Privacy Policy
Version 1.4 - 15 September 2026
This Privacy Policy explains how Boing Ltd (Boing, we, us, our), New Zealand company number 9452129, collects, stores, uses, discloses and protects your personal information when you use the Boing app or our website, including as an accredited third party under the Customer and Product Data Act 2020 and its open banking regulations.
In this policy, personal information means information about an identifiable individual.
We collect, store, use and disclose your personal information as set out in this policy and where permitted by applicable law. If you do not agree with this policy, please do not use Boing.
This policy should be read together with our Terms of Use. It does not limit or exclude any of your rights under the Privacy Act 2020 (the Act). For general information about your privacy rights, see privacy.org.nz.
1. About us and the role we play with your information
Boing operates in New Zealand and is bound by the Act. When you use Boing, we generally decide how and why your personal information is collected, used, held and disclosed - for example, when you create an account, link a bank account, or make a payment. In those situations, Boing is responsible for handling your personal information in accordance with this policy.
Where we handle personal information on the instructions of your bank, account provider, or a business you are paying in connection with a specific payment, that organisation is responsible for how it uses the information it receives. You should refer to that organisation's privacy policy for that part of the process.
2. Information we collect
When you sign up for a Boing account:
- your name, mobile phone number, and email address;
- your chosen BoingID (if you set one);
- the name, account number and account details of any bank account you link to Boing;
- your device ID, mobile operating system, and IP address, so we can operate the app, keep it secure, and investigate fraud or bot activity.
When you use Boing to make or receive a payment:
- payment and transaction data - the date, time, amount, description, and the payer's and payee's phone number, BoingID, name, and bank account details;
- confirmation-of-payee information we retrieve from your bank to show a name check before a payment is sent;
- account balance and transaction information from your linked bank accounts, to the extent you authorise us to access it and only as needed to provide the Boing feature you're using.
From our website and when you contact us:
- information you give us in emails, support requests, or complaints;
- IP address, browser and device information, and website usage patterns, including through cookies and analytics tools (see clause 5).
We do not use tracking technologies to build advertising profiles about you.
3. Purpose limitation - why we collect and use your information
Consistent with our obligations as an accredited third party, we collect and use personal information only for purposes connected with providing, securing, supporting, and improving Boing, including:
- to create and verify your Boing account and BoingID;
- to initiate payment consents on your instruction, and process payment requests sent to you;
- to resolve a phone number or BoingID to the correct bank account, and show a name check to the payer before a payment is sent;
- to maintain a record of your Boing account activity;
- to detect, investigate, and prevent fraud, scams, and misuse of the Boing service or the directory;
- to meet our record-keeping, audit, and reporting obligations to the CDR accreditation register, Payments NZ, and MBIE;
- to comply with other legal obligations, including AML/CFT requirements where applicable;
- to provide customer support and respond to your enquiries or complaints.
When you authorise us to access information from your bank or account provider, that authorisation applies only to the account information, payment consent, feature, and period you approve. You can withdraw or manage your authorisation through the Boing app where that functionality is available, or by contacting us using the details in clause 12.
We will not use your information for marketing purposes without your express permission, and we will not use it for purposes unrelated to those listed above unless we have a lawful basis for doing so.
4. How we collect personal information
We collect personal information:
- directly from you, when you register, use the Boing app, or contact us;
- from your bank or account provider, through the open banking APIs you authorise us to use, each time you link an account, check a balance, or approve a payment consent;
- from other Boing users, when someone sends a payment request to your phone number or BoingID, or shares your details as part of a payment;
- indirectly, through analytics, device information, and cookies as described in clause 5.
We only request the categories and scope of information from your bank that we need to provide the specific Boing feature you are using - we do not request broader access "just in case."
5. Cookies and website analytics
We use cookies and similar technologies on our website to help it function, keep it secure, and understand how visitors use it, including through third-party analytics tools. You can disable cookies in your browser settings, but some parts of our website or the Boing app may not work properly if you do.
6. Disclosing your personal information
We share the minimum personal information necessary. We may disclose it to:
- your bank or account provider, and the recipient's bank, in order to initiate or receive a payment consent;
- the person you are paying, or who is paying you - for example, your name and payment confirmation, as shown in the app's name check step;
- the CDR accreditation register, Payments NZ, and MBIE, where we are required to report to or provide records to them under our accreditation;
- service providers who host our infrastructure or provide analytics, acting only on our instructions and bound by confidentiality and security obligations;
- a regulator, law enforcement agency, or other person legally entitled to require the information from us;
- any other person you have authorised us to share your information with.
