Checkmate Privacy Policy
Last updated: 20 October 2026
This privacy policy sets out how we, Checkmate Limited (Checkmate, we, us and our), collect, store, use and disclose your Personal Information when you use or interact with our Website, checkmate.tech (Website), access and use our products or services (together, Services) or otherwise deal with us. Personal Information means information about an identified individual or an individual who is reasonably identifiable (Personal Information).
Checkmate Limited is a company incorporated in New Zealand, with its registered office in Wellington.
When handling Personal Information, we will comply with all privacy and data protection laws applicable to us from time to time (Applicable Privacy Laws), including, where applicable, the New Zealand Privacy Act 2020, the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018 and Regulation (EU) 2016/679 (EU GDPR).
Checkmate acts both as a processor and, in some cases, as a controller. For candidate screening, reference checking, background screening and workforce compliance services that we provide on behalf of our customers, we generally act as a processor and process Personal Information on our customer's instructions. For our Website, marketing, customer administration, platform security, fraud detection, Service improvement and certain compliance activities (as well as, in limited cases, internal technical support, troubleshooting, bug investigation and reproduction, regression and functional testing, service validation and identity-verification template improvement activities, we generally act as a controller), we generally act as a controller. Where we act as a processor on behalf of a customer, that customer is generally responsible for determining the purposes and means of processing the relevant Personal Information and for providing any notices required by law. Where we process candidate or employee Personal Information for our own internal technical, security, quality assurance or service improvement purposes, we will do so only where we have a lawful basis and subject to appropriate safeguards.
Contents
- Summary
- Our details
- Who we collect personal information from
- Collection, use and disclosure of personal information
- When you visit our Website
- When you contact us
- When you register on our Website
- Referees
- Candidates and Employees
- When you place an order
- Processing payments
- Newsletters
- Marketing communications
- Information obtained from third parties
- Disclosure and additional uses of your information
- Do we sell your Personal Information to third parties
- How long we retain your information
- Overseas Transfers of your Personal Information
- How we secure your Personal Information
- Sensitive information
- Children's privacy
- Your rights in relation to your Personal Information
- How to contact us
- Changes to our privacy policy
Summary
This section summarises how we obtain, store and use Personal Information. It is intended to provide a very general overview only. It is not complete in and of itself and it must be read in conjunction with the corresponding full sections of this privacy policy.
How we collect or obtain your Personal Information: when you provide it to us directly, when our customers upload candidate, employee or referee information into our Services, when referees complete reference requests, when you contact us, register for an account, place an order, sign up for updates or newsletters, use our Website, or where we receive information from third parties or publicly available sources as permitted by law.
Personal Information we collect: may include your name, contact details, account details, employment- or screening-related information, identity verification information (including selfie images, government-issued identity documents and, where relevant, government certificate), right-to-work, visa and immigration information, criminal conviction information where relevant and lawful, payment-related information, IP address, cookie and device information, and information about how you use our Website and Services.
How we use your Personal Information: for administrative and business purposes (particularly to contact you and process orders you place on our Website, to improve our business and Website, to perform Services for our customers and fulfil our contractual obligations, to advertise our and other’s goods and services, to analyse your use of our Website, and in connection with our legal rights and obligations, and where necessary and lawful, to maintain, secure, troubleshoot, test, validate and improve our identity verification and related Services, including limited bug investigation and reproduction, regression and functional testing, and document-template support activities where genuine production data is required and synthetic, anonymised or de-identified data is not technically suitable.
Disclosure of your Personal information: user Personal Information can be shared with partners for specific types of content and events where a user has registered their information. Other disclosures are only to the extent necessary to run our business, to our service providers, to fulfil any contracts we enter into with you and where required by law or to enforce our legal rights. This may include limited disclosure of identity document data to specialist identity verification or document-tender support providers where necessary to support or improve document recognition capabilities used in our Services.
Do we sell your Personal Information to third parties (other than in the course of a business sale or purchase or similar event): No, we do not sell your Personal Information. However, when you register or sign up for certain types of content, your registration data can be shared with sponsors and partners. We will always make it clear where any information provided will be shared with other parties.
How long we retain your Personal Information: for no longer than necessary, taking into account any legal obligations we have (e.g. to maintain records for tax purposes), any other legal basis we have for using your Personal Information (e.g. your consent, performance of a contract with you or our legitimate interests as a business) and certain additional factors described in the main section below entitled How long we retain your information. For specific retention periods in relation to certain Personal Information that we collect from you, please see the main section below entitled How long we retain your information. This includes specific retention controls for production data used for technical support, testing, validation and template-improvement activities.
How we secure your Personal Information: using appropriate technical and organisational measures such as storing your Personal Information on secure servers, encrypting transfers of data to or from our servers using Secure Sockets Layer (SSL) technology, encrypting payments you make on or via our Website using Secure Sockets Layer (SSL) technology and only granting access to your Personal Information where necessary. For higher-risk identity verification data used for technical support or testing, we also apply role-based access control, data minimisation, internal approval processes, logging or monitoring of access where appropriate, secure transfer methods and deletion or de-identification controls after use.
