Privacy Policy

Effective September 2026

This policy explains how GCA Lawyers (GCA, we, us or our) collects, uses, discloses, stores and protects personal information. It applies to clients, prospective clients and other people whose personal information we handle. Our professional duties of confidentiality and legal professional privilege continue to apply in addition to this policy.

Personal information we collect

The personal information we collect depends on our relationship with you and the work involved. It may include:

• identity and contact information, including identification documents and information about directors, shareholders, trustees, beneficiaries and related persons
• information required for client due diligence, including source of funds or wealth information
• communications, instructions, evidence and other information relating to an enquiry, transaction or dispute
• financial, billing, credit and trust account information
• information from our website and electronic systems, including technical and security information.

How we collect information

We usually collect personal information directly from the person concerned. We may also collect it from clients, representatives, other parties, witnesses, experts, courts and tribunals, public registers, government agencies, identification and screening providers, credit agencies and other lawful sources.

Where we collect personal information about a person from someone else, we will consider whether Information Privacy Principle 3A applies. Unless the person has already been made aware or an exception applies, we will take reasonable steps, as soon as reasonably practicable after collection, to make the person aware of the matters required by the Privacy Act 2020. Notification will not be required where doing so would breach or undermine legal professional privilege or a duty of confidentiality, prejudice the purpose for which the information was collected or court or tribunal proceedings, or where another legal exception applies.

Why we use information

We may use personal information to:

• consider an enquiry, complete conflict checks and decide whether we can act
• provide legal services and carry out instructions
• verify identity and comply with legal and professional obligations, including anti-money laundering requirements
• communicate with clients and other people involved in a matter
• operate, secure and improve our practice and systems
• for internal purposes such as, but not limited to, staff training, business development, billing, debt collection, health and safety and other matters relating to the operation of our business
• issue invoices, assess credit and recover unpaid amounts
• provide legal updates or other marketing where permitted.

If required information is not provided, we may be unable to act, continue acting or complete a transaction.

Who we may share information with

We may disclose personal information where reasonably necessary for these purposes, where authorised, or where required or permitted by law or our professional obligations. Recipients may include:

• our employees, contractors, agents and service providers, including providers of practice management, document storage, communications, information technology, security, identification, screening and artificial intelligence tools
• counsel, experts, agents and other professional advisers engaged in connection with a matter
• courts, tribunals, mediators, arbitrators, other parties, lawyers, witnesses and relevant organisations
• banks, auditors, insurers, regulators, government agencies, law enforcement agencies, credit agencies and debt collection providers.

We disclose confidential client information only where permitted by our professional obligations and terms of engagement.

Information handled outside New Zealand

Some service providers may store or process information outside New Zealand. We take reasonable steps to ensure that personal information handled overseas is appropriately protected and, where the disclosure rules in the Privacy Act apply, that the recipient provides safeguards comparable to those required in New Zealand or another lawful basis applies.

Security and retention

We use reasonable physical, technical and organisational safeguards to protect personal information against loss, unauthorised access, use, modification or disclosure. No method of storage or communication is completely secure.

We retain personal information for as long as reasonably required for the purpose for which it was collected, our professional and business purposes, and any applicable legal or regulatory requirements. We then securely delete or destroy it where reasonably practicable. Client files are generally retained for at least six years from the later of our final invoice and the last trust account transaction relating to a matter, and may be retained for longer.

Access and correction

You may ask to access or correct personal information we hold about you. Some information may be withheld where permitted by law, including where it is protected by legal professional privilege or another person's privacy.

Contact and complaints

Requests, questions or complaints may be sent to the Privacy Officer at enquiry@gcalawyers.com, by telephone on +64 3 365 1347, or by post to PO Box 3241, Christchurch 8140, New Zealand.

You may also complain to the Office of the Privacy Commissioner at privacy.org.nz.

General

We may modify or amend this Privacy Policy at any time