Privacy statement

April 2026

Introduction

Nelson Building Society recognises the importance of safeguarding your personal and financial information. As an institution offering financial services, NBS needs to collect and retain Personal Information about you in the course of providing products and services. We do so only where this is lawful, necessary, and consistent with this privacy statement and the Privacy Act 2020.

Definitions

In this statement:
NBS means Nelson Building Society, also referred to with the words we, us and our.

NBS Privacy Officer means the person appointed by NBS from time to time to oversee privacy compliance and respond to privacy-related enquiries.

Personal Information means any information about an identifiable individual.

Privacy Act means the Privacy Act 2020 and any laws that change or replace it.

You and your means our clients, and includes the person:

• named when the account was set up who uses our products and services; and/or

• who gives us Personal Information

Changes to this privacy statement
We may update this privacy statement from time to time by publishing a new version of it to our website at Privacy Statement - NBS. We will take reasonable steps to tell you about changes at least 14 working days before they are made. Depending on how significant the changes are, we will tell you about changes in one or more of the following ways:

• a notice on our website;

   

• sending you an email or notifying you through Internet or Mobile banking; or

displaying information in our branches.

This privacy statement was last updated on 16 April 2026.

Your acceptance of this privacy statement

By accessing or using our website, products, or services, you agree that your Personal Information may be collected, used, stored, and disclosed by NBS in accordance with this privacy statement and the Privacy Act.

 

Collection and use of information

NBS may collect and use your Personal Information for the following purposes:

• to verify your identity
• to provide our products and services to you
• to communicate with you (including for marketing purposes) and respond to communications from you
• to improve our products and services, analyse data, and generate insights
• to undertake credit checks of you (if necessary)
• to use information for security reasons or investigations
• to protect and/or enforce our legal rights and interests (including defending any claim)
• where you contact us by phone, we may record the call and note the details of it (for training, service improvement, or statistical purposes), and
• for any other reason authorised by you, this privacy statement or the Privacy Act.

You do not have to provide NBS with the above Personal Information, although not doing so may affect the products or services that we can provide to you.

When you use our website or mobile services, we may collect information such as your device type, browser, IP address, location data, and website interactions. This information helps us improve your user experience. We will treat this information as Personal Information. Your device may allow you to restrict our ability to view this information, but please note that should these restrictions be enabled you may be unable to use some or all of the functions on our website.

When we collect Personal Information directly from you, we will take reasonable steps to make you aware of what we are collecting, why we are collecting it, how we will use it, who we may share it with, and your rights to access and correct that Personal Information.

From time-to-time, NBS may collect Personal Information about you indirectly, from third parties. Where we collect Personal Information about you indirectly, we will take reasonable steps to notify you of the collection, the purpose of the collection, who will receive the Personal Information, the name and address of NBS as the collecting agency, and your rights to access and correct that Personal Information.

Set out below are examples of circumstances in which we may collect your Personal Information indirectly. For the avoidance of doubt, your rights to access and request correction of that Personal Information are as set out in the Access and correction to Personal Information section of this privacy statement.

Young people and children
NBS will take care when collecting Personal Information from young people and children and will do so in a manner which is fair and compliant with the Privacy Act.

 

Disclosure of Personal Information

NBS may disclose your Personal Information to:

• any business that supports our services and products, including our professional advisors and any person that hosts or maintains any underlying IT system or data centre that we use to provide the Website or other services, any payment providers, any fraud detection partners, marketing and advertising partners, and customer support partners;
  

• credit reporting agencies;

• debt recovery agencies;

• market and data research companies (for anonymised statistical information);
  

• a person who can require us to supply your Personal Information (such as a regulatory or government authority);
  

• any entity that we enter into any joint venture with, or any other business that we are sold to or merged with;

• any other person authorised by the Privacy Act or another law (such as a law enforcement agency); and

• any other person authorised by you.

We will only disclose Personal Information to the parties listed above if it is necessary and appropriate to facilitate the purposes for which your Personal Information was collected pursuant to this privacy statement. We will take reasonable steps to ensure that Personal Information is accurate and up to date before disclosing it to any third party.

NBS will not sell your Personal Information to third parties.

Retention
We retain Personal Information for the length of time for which we may lawfully hold it, and we securely delete it when no longer required.

However, please note that:

• we are required to hold certain Personal Information for at least 7 years;

• we are required to keep certain other Personal Information for longer, to comply with various regulatory and legal obligations that apply to us (including under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, the Financial Transactions Reporting Act 1996, Financial Market Conduct Act 2013, Credit Contracts and Consumer Finance Act 2003 and other New Zealand and international laws); and

we are required to hold the information referred to above even if you are no longer a client of ours.