Use of cookies and similar technologies: we use cookies and similar technologies on our Website, including essential cookies and, where enabled, functional, analytics and advertising or targeting cookies. Where required by law, we will obtain your consent before using non-essential cookies or similar technologies. You can manage your preferences through our cookie settings tool or your browser settings. For more information, including the types of cookies we use, the purposes for which we use them and their retention periods, please see our Cookies Policy at https://www.checkmate.tech/utility/cookies-policy.
Overseas transfers of your Personal Information: your Personal Information may be transferred outside New Zealand and, where relevant, outside the UK, including to service providers in Australia, the United States, the United Kingdom and other countries in which our service providers operate. This may include specialist identity verification or document-template support providers engaged in connection with our Services. Where required by law, we use appropriate safeguards for those transfers.
Use of profiling: we may use limited profiling and analytics to understand how users interact with our Website and Services and to improve user experience and communications. We may also use limited automated validation and testing processes in connection with identity verification workflows. We do not make solely automated decisions that produce legal or similarly significant effects unless we notify you and have a lawful basis to do so.
Your rights in relation to your Personal Information: Depending on where you are located, the following rights may be available to you in respect of your Personal Information:
- to access your information and to receive information about its use
- to have your information corrected and/or completed
- to have your information deleted
- to restrict the use of your information
- to receive your information in a portable format
- to object to the use of your information
- to withdraw your consent to the use of your information
- to complain to a supervisory authority
Sensitive Information: We do not generally seek to collect sensitive information unless it is necessary for the Services or otherwise permitted by law. Where we process special category data, criminal conviction information or other sensitive compliance-related information, biometric information used for identity verification, we do so only where we have an appropriate lawful basis and any additional condition required by law.
Where selfie images or document photos are processed through specific technical means for face matching, identity verification or similar unique identification purposes, we will treat that processing as involving biometric information and apply the additional protections required by applicable law. Where such information is used for limited internal technical support, testing, troubleshooting or Service-improvement purposes, we will do so only where lawful, necessary and proportionate. If you do not consent to us collecting and disclosing your biometric information for these purposes, you will need to contact us directly (by email: team@checkmate.tech).
Where we undertake biometric processing, including face matching or identity verification activities involving selfie images or document photographs, we will assess whether the processing is lawful, necessary, proportionate and reasonably required for the relevant purpose. We will consider whether less privacy-intrusive alternatives are available and whether those alternatives are technically capable of achieving the same outcome. We maintain appropriate governance, risk assessment, security and oversight processes for biometric processing and will apply any additional safeguards required by applicable law.
Our details
If you have any questions about this privacy policy, please contact our Privacy Officer, who can be contacted at, team@checkmate.tech or by visiting our contact page for other options of contacting us.
Where applicable law requires us to appoint a representative in the United Kingdom or European Union, details of that representative will be made available in this privacy policy or on our Website.
Who we collect personal information from
We collect Personal Information from:
- you, when you provide that Personal Information to us, through use of our Website and/or our Services, or through any other interactions with us (e.g. in person, via telephone, email or otherwise).
- third parties, where you have authorized this or the information is publicly available.
- use of our Website and/or Services, e.g. any action an individual takes while using our Website or our Services. We use this information for the purposes described below.
We do not knowingly collect Personal Information directly from children under the age of 18 through our Website, except where this is necessary in connection with Services lawfully requested by our customers and permitted by applicable law. If you believe a child has provided Personal Information to us unlawfully, please contact us and we will review the matter and, where appropriate, delete the information.
Providing your Personal Information and allowing us to use it in accordance with this privacy policy is optional. However, if you choose not to provide necessary Personal Information, we may be unable to provide you with certain services.
Collection, use and disclosure of personal information
We collect, use and disclose Personal Information in accordance with this section and the section entitled Disclosure and additional uses of your information.
When you visit our Website
Web server log information
Our Website server automatically logs the IP address you use to access our Website as well as other Personal Information about your visit such as the pages accessed, information requested, the date and time of the request, the source of your access to our Website (e.g. the website or URL (link) which referred you to our Website), and your browser version and operating system.
Use of Website server log information for IT security purposes
We collect and store server logs to help ensure network and IT security and so that the server and Website remain uncompromised. This includes analysing log files to help identify and prevent unauthorised access to our network, the distribution of malicious code, denial of service attacks and other cyber-attacks, by detecting unusual or suspicious activity.
Unless we are investigating suspicious or potential criminal activity, we do not make, nor do we allow our hosting provider to make, any attempt to identify you from the information collected via server logs.
Legal basis for processing: Our legitimate interests and, where applicable, compliance with legal obligations.
Legitimate interests: Maintaining the security, integrity, availability and performance of our Website, systems and services; preventing misuse; investigating suspicious activity; and improving Website functionality and user experience.
Legal obligation: In some cases, we may also process this information where necessary to comply with applicable laws, regulations or lawful requests relating to cybersecurity, law enforcement, regulatory compliance or record-keeping.
Use of Website server log information to analyse Website use and improve our Website
We use the information collected by our Website server logs to analyse how our Website users interact with our Website and its features. For example, we analyse the number of visits and unique visitors we receive, the time and date of the visit, the location of the visit and the operating system and browser use.
We use the information gathered from the analysis of this information to improve our Website. For example, we use the information gathered to change the information, content and structure of our Website and individual pages according to what users are engaging most with and the duration of time spent on particular pages on our Website.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Improving our Website for our Website users and getting to know our Website users’ preferences so our Website can better meet their needs and desires.
