Last updated: 8 October 2026
1. Introduction
We are Virscient Limited (“Company”, “we”, “us”, “our”) and are an “agency” under the New Zealand Privacy Act 2020 (and, where the EU GDPR or UK GDPR applies, a “controller”) in respect of your personal information. Our registered office is SkyPoint Building, Level 1, 3 Melody Lane, Hamilton East, Hamilton, 3216, New Zealand, and our New Zealand Business Number (NZBN) is 9429031199292. This policy also covers our related Virscient group companies, Virscient Labs, Virscient LLC, VTML in relation to personal information collected through this website.
This policy explains how we collect, use, share and protect personal information (“Personal Data”) when you visit or use www.virscient.com and its sub-domains, and any other Virscient domains that point to it (the “website”), or otherwise interact with us. “Personal Data” means any information about an identifiable individual, including name, contact details, identification numbers, location data or online identifiers.
This policy should be read alongside our Terms of Use.
We comply with the New Zealand Privacy Act 2020. Where we process the personal data of individuals in the European Economic Area or United Kingdom (for example, clients, contacts or website visitors based there), we also comply with the EU GDPR and UK GDPR in respect of those processing activities, where they apply to us.
2. Why we process your personal data
The paragraphs below set out the purposes for which we process your Personal Data, and the basis we rely on for doing so. In some circumstances we may also need to share your Personal Data where we are under a legal or contractual obligation to do so.
2.1 To enter into and perform contracts
Where you engage us, or your organisation engages us, for our engineering, software, hardware or consultancy services, we process Personal Data to deliver those services. This may include sharing Personal Data with third-party agents, consultants, suppliers, subcontractors and certification bodies we work with to deliver a project, and for assessing security or fraud risk.
We need this Personal Data to enter into and perform the relevant contract. If you do not wish to provide it, we may be unable to provide the services requested.
2.2 To provide customer and business support
We process Personal Data to respond to enquiries, provide technical support, and manage our ongoing relationship with clients and business contacts. We rely on our legitimate interest in providing effective support as the basis for this processing. If you do not provide the Personal Data we request, we may not be able to fully address your enquiry.
2.3 To engage suppliers and manage our business
We process Personal Data where we engage third-party goods and services providers as part of delivering services to clients or running our business, and for making our website secure, administering it, and for troubleshooting, testing, research and statistical purposes. We rely on our legitimate interest in running our business and keeping our systems secure.
2.4 To improve our website
We process Personal Data to provide a more effective and tailored user experience on our website, including through the use of cookies and analytics tools that help us understand how the site is used and improve it. Where these tools are not strictly necessary for the website to work, we only use them with your consent. Further detail on the cookies we use is set out in Section 8 below.
2.5 For marketing purposes
We may retain the Personal Data of clients, prospective clients and business contacts to provide information about our capabilities and services. This includes Personal Data collected through campaign, event and other marketing pages on our website, and through online advertising and measurement tools (see Section 8). We rely on our legitimate interest in promoting our business. Where our marketing involves cookies or similar technologies, we rely on your consent (see Section 8). You can ask us to stop marketing communications at any time (see Section 6).
2.6 In response to legal requests
We may disclose Personal Data where required to comply with a legal obligation, to enforce our agreements, or in response to a lawful request from a public authority (including law enforcement).
2.7 To assess job applications
If you apply for a role with us, or submit an expression of interest, we use the Personal Data you provide (such as your name, contact details and CV or other application material) to assess your suitability for a role and to manage our recruitment process. We rely on our legitimate interest in recruiting suitable people. If you do not provide the Personal Data we ask for, we may not be able to consider your application.
3. Personal data we collect
3.1 Information you give us
Information you provide directly, such as by filling in a form on our site (including enquiry, event and campaign pages), contacting us by email, applying for a role or submitting an expression of interest, or engaging us for services. This may include your name, job title, company, address, email address and phone number.