Storage and security of information

We take reasonable steps to keep your Personal Information safe from loss, unauthorised activity or other misuse. These steps include:

• adopting and regularly reviewing the performance and terms of our data security processes and systems to ensure that they are fit for purpose;
• adopting technologies that meet the standards required by the Privacy Act;
• verifying the suitability of security systems in place with third parties that we work with to ensure that they meet the standards required by the Privacy Act; and
• training our personnel on how to keep your Personal Information safe and secure.

Some of our service providers may be located overseas. Where we disclose your Personal Information to an overseas recipient, we will ensure the recipient is required to protect that Personal Information in a way that is comparable to the protections under the Privacy Act.

Access and correction to Personal Information

Under the Privacy Act, you have the following rights:

• The right to be informed about how your Personal Information is being used. If you would like further information beyond that provided in this privacy statement, please contact us. Our details are below.

• The right to access readily retrievable Personal Information held by us about you, subject to certain grounds for our refusal as outlined in the Privacy Act.

• The right to request corrections to the Personal Information that we hold about you. Should you request a correction, we will make the correction should the correction be reasonable and we are reasonably able to make it. If we are unable to, we will discuss this with you and take reasonable steps to note the requested correction in our records against your data.

If you would like to exercise the above rights, please contact us via secure messaging, email us at PrivacyOfficer@nbs.co.nz or phone us on 0800 101 700. You can also make your request in person at an NBS branch. When making your request, please clearly state what information you are requesting , and notify us of anything else you think relevant to your request. As part of this process we may need to verify your identity. Generally, there is no fee applicable to the exercise of your rights. However, if in the circumstances enacting your request will incur a fee, we will discuss this with you in advance of acting upon your request.

Where you request a copy of your readily retrievable Personal Information or request a correction to your Personal Information, we will endeavour to act upon your request within 20 working days.

Please note that, should you wish to exercise any of the above rights on behalf of another person, we will take steps that we deem appropriate in the circumstance to ensure that you are authorised to exercise those rights on behalf of that other person. Such steps may include contacting the person to whom the Personal Information belongs, or requesting evidence of authorisation and may require us to verify your identity.

Security or data breaches

In the event that a security or data breach occurs, we will promptly assess the nature and cause of the breach, including whether the breach constitutes a “notifiable privacy breach” (as defined in the Privacy Act).If we determine that the breach constitutes a notifiable privacy breach, we will:

• notify the Office of the Privacy Commissioner; and

• take reasonable steps to notify affected individuals (subject to any applicable and appropriate exceptions set out in the Privacy Act),

as soon as reasonably practicable.

Following a breach, we are committed to taking all reasonable steps to contain the incident, mitigate potential harm, and remediate the issue that gave rise to the breach to prevent future occurrences.

Cookies

A description of the cookies that NBS uses in this website is set out below. You may be able to configure your browser to notify you when you are offered cookies and decide whether or not to accept it. You may choose not to accept cookies when browsing our websites. However, you may not be able to log on to our secure services without accepting the cookies outlined below.

We use technology in order to offer you the most convenient, secure and relevant services. An example of the technology we use is a “cookie”. Cookies are very small text files your browser stores on your computer when you visit certain websites. Every time you visit a website that has issued a cookie to your computer, your browser sends the stored data in that cookie back to the website’s server.  

Some cookies are placed by third party services that appear on our pages. You can at any time change or withdraw your consent from the cookies declaration on our webpage. We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you've provided to them or that they've collected from your use of their services. You will not see any advertising on our website from anyone other than NBS and community groups sponsored by NBS.

Necessary cookies
Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

Preference cookies
Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.

Statistics cookies
Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

Marketing cookies
Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

Session cookies
Session cookies are used only while navigating a website. They are stored in random access memory and are never written to the hard drive. When the session ends, session cookies are automatically deleted. They also help the "back" button or third party anonymiser plugins work. These plugins are designed for specific browsers to work and help maintain user privacy.

Persistent cookies
Persistent cookies remain on a computer indefinitely, although many include an expiration date and are automatically removed when that date is reached. Persistent cookies are used for two primary purposes: Authentication. These cookies track whether a user is logged in and under what name. They also streamline login information, so users don't have to remember site passwords.

Tracking cookies
These cookies track multiple visits to the same site over time.

We use cookies for a number of purposes, including to maintain the secure connection between your browser and our servers while you are using our secure websites. These cookies can be identified as being issued from the website domains my.nbs.co.nz or nbs.co.nz.

You may be able to configure your browser to notify you when you are offered cookies and decide whether or not to accept it. You may choose not to accept cookies when browsing our websites. However, you may not be able to log on to our secure services without accepting the cookies outlined above.