Cookies
Cookies are data files which are sent from a Website to a browser to record information about users for various purposes.
We use cookies and similar technologies on our Website, including essential cookies and, where enabled, functional, analytics and advertising or targeting cookies. Where required by law, we will obtain your consent before using non-essential cookies or similar technologies. You can manage your preferences through our cookie settings tool or your browser settings. For more information, including the types of cookies we use, the purposes for which we use them and their retention periods, please see our Cookies Policy at https://www.checkmate.tech/utility/cookies-policy.
When you contact us
When you send an email to the email address displayed on our Website we collect your email address and any other Personal Information you provide in that email (such as your name, telephone number and the information contained in any signature block in your email).
Legal basis for processing: Our legitimate interests.
Legitimate interests: Responding to enquiries and messages we receive and keeping records of correspondence.
Legal basis for processing: Necessary to perform a contract or to take steps at your request to enter into a contract.
Reason why necessary to perform a contract: Where your message relates to us providing you with Services or taking steps at your request prior to providing you with our Services (for example, providing you with information about such Services), we will process your Personal Information in order to do so).
Upload features
When you upload information via any upload feature within the Website or Services, we collect information including your name, address and results of background, compliance and reference checks and inquiries on behalf of our clients.
Legal basis for processing: Necessary to perform a contract and, depending on the circumstances, our legitimate interests or compliance with legal obligations.
Reason why necessary to perform a contract: Providing you (and, if you are a candidate or employee of one of our clients, your potential or current employer, as applicable) with our Services.
Enquiry forms
When you contact us using an enquiry form, we collect your personal details and match this to any Personal Information we hold about you on record. Typical Personal Information collected will include your name and contact details. We will also record the time, date and the specific form you completed.
If you do not provide the mandatory information required by our contact form, you will not be able to submit the contact form and we will not receive your enquiry.
Legal basis for processing: Our legitimate interests.
Legitimate interests: We process personal Information submitted through enquiry forms for our legitimate interests in responding to enquiries, administering our relationship with you and keeping records of communications. Where your enquiry relates to potential or actual Services, we may also process that information where necessary to take steps at your request before entering into a contract or to perform a contract. We will only use enquiry information for marketing where permitted by law.
Phone and post
When you contact us by phone, we collect your phone number and any information you provide during the call. We may record customer-facing calls for training, quality assurance and customer service purposes, and where we do so we will retain recordings only for as long as reasonably necessary for those purposes and in accordance with our retention practices.
If you contact us by post, we will collect any information you provide to us in any postal communications you send us.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Responding to enquiries and messages we receive and keeping records of correspondence.
Legal basis for processing: Necessary to perform a contract or to take steps at your request to enter into a contract.
Reason why necessary to perform a contract: Where your message relates to us providing you with our Services or taking steps at your request prior to providing you with our Services (for example, providing you with information about such Services), we will process your Personal Information in order to do so).
When you register on our Website
We collect and use Personal Information from individuals who interact with particular features of our Website in accordance with this section and the section entitled Disclosure and additional uses of your information.
When you register and create an account on our Website, we collect Personal Information such as your name, email address, address and location, together with the time and date of registration. We use this information to create and administer your account, provide access to the relevant parts of the Website or Services, and manage our relationship with you.
If you do not provide the mandatory information required by the registration form, you will not be able to register or create an account on our Website.
Information you submit to us via the registration form on our Website will be stored on our third-party hosting provider’s servers located in Australia.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Registering and administering accounts on our Website to provide access to content, allow you to buy Services and facilitate the running and operation of our business.
If registration information is also used to send marketing communications, we will do so only where permitted by law, and you can opt out at any time. For further information, see the section of this privacy policy entitled Marketing Communications.
Referees
When you act as a referee, or where one of our users provides your details so that we can request a reference from you, we may collect your name, email address, the time and date of the request, your relationship to the candidate, and the information you choose to provide in response to a reference request.
Where we receive your details indirectly, we will provide any notice required by applicable law, unless an exception applies.
If you do not provide the information marked as mandatory in a reference request or referee form, you may be unable to complete the reference process or we may be unable to provide the relevant Services to our customer.
Legal basis for processing: Our legitimate interests and, depending on the circumstances, the legitimate interests of our customer in obtaining references and related services.
Legitimate interests: Administering the referee process and facilitating the running and operation of our business and Services.
Removal of your personal data
If your Personal Information has been submitted on our Website without authority, or you would like to request removal of your Personal Information from our systems, please email team@checkmate.tech and we will review your request in accordance with Applicable Privacy Laws. To read more about your rights please see the section entitled Your rights in relation to your information.
Additional information
When completing a referee form, you may be asked additional questions relevant to the reference process. That information may be made available to the relevant employer or customer as part of the Services. If we ask you to verify your identity, we will do so using reasonable and proportionate methods and only where we have a lawful basis.
Transfer and storage of your information
Information you submit to us via the referee form on our Website will be stored on our third-party hosting provider’s servers located in Australia.
Candidates and Employees
When you are registered as a candidate or employee, whether by you or by one of our customers using our Services, we may collect your name, contact details, the time and date of registration, and other Personal Information relevant to the screening, compliance, verification or employment-related Services requested by our customer. Depending on the Service, this may include identity verification information such as selfie images, government issued identity documents (for example, passports, driver licenses and other identity cards), government certificates where relevant or required (for example, birth, citizenship, marriage and name change certificates), and candidate profile information relevant to the Services.