3.2 Information we collect automatically
When you visit our site, we may automatically collect:
- technical information, including your IP address, browser type and version, time zone setting, device and operating system information; and
- information about your visit, including pages viewed, time spent on pages, click patterns, referring/exit pages and similar navigation data.
We use analytics, advertising and other tools (such as Google Analytics 4, Google Ads, LinkedIn Insight, HubSpot and Google reCAPTCHA) to help us understand how visitors use our site, measure our marketing and keep our forms secure. Where these tools use cookies, we ask for your consent first (other than for cookies that are strictly necessary), and you can change or withdraw your choice at any time as described in Section 8.
3.3 Information from other sources
We may occasionally receive Personal Data about you from third parties, such as business partners, referrals, or publicly available professional sources (e.g. LinkedIn), where relevant to a business relationship or opportunity. Where we collect your Personal Data from a third party in this way, we will take reasonable steps to notify you, within a reasonable time of receiving it, that we hold your Personal Data, why we hold it, and your right to access and correct it, in accordance with information privacy principle 3A (IPP 3A) of the Privacy Act 2020.
4. International transfers
Virscient is a New Zealand company, and Personal Data we collect is generally held and processed in New Zealand. However, we may share Personal Data with service providers, subcontractors, or cloud/software providers located outside New Zealand (for example, in Australia, the United States, the United Kingdom or the European Union) as part of delivering our services or running our business.
Where we transfer Personal Data outside New Zealand, we take reasonable steps to ensure it receives a comparable standard of protection to that required under the Privacy Act 2020, including by:
- only transferring Personal Data to countries or organisations we reasonably believe have comparable privacy protections in place; or
- entering into contractual arrangements with the recipient that require them to protect the Personal Data to a standard comparable to the Privacy Act 2020 (and, where relevant, using recognised mechanisms such as standard contractual clauses for EU/UK-originating data).
5. Retaining your personal data
We retain Personal Data only for as long as necessary for the purpose(s) for which it was collected, and in line with our internal retention practices and any applicable legal, accounting or contractual requirements. Cookie-related data is kept for the periods set out in Section 8.
We use reasonable technical and organisational measures to protect Personal Data, including access controls, passwords, encryption where appropriate, and restrictions on physical access to our offices.
6. Your rights
Under the Privacy Act 2020, you have the right to:
- ask us to confirm what Personal Data we hold about you and to access that data; and
- ask us to correct any Personal Data about you that is inaccurate, incomplete, or out of date.
Where GDPR or UK GDPR applies to our processing of your Personal Data, you may also have the right to ask us to:
- delete your Personal Data;
- restrict or object to our processing of your Personal Data;
- receive your Personal Data in a structured, commonly used, machine-readable format; and
- withdraw any consent you have given us, at any time, without affecting the lawfulness of processing carried out before you withdrew it.
You can also ask us at any time to stop using your Personal Data for direct marketing.
To exercise any of these rights, or if you have a question about how we handle your Personal Data, please contact us using the details in Section 7. Please include enough detail for us to identify you and respond to your request. If you are not satisfied with our response, you have the right to complain to the New Zealand Office of the Privacy Commissioner (www.privacy.org.nz) or, where relevant, your local EU/UK data protection authority.
7. Contact and changes
Questions, comments or requests relating to this policy, or to exercise your rights, should be sent to [email protected].
We may update this policy from time to time by posting a revised version on our website. We encourage you to review it periodically. This policy was last updated on 8 October 2026.
8. Cookies
Our website uses cookies and similar technologies to operate effectively and to help us understand how the site is used. When you visit our website, we show a cookie banner. Cookies that are not strictly necessary (analytics, advertising and marketing cookies) are only set after you opt in, and you can change or withdraw your choice at any time through the cookie settings on our website or through your browser settings. Disabling cookies may affect some website functionality.
The tools below are loaded through Google Tag Manager and HubSpot. We may add or change tools from time to time, and will update this section when we do.
