you exercise them?

The data subject may exercise the following rights before Global Exchange:

Right of access: The right to obtain information about which personal data and processing activities are being carried out by the Data Controller.

Right of rectification:The right to request the correction of inaccurate personal data.

Right of erasure:The right to request the deletion of personal data.

Right to data portability: The right to receive the personal data provided for transmission to another Data Controller.

Right to object: The right to request the cessation of personal data processing when it is based on legitimate interest.

Right to restrict the processing of personal data.

Right not to be subject to automated decision-making.

To do this, you must send a communication to Global Exchange, attaching a document that proves your identity and expressly indicating the right or set of rights you wish to exercise, through our Contact Form.

However, Global Exchange is obliged to comply with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 of New Zealand. Compliance with this regulation may result in certain restrictions on the exercise of your rights.

In any case, and if deemed appropriate, you will have the right to seek the protection and support of the competent data protection authority, in accordance with the provisions of the current data protection regulations

VII - Do you need more information about the processing of your personal data?

For any other matter related to the processing of your personal data by Global Exchange, you can contact our Data Protection Officer by filling out our Contact Form.

© GLOBAL EXCHANGE NZ LIMITED.

Global Exchange

Last updated, April 2025