If you do not provide the mandatory information required by the candidate or employee form, you will not be able to register or create an account on our Website.
Depending on the context, we process candidate and employee Personal Information either on behalf of our customer or for our own purposes. Where we process that Personal Information on behalf of our customer in connection with screening, reference checking, background checking, workforce compliance or similar services, we generally act as a processor and process that information in accordance with our customer's instructions. Where we process that Personal Information for our own purposes, such as service administration, platform security, fraud prevention, legal compliance, billing, internal reporting, product maintenance or service improvement, we generally act as a controller. This may include, in limited circumstances, using production candidate or employee data for internal technical support, troubleshooting, bug investigation and reproduction, regression and functional testing, validation of identity verification workflows, and improvement of document recognition or template support where such data is reasonably necessary and lower-risk alternatives are not technically adequate. Where we act as a controller, we will process Personal Information only where we have a lawful basis under applicable law, which may include legitimate interests, compliance with legal obligations, performance of a contract or consent where required. Where we rely on legitimate interests for these internal technical purposes, those interests include maintaining the accuracy, security, reliability and effectiveness of our identity verification and related Services. Where special category data, biometric data or criminal conviction information is processed, we will also ensure that any additional condition required by law is satisfied.
In limited circumstances, and where permitted by applicable law, we may use certain candidate or employee Personal Information for internal technical purposes connected with our identity verification and related Services. These purposes may include:
- investigating, reproducing, diagnosing and resolving technical issues;
- validating fixes and carrying out regression or functional testing of identity verification workflows; and
- supporting the creation, correction or improvement of document-recognition templates where an existing template is inaccurate or unavailable.
Depending on the purpose, this may involve the use of limited production data, including identity verification information, where synthetic, anonymised, de-identified or other lower-risk alternatives are not technically suitable. We will only use the information reasonably necessary for the relevant purpose and will apply appropriate safeguards, including access restrictions, approval controls, secure handling requirements and retention limits.
Where we undertake this processing for our own purposes, we will do so only where we have a lawful basis under applicable law and, where required, have assessed the necessity, proportionality and privacy impacts of the processing.
Removal of your personal data
If your Personal Information has been submitted on our Website without authority, or you would like to request removal of your Personal Information from our systems, please email us at, team@checkmate.tech and we will review your request in accordance with Applicable Privacy Laws. To read more about your rights please see the section entitled Your rights in relation to your information.
Additional information
When completing a candidate, employee or other relevant form, you may be asked for additional Personal Information relevant to the Services, including information needed for identity verification, right-to-work checks, visa or immigration checks, background screening and other compliance checks. If we need to verify information through a government agency or other official source, we will do so only where we have a lawful basis and, where required, your prior authorisation.
Transfer and storage of your Personal Information
Personal Information you submit to us via the referee or any other relevant form or otherwise upload on our Website will be stored on our third-party hosting provider’s servers located in Australia. In some cases, Personal Information used for the limited technical purposes described in this privacy policy may also be accessed by or disclosed to authorised personnel or specialist service providers outside New Zealand, including in the United States or other jurisdictions in which those providers operate, subject to the safeguards described in this privacy policy.
When you place an order
We collect and use information from individuals who place an order on our Website in accordance with this section and the section entitled Disclosure and additional uses of your Personal Information.
Mandatory information
When you place an order for Services on our Website, we collect your name, email address, billing address.
If you do not provide this information, you will not be able to purchase Services from us on our Website or enter into a contract with us.
Legal basis for processing: Necessary to perform a contract and compliance with legal obligations.
Compliance with a contract: We process order information as necessary to enter into and perform our contract with you, including providing the Services you have ordered, administering your account and communicating with you about your order
Legal obligation: We may also retain and use certain order and transaction records where necessary to comply with applicable tax, accounting, financial reporting and record-keeping obligations
Additional information
We may also collect additional Personal Information such as your phone number, full name and address where needed to administer your account, provide support, manage delivery of Services and improve customer experience. If certain additional information is required to process your order, we will identify it as mandatory.
We use this information to manage and improve your customer experience with us. We may also use this information to tailor follow up sales and marketing communications with you where permitted by law. For further information, see the section of this privacy policy entitled Marketing Communications.
If you do not supply the additional information requested at checkout, you will not be able to complete your order as we will not have the correct level of information to adequately manage your account.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Registering and administering accounts on our Website to provide access to content, allows you to buy Services and facilitates the running and operation of our business.
Processing payments
After you place an order on our Website you will need to make payment for the Services you have ordered. In order to process your payment, we use Stripe, a third party payment processor.
We use Stripe as our payment processor. Payment information is processed as necessary to perform our contract with you, and certain related records may be retained to comply with legal obligations. Stripe processes payment information in accordance with its own privacy notice, available at https://stripe.com/gb/privacy.
Legal basis for processing: Necessary to perform a contract and compliance with legal obligations.
Compliance with a contract: Your payment information is processed as necessary to take payment for the Services you have ordered and to perform our contract with you.
Legal obligation: Certain payment and transaction records may also be retained where necessary to comply with applicable tax, accounting, fraud prevention and financial reporting obligations
Transfer and storage of your information
As a consequence of using the services of Stripe, your personal data may be transferred outside New Zealand to jurisdictions in which Stripe operates, which may include the United States of America.