8.1 Google Analytics 4 (website traffic)
| What we collect | Cookie identifiers, approximate location (from your IP address), device and browser details, pages viewed, time on page, referral source and clicks. |
| Why we use it | To understand how visitors use our website so we can improve it. |
| Who gets it | Google (our analytics provider) and our team. |
| Where it goes | Google servers, which may be located outside New Zealand, including in the United States. |
| How long we keep it | Cookies last up to 2 years; analytics event data is kept for [GA4 RETENTION: 2 or 14 months]. |
| Legal basis | Your consent, given through our cookie banner. |
| How to opt out or withdraw | Change or withdraw your choice at any time through the cookie settings on our website or your browser settings. You can also use the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). |
8.2 Google Ads (conversion tracking)
| What we collect | Cookie identifiers, the Google ad click ID, and whether a visit that started from one of our ads led to an action such as submitting a form. |
| Why we use it | To measure how well our Google advertising works and to improve our campaigns. |
| Who gets it | Google. |
| Where it goes | Google servers, which may be located outside New Zealand, including in the United States. |
| How long we keep it | Up to 90 days. |
| Legal basis | Your consent, given through our cookie banner. |
| How to opt out or withdraw | Change or withdraw your choice at any time through the cookie settings on our website or your browser settings. You can also manage ad personalisation at adssettings.google.com. |
8.3 LinkedIn Insight (ad tracking and audiences)
| What we collect | Cookie identifiers, pages visited, referring page, IP address, device and browser details. Where you are logged in to LinkedIn, this may be linked to your LinkedIn profile. |
| Why we use it | To measure the results of our LinkedIn advertising, build and reach audiences, and understand the professional audience visiting our website. |
| Who gets it | LinkedIn (Microsoft group) and our team. |
| Where it goes | LinkedIn servers, which may be located outside New Zealand, including in the United States. |
| How long we keep it | Cookies last up to 12 months; LinkedIn applies its own retention periods to the data it receives. |
| Legal basis | Your consent, given through our cookie banner. |
| How to opt out or withdraw | Change or withdraw your choice at any time through the cookie settings on our website or your browser settings. You can also manage LinkedIn ad settings at linkedin.com/psettings/advertising. |
8.4 HubSpot (visitor tracking and forms)
| What we collect | A cookie identifier, pages viewed, referral source, IP address, device and browser details, and anything you submit through our forms (for example your name, email address, company and message), which is linked to your visitor record. |
| Why we use it | To understand visits to our website, manage enquiries and form submissions, and run and measure our marketing and event campaigns. |
| Who gets it | HubSpot (our service provider) and our team. |
| Where it goes | HubSpot data centres in the United States. |
| How long we keep it | Tracking cookies last up to 180 days (6 months). Contact records are kept while we need them for the purposes in Section 2, or until you ask us to delete them. |
| Legal basis | Tracking cookies: your consent, given through our cookie banner. Information you submit through a form: your request and our legitimate interest in responding to you (see Section 2). |
| How to opt out or withdraw | Change or withdraw your choice at any time through the cookie settings on our website or your browser settings. You can also use the unsubscribe link in any marketing email, or contact us at [email protected] to ask us to delete your record. |
8.5 Google reCAPTCHA (spam protection on forms)
| What we collect | A cookie identifier, IP address, browser and device details, and how you interact with the page (for example mouse movements and time on page), to tell people from bots. |
| Why we use it | To protect our forms from spam and abuse. |
| Who gets it | Google. |
| Where it goes | Google servers, which may be located outside New Zealand, including in the United States. |
| How long we keep it | Up to 6 months. |
| Legal basis | Our legitimate interest in keeping our website and forms secure. |
| How to opt out or withdraw | If you block reCAPTCHA, some forms may not work. You can change your cookie settings or contact us at [email protected]. |
8.6 Your rights and contacting us
You have the rights described in Section 6 in relation to Personal Data collected through these cookies, including the right to withdraw your consent at any time (withdrawing consent does not affect processing that took place before you withdrew it). To exercise your rights, or to ask us about how we use cookies, please contact us at [email protected]. Google, LinkedIn and HubSpot also publish their own privacy notices explaining how they use the data they receive.