OwlQR

Privacy policy

Last updated: 7 October 2026

1. Application

1.1 OwlQR Limited (OwlQR, we, us or our) is committed to protecting the personal information of the users of our website https://OwlQR.com/ (Website), our customers, and any other individual whose personal information we hold (you, your).

1.2 This privacy policy will help you understand what information we collect, how and why we collect that information, when we might disclose that information to third parties, how that information is stored, and how you can access and correct that information.

1.3 This privacy policy does not limit or exclude any rights that you have or may have under the New Zealand Privacy Act 2020 (Privacy Act).

1.4 By using the Website, OwlQR platform (OwlQR Platform) and/or services (Services) offered by OwlQR, you consent to the collection, use, disclosure, storage, and processing of your personal information in accordance with this privacy policy.

1.5 This privacy policy is intended to apply to individuals located in New Zealand, using our Website, OwlQR Platform and/or Services.

2. What personal information we collect

2.1 Personal information is information about an identifiable individual.

2.2 The type of personal information we will collect about you will depend on how you interact with us however, this may include:

  1. (a) your name;
  2. (b) your contact information, such as your phone number, residential address, postal address, email address and communication preferences;
  3. (c) your occupation/role;
  4. (d) your entity/company name;
  5. (e) your location;
  6. (f) IP address, device type, browser and timestamp;
  7. (g) identification information, such as your driver’s licence or passport;
  8. (h) information contained in any communication between you and us;
  9. (i) transaction information relating to your purchases from us;
  10. (j) date relating with your account with OwlQR to access the OwlQR Platform and/or Services. (Account) including information about Account creation, modifications to your Account, website settings and marketing preferences;
  11. (k) data about your use of our Website, OwlQR Platform and/or Services;
  12. (l) any other information provided by you to us; and
  13. (m) other information necessary to conduct our business, provide the OwlQR Platform and/or Services to you, and/or comply with our legal obligations.

2.3 If you choose not to provide your personal information when we ask for it, then we may be unable to provide you with access to our OwlQR Platform and/or Services, and certain functions and features on the Website and/or OwlQR Platform may not be available to you.

2.4 We do not collect your billing information. All of the billing information is collected and stored by our third party provider Stripe. We encourage you to read Stripe’s privacy policy, which can be accessed by clicking here, before providing your billing information to understand, and be aware of Stripe’s privacy practices, and how your personal information may be used.

2.5 If you use the Amazon Transparency product authentication programme, Amazon may collect your personal information. All of the information you provide via Amazon Transparency is collected and stored by Amazon. We encourage you to read Amazon’s privacy policy, which can be accessed by clicking here, before using the Amazon Transparency integration service to understand, and be aware of Amazon’s privacy practices, and how your personal information may be used.

3. How we collect personal information

3.1 We may collect your personal information:

  1. (a) Directly from you via the Website, OwlQR Platform, phone, email, and/or another form of communication.
  2. (b) From publicly available sources.
  3. (c) From third parties.
  4. (d) Automatically when you use the Website, including through the use of cookies. For more information on the cookies on our Website, please read our Cookies Policy by clicking here.

4. Why we collect personal information

4.1 We collect your personal information for various reasons, including:

  1. (a) to verify your identity;
  2. (b) in connection with the provision (or potential provision) of the OwlQR Platform and/or Services to you;
  3. (c) to communicate with you in relation to the OwlQR Platform and/or Services;
  4. (d) to provide customer support, including responding to communications from you;
  5. (e) to invoice you and to collect money that you owe us, including authorising and processing payment card transactions;
  6. (f) to improve our OwlQR Platform and/or Services, and/or the Website based on your feedback;
  7. (g) to provide you with promotional offers, newsletters, and otherwise market our OwlQR Platform and/or Services to you, including contacting you electronically (for example, by text, email or an online messaging platform);
  8. (h) to create and manage product serialisation codes and QR codes, including assigning unique codes to products and managing those codes throughout the product lifecycle;
  9. (i) to verify the authenticity of products, including by recording and reviewing information generated when a product QR code or serialisation code is scanned;
  10. (j) to identify and investigate unusual or potentially suspicious scanning activity, such as an unusually high number of scans or scans associated with a country or location that may be unexpected for the relevant product;
  11. (k) to prepare compliance reports and assess export readiness;
  12. (l) to comply with our legal obligations;
  13. (m) to protect and/or enforce our legal rights and interests, including by monitoring suspicious or fraudulent activity and defending any claim;
  14. (n) to co-operate with any government, industry, legislative, or regulatory authorities;
  15. (o) for any other purpose authorised by you or the Privacy Act; or
  16. (p) for any other purpose notified to you at the time your personal information is collected.

4.2 The Company reserves the right to use data (on an anonymous basis) in relation to your use of the Website and/or the OwlQR Platform and/or Services, for marketing and accounting purposes.

5. How we share personal information

5.1 Unless expressly authorised to do so by you or under this privacy policy, we will not disclose your personal information to any third party except where disclosure relates to the purposes for which the information was collected (as stated in clause 4 above) or where we may be required by law to do so.

5.2 Without limiting the generality of clause 5.1, we may disclose your personal information to:

  1. (a) people within our business;
  2. (b) our related companies;
  3. (c) third party providers, including data storage and cloud hosting providers (including Amazon Web Services (AWS)), IT support, software development and platform service providers, payment processing providers (including Stripe), professional advisers (including accountants, auditors and legal advisers), and artificial intelligence service providers where OwlQR has approved their use, and personal information may be processed through those services. All such providers are required to handle personal information in accordance with contractual confidentiality and security obligations;
  4. (d) debt collection agencies;
  5. (e) an actual or potential buyer (and its advisors) in connection with the proposed purchase or merger of any part of our business;
  6. (f) regulators, law enforcement bodies, government agencies, courts and other dispute resolution providers;
  7. (g) any person or organisation as required by law, court order and/or regulatory authority;
  8. (h) any person or organisation authorised by you; or
  9. (i) any person or organisation authorised by the Privacy Act and any other applicable legislation.