For further information about the safeguards used when your Personal Information is transferred outside of New Zealand, see the section below entitled Overseas transfers of your information.
Newsletters
When you sign up to receive our newsletters or other marketing updates, we collect your name, email address and the date and time of sign-up. We use this information to send you the communications you have requested and to maintain suppression and preference records. We will send those communications on the basis of consent where required by law, or otherwise where permitted by law. You can unsubscribe at any time by using the unsubscribe link in the relevant message or by contacting us at team@checkmate.tech.
We may use a third-party provider, such as Mailchimp, to manage mailing lists and send newsletters on our behalf. Information submitted for newsletter subscriptions may be stored on that provider's servers outside New Zealand, including in the United States or other jurisdictions in which that provider operates. For further information about overseas transfers and the safeguards we use, see the section entitled Overseas Transfers of your Personal Information.
Our marketing emails may use technologies such as tracking pixels and tracked links to help us measure delivery, opens, clicks and content engagement. Where required by law, we will use those technologies only with your consent or another valid lawful basis.
Legal basis for processing: Consent.
Consent: You give your consent to us sending you our newsletters by signing up to receive them using the steps described above.
Transfer and storage of your information
We use a third-party provider, such as Mailchimp, to administer our mailing list and send newsletters. Information submitted for newsletter subscriptions may be stored on that provider's servers outside New Zealand, including in the United States.
For further information about the safeguards used when your Personal Information is transferred outside the European Economic Area and the United Kingdom, see the section below entitled Overseas transfers of your information.
Use of tracking in emails
We may use technologies such as tracking pixels and tracked links in marketing emails to understand delivery, opens, clicks and general engagement with our communications. Where required by law, we will do so only on the basis of consent or another valid lawful basis.
Marketing communications
Our content, goods and services
Where permitted by law, we may send you marketing communications about our Services and related content. In some cases, this will be based on your consent. In other cases, where permitted by law, we may rely on our legitimate interests to send you information about similar services, subject always to your right to opt out. We will not send third-party marketing to you unless you have consented where required.
You can opt out of marketing communications at any time by using the unsubscribe link in the relevant communication or by emailing team@checkmate.tech.
Legal basis for processing: Our legitimate interests, and where required by Applicable Privacy Laws, consent.
Legitimate interests: Sharing relevant, timely and industry-specific information on related business services, in order to assist your organisation to grow.
Third party goods and services
In addition to receiving information about our products and Services, you can opt in to receiving marketing communications from us in relation to third party goods and services by email by ticking a box indicating that you would like to receive such communications.
Legal basis for processing: Consent.
Consent: you give your consent to us sending you information about third party goods and services by signing up to receive such information in accordance with the steps described above.
Transfer and storage of your information
Information for marketing campaigns will be stored on our third-party mailing list provider’s servers in the United States.
For further information about the safeguards used when your Personal Information is transferred outside New Zealand, the European Economic Area and the United Kingdom, see the section of this privacy policy below entitled Overseas transfers of your information.
Use of tracking in emails
We use technologies such as tracking pixels (small graphic files) and tracked links in the emails we send to allow us to assess the level of engagement our emails receive by measuring information such as delivery rates, open rates, clickthrough rates and content engagement. Where required by law, we will do so on the basis of consent.
Information obtained from third parties
We may receive Personal Information about you from our customers, business contacts, publicly available sources, referees, identity verification sources, government or official databases where lawful, and other third parties where permitted by law. The categories of Personal Information obtained will depend on the Services being provided and may include identity verification information (such as, selfie images, identity documents, government certificates and candidate profile data) where relevant to the Services or to limited technical support, troubleshooting or validation activities described in this privacy policy. Where we collect Personal Information indirectly, we will provide any notice required by law unless an exception applies.
Information we obtain from third parties will generally be your name, contact details and information required to fulfil candidate and employee compliance checks we have been engaged to perform, but may include any additional information about you which they provide to us.
Where we collect Personal Information about you from a third party rather than directly from you, we will, where required by law, take reasonable steps to make you aware of the fact of collection, the purpose of collection, the intended recipients, our details, and your rights of access to and correction of that information, unless an exception applies.
Legal basis for processing: Necessary to perform a contract or to take steps at your request to enter into a contract.
Reason why necessary to perform a contract: Where a third party has passed on Personal Information about you to us (such as your name and email address) in order for us to provide Services to you or our customer, we will process your information in order to take steps at your request to enter into a contract with you or perform a contract (as the case may be).
Legal basis for processing: Consent.
Consent: Where you have asked that a third party share Personal Information about you (or consented to such sharing of Personal Information about you) with us and the purpose of sharing that information is not related to the performance of a contract or Services by us to you, we will process your Personal Information on the basis of your consent.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Where a third party has shared Personal Information about you with us and you have not consented to the sharing of that information, we may have a legitimate interest in processing that information in certain circumstances, including to perform our obligations under a sub-contract with the third party. Similarly, third parties may pass on Personal Information about you to us if you have infringed or potentially infringed any of our legal rights. In this case, we will have a legitimate interest in processing that information to investigate and pursue any potential infringement of our legal rights.
