Privacy Policy

Blutui handles personal information in two different roles.

• As a controller: for information about our own customers and users, such as agency staff with a Blutui account, people who contact us, and visitors to blutui.com. We decide how and why this information is used, and this policy applies to it.

• As a processor: for information collected through websites our customers build and host on the Blutui Platform, such as a form submitted on an agency client's site. Our customer, or their client, decides how that information is used and is responsible for their own privacy notice. We process it only on their instructions and to provide the Services, as set out in Section 13 of our Terms and Conditions.

If you visited a website hosted on Blutui and have a question about information collected through it, please contact the owner of that website. We will help our customers respond to these requests.

We collect the following personal information:

• Account and contact details: your name, email address, phone number, business name, role and postal address.

• Billing information: your billing contact, plan, invoices and payment history. Card payments are handled by Stripe, and we do not store your card details.

• Technical and usage information: your IP address, browser and device type, operating system, and information about how you use blutui.com and the Blutui Platform, including log data.

• Communications: messages, support requests, survey responses and feedback you send us.

• Marketing preferences: whether you have chosen to receive marketing emails from us.

We collect most of this information directly from you. We may also receive it from others, for example when an agency adds you as an Authorised User on its account, or when you connect a third-party service to the Blutui Platform.

We use personal information to:

• provide, maintain and support the Blutui Platform and your account;

• process payments and manage billing;

• respond to your enquiries and support requests;

• keep the Services secure and prevent fraud and misuse, including under our Acceptable Use Policy and Fair Use Policy;

• understand how the Services are used so we can improve them and develop new features;

• send you service updates and, where you have agreed or the law allows, marketing emails; and

• meet our legal, tax and accounting obligations.

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the Services you have signed up for and manage your account.

• Legal obligation: to comply with laws that apply to us, such as tax record-keeping.

• Legitimate interests: to secure and improve the Services, prevent fraud, and tell customers about our services, where those interests are not overridden by your rights.

• Consent: for marketing emails and non-essential cookies, where the law requires it. You can withdraw your consent at any time.

We use essential cookies to run blutui.com and the Blutui Platform, and analytics cookies to understand how our website is used. Where the law requires it, we only set non-essential cookies with your consent. We do not use advertising or remarketing cookies, and we do not allow third-party advertising networks to track visitors on blutui.com. More detail is in our Cookie Policy at blutui.com/legal/cookie-policy.

We do not send your content, or content from websites hosted on the Blutui Platform, to our artificial intelligence service providers, and it is not used to train AI models.

We do not sell, rent or lease personal information. We share it only with:

• Service providers: trusted providers that help us run the Services, such as hosting, payment processing, email, customer support and analytics providers. Each is bound by a written agreement to protect the information and use it only to provide services to us. A current list is published at blutui.com/legal/subprocessors.

• Services you connect: third-party services you choose to connect to the Blutui Platform, until you remove that connection.

• Legal and safety reasons: courts, regulators or law enforcement where the law requires it, or where it is needed to protect the rights, safety or property of Blutui, our customers or others.

• Business transfers: a buyer or successor if Blutui is involved in a merger, acquisition or sale of assets, subject to this policy.

Blutui is based in New Zealand and some of our service providers are in other countries, including the United States, so personal information may be processed outside the country where it was collected. The European Commission and the United Kingdom both recognise New Zealand as providing an adequate level of data protection. Where we transfer personal information to a country without that recognition, we put appropriate safeguards in place, such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum. When we send personal information outside New Zealand, we take reasonable steps to ensure it is protected in a way comparable to the New Zealand Privacy Act 2020.

We use appropriate technical and organisational measures to protect personal information, including encryption, secure hosting and access controls. If we become aware of a breach affecting personal information, we will notify affected customers without undue delay, and in any event within 48 hours, and will notify the relevant regulator and affected individuals where the law requires. No system is completely secure. If you think you have found a security issue, please email security@blutui.com, as set out in our Responsible Disclosure Policy.

We keep personal information only for as long as we need it for the purposes in this policy. When you close your account, we delete or anonymise your personal information within a reasonable period, except where we need to keep it to meet legal obligations, resolve disputes or enforce our agreements. For example, we must keep financial records for seven years under New Zealand tax law.

Depending on where you are and which law applies, you have the right to:

• ask for a copy of the personal information we hold about you;

• ask us to correct information that is inaccurate or incomplete;

• ask us to delete your information;

• ask us to restrict or stop using your information, or object to how we use it;

• receive your information in a portable format; and

• withdraw your consent where we rely on it.

You can update most account details yourself in the Blutui Platform. For anything else, contact us using the details below. We will respond within the time required by the applicable law. You also have the right to complain to a data protection authority, such as the Office of the Privacy Commissioner in New Zealand, the Information Commissioner's Office in the UK, or the supervisory authority in your EU country.

You can unsubscribe from our marketing emails at any time using the link in each email or by contacting us. We will still send you messages about your account and the Services, such as billing and security notices.

The Services are provided to businesses and professionals, as set out in Section 2.6 of our Terms and Conditions, and are not intended for anyone under 18. We do not knowingly collect personal information from children.

This policy applies only to Blutui. Websites built on the Blutui Platform, and other websites linked from ours, have their own privacy practices, and we are not responsible for them.

We may update this policy from time to time. We will publish the updated version at blutui.com/legal/privacy-policy and update the effective date. Where a change materially affects how we handle personal information, we will also notify our customers directly.

If you have any questions about this policy or want to exercise your rights, please contact us:

Email: GDPR@blutui.com

Address: Blutui Limited, 95A Collingwood Street, Hamilton, New Zealand

Phone: +64 21 728092