We aim to host Boing's cloud services in New Zealand where suitable New Zealand-based services are available and meet our technical, security, resilience, and accreditation requirements. Some service providers may still be located outside New Zealand, or may process personal information outside New Zealand, where a New Zealand option is not available or does not meet those requirements. Where this is the case, we take reasonable steps before disclosing personal information to ensure it will be protected by safeguards comparable to those required under the Act.
We may also disclose information as part of a sale, merger, or restructuring of Boing's business, subject to the new owner continuing to comply with this policy (or an equivalent policy) for information already held.
7. Data retention
We follow data minimisation principles: we only keep personal information for as long as we need it for the purpose it was collected, then securely delete or anonymise it. Indicative retention periods are:
| Type of information | Retention period |
|---|---|
| Account and profile information (name, phone number, BoingID) | For as long as your account is open, plus a short period after closure to allow account recovery |
| Payment and transaction records | For as long as required to meet accounting, dispute-resolution, accreditation, and any applicable AML/CFT obligations |
| Device, IP address and app diagnostic logs | For as long as reasonably needed for security, fraud prevention, and incident investigation |
| Support and complaint correspondence | For as long as reasonably needed to respond to the matter and meet record-keeping obligations |
Before publishing this policy, we will confirm that our retention periods are consistent with our accreditation conditions, AML/CFT obligations, the Limitation Act 2010, and any other applicable legal or operational requirements.
8. How we protect your information
We take your security seriously and aim to meet the standards expected of an accredited third party under the open banking regulations, including:
- encryption of data in transit (TLS) and at rest;
- access controls and authentication for our systems and staff;
- regular security review and, where applicable, independent audit of our systems;
- incident management procedures for responding to a suspected security or privacy incident.
No system is completely secure, and if you provide information to us over the internet, you do so at your own risk. If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will investigate promptly and notify the Office of the Privacy Commissioner and affected individuals where the Act requires us to do so. We will also notify any relevant open banking accreditation body where our accreditation obligations require it.
9. Your rights - accessing, correcting, and deleting your information
Subject to the grounds for refusal set out in the Act, you have the right to access and request correction of the personal information we hold about you. You may also ask us to delete your personal information or restrict certain processing, although we may need to retain or continue using some information where permitted or required by law.
How to make a request: contact us using the details in clause 12, and provide enough information for us to confirm your identity and understand your request. We may ask for identification to protect your privacy before we act on a request.
Timeframes: we will acknowledge your request within 5 working days and aim to respond in full within 20 working days, as required by the Act. If a request is complex, we will tell you if we need more time.
If we refuse a request, we will explain why and tell you how you can complain about that decision. Closing your Boing account removes your phone number and BoingID from the directory. Some information may need to be retained after account closure for the reasons set out in clause 7.
10. Eligibility, children and young people
Boing may be used by anyone who has a registered New Zealand bank account that is supported by Boing. This may include children or young people, but they may need consent or approval from a parent, guardian, or their bank before using Boing or linking a bank account. If we become aware that a child or young person is using Boing without any consent or approval required by law, their bank, or our Terms of Use, we may restrict or close the account and take steps to delete or limit the personal information we hold, subject to any legal or record-keeping obligations.
11. Complaints
If you have a concern about how we've handled your personal information, contact us first using the details in clause 12 and we will investigate and do our best to resolve it. If you're not satisfied with our response, you can complain to:
- the Office of the Privacy Commissioner, PO Box 10-094, The Terrace, Wellington 6143, phone 0800 803 909, privacy.org.nz; and/or
- [insert approved dispute resolution scheme Boing belongs to as a Financial Service Provider - e.g. Financial Services Complaints Limited (FSCL) or the Insurance & Financial Services Ombudsman Scheme (IFSO)].
12. Contact us
If you have any questions about this policy, or want to exercise your privacy rights, contact our Privacy Officer at complaints@boing.nz.
13. Changes to this policy
We may update this policy from time to time, including to reflect changes to Boing, changes in the law, or changes to our accreditation obligations. We will publish the updated policy at boing.nz/privacy and update the version date at the top of the page.
Where a change is material, we will also notify you in the app or by email before it takes effect, except where we need to make a change sooner to protect the security of your information or to comply with a change in the law.