Where we receive Personal Information about you in error
If we receive Personal Information about you from a third party in error and/or we do not have a legal basis for processing that information, we will delete your information or otherwise handle it in accordance with applicable law.
Personal Information you provide to us about third parties
If you provide us with Personal Information about another person, you confirm that:
- they have authorised you to do so;
- they have been made aware that their Personal Information will be provided to us and that it may be accessed, used and/or disclosed by us in accordance with this privacy policy; and
- they have been made aware of this privacy policy, including their right to access and correct their Personal Information in this privacy policy.
Disclosure and additional uses of your information
This section sets out the circumstances in which we will disclose information about you to third parties and any additional purposes for which we use your information.
Disclosure of your Personal Information to our customers
We may disclose Personal Information to our customers, including current or prospective employers, where this is necessary to provide the Services, where the disclosure is authorised by the relevant individual or customer, or where another lawful basis applies.
Disclosure of your Personal Information to our service providers
We use third-party service providers, including hosting providers, IT service providers, payment processors, communications providers and screening or compliance support providers, to help us operate our Website, Services and business. We may also use specialist identity verification or document-template support providers.
We share Personal Information with service providers only where reasonably necessary for them to provide services to us or on our behalf. We require those providers to handle Personal Information in accordance with appropriate confidentiality, privacy and security obligations, and not to use it for unrelated purposes except as permitted or required by law. Where we share identity document information with a specialist document-template support provider, that provider may only use the relevant information for the limited purpose of creating, validating, correcting or improving document templates or related verification support used in our Services, and not for unrelated secondary purposes except as permitted or required by law.
Our third-party service providers are located both inside and outside of New Zealand (including in the European Economic Area, the United States of America and potentially other countries).
We do not display the identities of our service providers publicly by name for security and competitive reasons. If you would like further information about the identities of our service providers, however, please contact us directly by email and we will provide you with such information where you have a legitimate reason for requesting it (where we have shared your Personal Information with such service providers, for example). For transparency, this may include specialist providers engaged to support identity document verification or template improvement activities.
Where necessary to support or improve identity document recognition used in our Services, we may disclose limited samples of genuine identity documents to Regula, or another specialist provider performing an equivalent role, where an existing document template is inaccurate or unavailable.
Any such disclosure will be limited to the categories of documents reasonably required for the relevant template activity and, in the circumstances currently contemplated, would generally be limited to passports and identity cards such as driver licences, Medicare cards and student identification cards. Government certificates would not generally be disclosed for this purpose unless specifically required and lawful.
Such providers may only use the relevant information for the limited purpose of creating, validating, correcting or improving document-recognition templates or related verification functionality used in connection with our Services. We require those providers to comply with contractual obligations relating to confidentiality, information security, retention, deletion and restrictions on secondary use of the information.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Where we share your Personal Information with these third parties in a context other than where is necessary to perform a contract (or take steps at your request to do so), we will share your Personal Information with such third parties in order to allow us to run and manage our business efficiently.
Legal basis for processing: Necessary to perform a contract and/or to take steps at your request prior to entering into a contract.
Reason why necessary to perform a contract: We may need to share Personal Information with our service providers to enable us to perform our obligations under that contract or to take the steps you have requested before we enter into a contract with you.
Disclosure and use of your Personal Information for legal reasons
We may use or disclose Personal Information where necessary to prevent, detect or investigate unlawful activity, to enforce our legal rights, to comply with legal obligations, or in connection with actual or prospective legal proceedings.
Criminal conduct
If we suspect that criminal or potential criminal conduct has occurred, we may in certain circumstances need to contact an appropriate authority, such as the police. This could be the case, for instance, if we suspect that fraud or a cyber-crime has been committed or if we receive threats or malicious communications towards us or third parties.
We will generally only need to process your Personal Information for this purpose if you were involved or affected by such an incident in some way.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Preventing crime or suspected criminal activity (such as fraud).
Enforcement or potential enforcement of our legal rights
We may use your Personal Information in connection with the enforcement or potential enforcement of our legal rights, including, for example, sharing information with debt collection agencies if you do not pay amounts owed to us when you are contractually obliged to do so. Our legal rights may be contractual (where we have entered into a contract with you) or non contractual.
Legal basis for processing: Our legitimate interests and, where applicable, compliance with legal obligations.
Legitimate interests: Enforcing our legal rights and taking steps to enforce our legal rights.
Legal compliance
We may use your Personal Information in connection with compliance with our legal obligations under Applicable Privacy Laws and other applicable laws. This will include complying with any notification and reporting obligations and any access directions imposed on us by a Government agency, and otherwise where the law requires or allows us to do so.
Legal basis for processing: Compliance with legal obligations and, where applicable, our legitimate interests.
Legal obligations: Complying with obligations imposed on us by applicable law, regulation, court order or lawful request from a competent authority.
Legitimate interests: Establishing, exercising or defending legal claims; maintaining appropriate governance, risk management and internal compliance processes; and responding to legal or regulatory issues in a proportionate manner
Legal or potential legal dispute or proceedings
We may need to use your Personal Information if we are involved in a dispute with you or a third party for example, either to resolve the dispute or as part of any mediation, arbitration or court resolution or similar process.
Legal basis for processing: Our legitimate interests.
Legitimate interests: Resolving disputes and potential disputes.