5.3 If you do not want us to share your personal information, please contact our privacy officer using the details at clause 8. If you ask us not to share your personal information with certain third parties, we may not be able to provide you with access to the OwlQR Platform and/or Services However, there may be circumstances where we are required by law to disclose your personal information and, in such circumstances, we will comply with our legal obligations irrespective of your request.

5.4 We may share your personal information with third parties based outside of New Zealand, including Australia, the United States and Europe, where necessary and to provide the OwlQR Platform and Services to you. This includes disclosing personal information to:

  1. (a) AWS, which hosts the OwlQR Platform and stores personal information in Sydney, Australia;
  2. (b) Google Analytics, which may process the IP addresses of individuals who scan a QR code and information about the scanned code, including in the United States;
  3. (c) Amazon CloudFront, which may process requests to the OwlQR Platform through edge locations in the United States, Europe and other locations, although information is not logged at these edge locations;
  4. (d) Amazon Bedrock, which may process text and documents uploaded by customers for the purposes of generating or populating content, and which may process that information in any AWS commercial region; and
  5. (e) third party services embedded or linked by a brand on its product pages, such as OpenStreetMap, YouTube and Vimeo, which may receive the IP address of an individual accessing the relevant product page.

5.5 Where we transfer your personal information overseas, we take reasonable steps to ensure it is protected in accordance with this privacy policy, the Privacy Act and any other applicable legislation. All such third party providers are also required to handle personal information under contractual confidentiality and security obligations.

6. How we hold and protect personal information

6.1 We will take all reasonable steps to ensure that personal information collected, used or disclosed in accordance with this privacy policy is stored and handled securely and is protected against unauthorised access, use, modification, disclosure, loss or destruction. Our security measures include:

  1. (a) encrypting personal information at rest using AES-256 encryption and in transit using TLS 1.2 or higher;
  2. (b) hosting the OwlQR Platform and personal information using AWS in the Sydney, Australia;
  3. (c) hashing IP addresses before storage using a keyed HMAC-SHA-256 hash of the IP address, the current date and a secret key held in AWS Secrets Manager, truncated to 64 bits, so that the stored value cannot be reversed to the original IP address without the key and changes each day;
  4. (d) applying role based access controls to limit access to personal information to authorised users based on their role and access requirements; and
  5. (e) maintaining audit logs of state changing operations to monitor and support the security and integrity of the OwlQR Platform and personal information.

6.2 We may update or change our security measures from time to time where reasonably necessary to maintain or improve the security of personal information.

6.3 We will hold personal information collected in accordance with this privacy policy for as long as necessary to:

  1. (a) provide the OwlQR Platform and/or Services to you, and for any period afterwards where we have an ongoing business or legal need to retain it;
  2. (b) maintain secure backups consistent with our security practices;
  3. (c) respond to or defend any actual or potential claims arising from our provision of the OwlQR Platform and/or Services; and/or
  4. (d) comply with our legal and regulatory obligations.

6.4 If you request that we delete your personal information, we will take reasonable steps to delete or de-identify it, unless we are legally required, or otherwise have a legitimate and lawful reason, to retain it. Where personal information is retained in backups, we will delete it in accordance with our applicable backup retention processes.

7. Rights to access personal information

7.1 You have the right to request a copy of the personal information we hold about you and to request that we update anything that is incorrect or outdated. These rights are subject to certain grounds for refusal under the Privacy Act.

7.2 If you wish to exercise any of the rights described in clause 7.1, please contact our privacy officer using the details at clause 8.

7.3 We may charge a fee for providing access to your personal information. We will advise you of this fee before actioning your request.

8. Third party links

8.1 The Website and/or OwlQR Platform may contain links to other websites. These links are provided for your information only, and we have no control over the content of those websites. By clicking on any third party links, you agree that we will not be liable to you or any other party arising from your access or use of a third party website.

8.2 For example, our Website and/or OwlQR Platform may include links to social media websites, such as Facebook and LinkedIn. These social media websites may collect your personal information. Your interactions with these social media websites are governed by their own privacy policy.

8.3 We encourage you to always read the privacy policies of every third party website and/or link, to understand and be aware of their privacy practices, and how your personal information may be used.

9. How to contact us

9.1 If you wish to exercise your rights under clause 7 or otherwise have questions about this privacy policy, or want to make a complaint, please contact our privacy officer (details below).

Privacy officer: Carrick Graham

Email: hello@OwlQR.com

Address: BFA, 109 Tūwharetoa Street, Taupo, Taupo, 3330, New Zealand

9.2 If, after contacting us, you are not satisfied with our response, you can submit a complaint to the New Zealand Privacy Commissioner, by clicking here.

10. General

10.1 We may vary this privacy policy from time to time. We will provide notice of the change by uploading the updated privacy policy on the Website. After we provide that notice you will be deemed to have accepted the updated privacy policy if you continue to use the Website and/or the OwlQR Platform and/or Services.

10.2 If any provision in this privacy policy is found by a court to be invalid, void, or unenforceable, whether under the Privacy Act or any other applicable law, such provision will be deemed to be deleted from this privacy policy and the remaining provisions will continue in full force and effect.