How we store, manage and protect your personal information

How long we hold your information for 

We usually only hold and use your personal information for as long as it’s needed in connection with its original purpose. After that, we delete it or anonymise it.  

Some personal information may be held or used for longer for purposes directly connected to the original purpose or to comply with our legal and regulatory obligations. For example, we generally keep:  

• Contact centre recordings for about two months, in-app chat messages for approximately one year and live chat messages for up to three years, or more to help with coaching, fraud investigation and complaint investigation. 
  
• Billing records for seven years, even after you stop being a customer, to comply with our legal obligations, to help reconnect you and to improve our credit, fraud management controls and decision-making/credit scoring models. 

In some circumstances we may need to keep some information longer when necessary for a lawful purpose. For example, to investigate and resolve an issue or to assist with law enforcement.

Where we hold and use your information

Most of your personal information is held and used online in Spark cloud platforms, or on our servers in New Zealand.

We send some of it overseas when we engage partners in overseas locations to provide data processing or storage services to us. We may also engage New Zealand-based providers who use their own overseas data processing or storage partners to deliver services to us.

These overseas providers include, for example, data centre providers, advertising partners and customer insights providers. 

Our security measures 

Wherever we hold or use your personal information, we apply strict security measures and follow industry standards to ensure its confidentiality and integrity. 

What you can do 

To help with our efforts to keep your personal information safe, we ask you to: 

• Keep unique account information such as your account number, PIN and password secure. Don’t share them with anyone. 
• Always select strong, unique passwords or PINs. Don’t re-use them from other services or platforms now or in the past, and don’t re-use them on other services or platforms in the future. 

We may assume that any verbal or online request or instruction we receive is authorised by you, if it’s accompanied by suitable verification such as your Spark account number, personal identification number or password.

What we will do if there is a data breach

If, despite our efforts, we become aware of a data breach that we think could compromise your security, we’ll tell you as soon as we can. We may also report the breach publicly, if we consider it appropriate to report or if we’re required to by law.