Do we sell your Personal Information to third parties (other than in the course of a business sale or purchase or similar event)
We do not sell Personal Information in the ordinary sense. However, where you register for certain events, content or co-branded activities, we may share your registration information with the relevant sponsor or partner where we clearly tell you this at the time of collection.
How long we retain your information
We retain Personal Information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, meet legal and regulatory obligations, resolve disputes, enforce agreements and protect our legitimate business interests. Production data used for internal technical support, bug investigation, reproduction, regression testing, functional testing, validation or document-template improvement will be retained only for so long as is reasonably necessary to investigate, reproduce, diagnose, resolve and validate the relevant issue or complete the relevant template activity. Once that purpose has been completed, the information will be deleted, securely destroyed or de-identified where practicable, unless a longer retention period is required or permitted by law.
We have set out specific retention periods where possible below. Where that has not been possible, we have set out the criteria we use to determine the retention period. You can also find further information about certain retention and deletion practices in our data retention and deletion policy, at https://www.checkmate.tech/utility/checkmate-data-retention-and-deletion-policy.
Retention periods
Server log information: generally up to 3 months, unless a longer period is reasonably required for security, incident investigation, fraud prevention or legal compliance purposes.
Order and payment related information: generally retained for 7 years after the end of the relevant financial year where required for tax, accounting, audit and record-keeping purposes.
Correspondence and enquiries: retained for as long as reasonably necessary to respond to and manage the relevant enquiry or relationship, and for a reasonable period afterwards for record-keeping, legal or service-improvement purposes.
Newsletter and marketing records: retained until you unsubscribe, object, withdraw consent where applicable, or we otherwise stop sending the relevant communications, together with limited suppression information as needed to ensure your preferences are respected.
Candidate, referee, employee and screening records: retained for the period agreed with the relevant customer or otherwise for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes and meet evidential or compliance requirements, after which the information will be deleted or de-identified where practicable.
Reports prepared for customers: retained in accordance with our agreement with the relevant customer and our internal retention practices, after which they will be deleted or de-identified where practicable, unless a longer retention period is required or permitted by law.
Production data used for internal technical support, bug investigation, reproduction, regression testing, functional testing, validation or document template improvement: retained only for as long as reasonably necessary to investigate, reproduce, diagnose, resolve and validate the relevant issue or to support the relevant template activity, after which they will be deleted or de-identified where appropriate, unless a longer retention period is required or permitted by law. Where sample identity documents are shared with a specialist provider for template support, they will be retained only for as long as necessary for that purpose and in accordance with applicable contractual and internal retention controls.
Criteria for determining retention periods
In any other circumstances, we will retain your Personal Information for no longer than necessary, taking into account the following:
- the purpose(s) and use of your information both now and in the future (such as whether it is necessary to continue to store that information in order to continue to perform our obligations under a contract with you or to contact you in the future);
- whether we have any legal obligation to continue to process your information (such as any record-keeping obligations imposed by relevant law or regulation);
- whether we have any legal basis to continue to process your information (such as your consent);
- how valuable your information is (both now and in the future);
- any relevant agreed industry practices on how long information should be retained;
- the levels of risk, cost and liability involved with us continuing to hold the information;
- how hard it is to ensure that the information can be kept up to date and accurate; and
- any relevant surrounding circumstances (such as the nature and status of our relationship with you).
Overseas transfers of your Personal Information
Your Personal Information may be transferred to and stored in countries outside New Zealand and, where applicable, outside the United Kingdom or European Economic Area, including countries in which our service providers or business partners operate, such as Australia, the United States and the United Kingdom. This may include transfers connected with identity verification support, technical troubleshooting, testing, validation and specialist document-template support services.
Where we disclose Personal Information overseas, we will take the steps required by applicable law. Depending on the circumstances, this may include relying on an adequacy decision, entering into contractual safeguards such as standard contractual clauses, the UK International Data Transfer Agreement or the UK Addendum, assessing the recipient's protections, or otherwise ensuring that the recipient is required to protect the information in a way that provides comparable safeguards.
For Personal Information subject to the New Zealand Privacy Act 2020, we will comply with the requirements applicable to overseas disclosures. For Personal Information subject to the UK GDPR or EU GDPR, we will use an appropriate transfer mechanism where required.
If you would like further information about overseas transfers of your Personal Information or the safeguards used, please contact us using the contact details set out below.
How we secure your Personal Information
We take appropriate technical and organisational measures to secure your Personal Information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:
- only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised or de-identified basis wherever possible;
- using secure servers to store your information;
- verifying the identity of any individual who requests access to information prior to granting them access to information;
- using Secure Sockets Layer (SSL) software to encrypt any payment transactions you make on or via our Website;
- using appropriate technical and organisational safeguards to protect Personal Information in transit and at rest, including encryption or other secure transmission methods where appropriate.
While we use reasonable security measures, transmission of information over the internet is not completely secure. If you submit information to us electronically, you do so at your own risk to the extent permitted by law. Nothing in this policy excludes any liability that cannot lawfully be excluded.
Sensitive information
‘Sensitive personal information’ is information about an individual that reveals their racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic information, biometric information for the purpose of uniquely identifying an individual, information concerning health or information concerning a natural person’s sex life or sexual orientation.
We do not generally require you to provide sensitive information through our Website. However, where the Services require us to process special category data, criminal conviction information, right-to-work information, visa and immigration information, identity verification information (including, selfie images or document photos processed through specific technical means for face matching or other identity verification purposes, where applicable, biometric information used for face matching or other identity verification processes), or other sensitive compliance-related information, we will do so only where permitted by law, where we have an appropriate lawful basis, and where any additional condition or authorisation required by law is satisfied. Where selfie images or document photos are processed through specific technical means for face matching, identity verification or similar unique identification purposes, we will treat that processing as involving biometric information and apply the additional protections required by applicable law. Where lawful and necessary, this may include limited use of such information for internal technical support, testing, troubleshooting, validation and service-improvement activities connection with our identity verification Services.
Children’s privacy
We do not knowingly collect Personal Information directly from individuals under 18 years of age through our Website, except where this is necessary to provide our Services and is permitted by applicable law.
While our Website is not directed at children, our customers may use our Services to process Personal Information relating to individuals under 18 years of age where permitted by applicable law, including as part of employment screening, background checking or related services. Where this occurs, the customer is responsible for ensuring that any required consents, authorisations, notifications or other legal permissions have been obtained before the Personal Information is provided to us.
If we become aware that Personal Information relating to a child has been collected or processed unlawfully, we will review the matter and, where appropriate, delete the information unless we are required or permitted by law to retain it.
Your rights in relation to your Personal Information
Depending on where you are located and which Applicable Privacy Laws apply, you may have rights in relation to your Personal Information. These may include the right to request access to, and correction of, Personal Information we hold about you. In some jurisdictions, you may also have rights to request erasure, restriction of processing, data portability, to object to certain processing, to withdraw consent where processing is based on consent, and to lodge a complaint with a relevant supervisory authority. These rights may be subject to limitations or exceptions under applicable law, including where we need to retain information for security, incident investigation, legal compliance, evidential purposes or the establishment, exercise or defence of legal claims.
If you are based in a country outside New Zealand (for example, the European Union or the United Kingdom) you may also have the right (as applicable), to:
- in certain circumstances, have your Personal Information erased;
- restrict the processing of your Personal Information;
- move, copy or transfer your Personal Information easily for your own purposes across different services in a safe and secure way;
- object to processing where we rely on our legitimate interests as the lawful basis for processing;
- withdraw your consent at any time, where our processing of your Personal Information is based on consent; and/or
- lodge a complaint with an appropriate supervisory authority, if you consider that our processing of your Personal Information has breached Applicable Privacy Laws.
Where we process Personal Information for internal technical support, troubleshooting, testing, validation, template improvement or other service-improvement activities on the basis of legitimate interests, you may have the right to object to that processing in certain circumstances. If you exercise that right, we will consider your objection in accordance with applicable law and determine whether we have compelling legitimate grounds to continue the processing.
We will respond to any request made in respect of the above in accordance with the Applicable Privacy Laws.
Please note that in certain circumstances we may refuse to respond to a rights request where we have the right to do so under Applicable Privacy Laws, for example, where a request is manifestly unfounded or excessive.
Objecting to processing
You have the right to object, in certain circumstances, to our processing of your Personal Information where we rely on legitimate interests as our lawful basis, including certain profiling related to those interests.
Opting out from marketing
You have the right to object to us using or processing your Personal Information for direct marketing purposes (including any profiling we engage in that is related to such direct marketing).
You may also exercise your right to object to us using or processing your Personal Information for direct marketing purposes by:
- clicking the unsubscribe link contained at the bottom of any marketing email we send to you and following the instructions which appear in your browser following your clicking on that link;
- sending an email to team@checkmate.tech, asking that we stop sending you marketing communications or by including the words “OPT OUT”.
How to contact us
If you wish to exercise your rights under this privacy policy or any Applicable Privacy Laws or otherwise raise any privacy issue with us, you can do this by emailing our Privacy Officer who can be contacted at, team@checkmate.tech. Your email should provide evidence of who you are and set out the details of your request (e.g., the Personal Information, or the correction, that you are requesting).
If you believe we are unlawfully processing your Personal Information and wish to lodge a complaint, you can lodge a complaint with us directly by sending an email to team@checkmate.tech or visiting our contact page for other options of contacting us, or you can lodge a complaint with the New Zealand Privacy Commissioner. Information about how to lodge a complaint is available at Privacy Commissioner’s website.
If you are located in the UK, you may also complain to the UK Information Commissioner's Office.
For more information about privacy issues in New Zealand and protecting your privacy, visit the New Zealand Privacy Commissioner's website at www.privacy.org.nz, or if you are located outside New Zealand, by visiting the website of your local privacy and data supervisory authority.
Changes to our privacy policy
We update and amend our privacy policy from time to time.
Minor changes to our privacy policy
Where we make minor changes to our privacy policy, we will update the policy with a new effective date stated at the beginning of it. Our processing of your Personal Information will be governed by the practices set out in that new version of the privacy policy from its effective date onwards.
Major changes to our privacy policy or the purposes for which we process your Personal Information
Where we make material changes to this privacy policy or intend to use your Personal Information for a new purpose that is materially different from the purpose for which it was originally collected, we will take reasonable steps to notify you where appropriate.
Hire Smarter. Faster.
With Less Effort.
Let's take the stress out of screening. Want to see how it works? We'd love to show you around.
