Our Approach to Confidentiality

‍

Confidentiality is fundamental to how CATO operates.

‍

Organisations engage CATO to address complex and often sensitive matters, including strategic decisions, governance challenges, organisational change, operational risks and specialist business issues.

‍

We recognise that these discussions can involve commercially sensitive information, confidential business plans and matters requiring a high degree of professional discretion.

Our approach is built around a simple principle: information entrusted to CATO should be handled with care, shared only where appropriate and protected throughout the professional relationship.

‍

1. Confidentiality From the First Conversation

‍

Confidentiality begins before a formal engagement.

‍

When an organisation approaches CATO, we use the information provided to understand its requirements, assess how we may assist and identify suitable professional expertise.

Initial enquiries are handled discreetly and access is limited to those who reasonably need the information for these purposes.

‍

Where appropriate, we can discuss the nature of a challenge without initially identifying the organisation or disclosing commercially sensitive details to prospective practitioners.

‍

We encourage prospective clients to avoid sharing highly sensitive documents or information through general website enquiry forms before appropriate confidentiality arrangements have been established.

‍

Where greater protection is required, a separate non-disclosure agreement may be arranged before detailed information is exchanged.

‍

2. A Private, Expert-Led Network

‍

CATO operates an expert-led advisory platform built around the requirements of each client, rather than an open, searchable directory of consultants.

‍

We identify and introduce relevant practitioners based on their professional experience, specialist expertise and suitability for the particular engagement.

‍

This approach allows us to exercise discretion over how client requirements and practitioner information are communicated.

‍

We do not publicly identify clients, disclose confidential project details or associate practitioners with sensitive engagements without appropriate authorisation.

‍

Where suitable, initial discussions may use anonymised or generalised descriptions to protect the identities and interests of those involved.

‍

3. Controlled Sharing of Information

‍

We apply a need-to-know approach to confidential information.

‍

Client information is shared only to the extent reasonably necessary to assess, establish, manage or deliver an engagement, or for another appropriately authorised or lawful purpose.

‍

Depending on the engagement, authorised recipients may include:

• CATO personnel responsible for the client relationship or engagement;
• Selected practitioners involved in assessing or delivering the work;
• Professional or operational service providers supporting the engagement, subject to appropriate safeguards; and
• Other parties expressly authorised by the client or permitted or required by law.

‍

We seek to avoid unnecessary circulation of sensitive information and take reasonable steps to ensure disclosures are proportionate to the purpose.

‍

Confidential information is not made available to CATO's wider practitioner network simply because an organisation has approached us.

‍

4. Practitioner Confidentiality and Professional Conduct

‍

CATO expects practitioners working through its platform to demonstrate professional integrity, sound judgement and discretion.

‍

Practitioners engaged by CATO are expected to:

• Treat client information as confidential;
• Use information only for authorised engagement purposes;
• Avoid unauthorised disclosure or use of confidential materials;
• Respect applicable information security requirements;
• Identify potential conflicts of interest before undertaking work; and
• Comply with the confidentiality obligations established in their applicable agreements.

‍

Where appropriate, engagements may include specific non-disclosure, conflict-of-interest, information handling and professional conduct obligations.

‍

Confidentiality requirements may continue after an engagement concludes, in accordance with the relevant agreement and applicable law.

‍

5. Secure Collaboration and Information Handling

‍

CATO takes reasonable technical and organisational measures to protect confidential information throughout an engagement.

‍

Depending on the nature of the work, these measures may include:

• Restricted access to engagement information;
• Appropriate document storage and sharing arrangements;
• Controlled communication and collaboration channels;
• Information access limited to authorised participants;
• Confidentiality obligations for relevant personnel and practitioners; and
• Procedures for managing information at the conclusion of an engagement.

‍

We consider the sensitivity of information and the nature of the engagement when determining appropriate safeguards.

‍

While we take reasonable steps to protect information, no digital communication or storage system can be guaranteed to be entirely free from risk.

‍

Where an engagement involves particular regulatory, security or information handling requirements, these should be identified and addressed in the relevant contractual arrangements.

‍

6. Respecting Client and Practitioner Identity

‍

Trust is essential to CATO's relationships with both organisations and independent practitioners.

‍

We recognise that the identity of a client, the nature of a business challenge and the involvement of particular specialists may themselves be commercially sensitive.

‍

Accordingly, CATO does not disclose confidential engagement details for marketing, publicity or unrelated commercial purposes without appropriate authorisation.

‍

This includes the use of client names, logos, testimonials, case studies, project outcomes or practitioner involvement in promotional materials.

‍

Where CATO wishes to refer publicly to completed work, we will seek the relevant permissions or use appropriately anonymised information.

‍

7. Conflicts of Interest and Professional Independence

‍

CATO recognises the importance of identifying and managing potential conflicts of interest.

Where relevant, we may assess whether a proposed practitioner has professional, commercial or other interests that could affect their independence or suitability for an engagement.

‍

Relevant conflicts may be disclosed to the appropriate parties where necessary and lawful, and arrangements may be made to manage or avoid them.

‍

We expect practitioners to respect their existing lawful confidentiality obligations and not disclose protected information belonging to previous or current employers, clients or other third parties.

‍

Our objective is to facilitate access to relevant professional expertise without compromising legitimate confidentiality obligations or professional independence.

‍

8. Legal and Regulatory Obligations

‍

CATO respects its confidentiality commitments while recognising that certain disclosures may be required or permitted by law.

‍

These may include disclosures necessary to comply with a lawful court order, regulatory requirement or other applicable legal obligation.

‍

Where legally permitted and reasonably practicable, we will seek to limit any required disclosure to the information necessary for the relevant purpose.

‍

If appropriate, we may notify the affected party before disclosure, subject to applicable law and contractual obligations.

‍

Personal information will also be handled in accordance with relevant privacy and data protection requirements.

‍

9. Formal Confidentiality Agreements

‍

This statement explains CATO's general approach to confidentiality. It is not intended to create a standalone non-disclosure agreement or replace confidentiality obligations established under an applicable contract.

‍

The specific confidentiality commitments governing an engagement are set out in the relevant written agreement, which may include:

• A non-disclosure agreement;
• A client engagement agreement;
• A practitioner or subcontractor agreement;
• Specific information security or data handling provisions; or
• Other agreed contractual protections.

‍

These arrangements may define confidential information, permitted uses, authorised disclosures, exclusions, retention requirements and obligations following completion or termination of an engagement.

‍

Where a separate written agreement applies, its terms govern the relevant engagement.

‍

10. Privacy and Personal Information

‍

Confidential business information and personal information may overlap, but they are not always the same.

‍

CATO handles personal information in accordance with applicable privacy laws, including the New Zealand Privacy Act 2020.

‍

For details about how we collect, use, store, share and protect personal information, please refer to our Privacy Policy.

‍

Our Terms of Use set out the general conditions governing access to and use of the CATO website.

‍

11. Discussing Confidential Requirements

‍

We understand that some matters require discretion from the outset.

‍

If your organisation wishes to discuss a sensitive project, confidential business challenge or engagement requiring particular information handling arrangements, please contact us before sharing detailed materials.

‍

We can discuss an appropriate process for initial conversations, professional introductions and any necessary confidentiality agreements.

‍

Contact CATO

Email: info@catoltd.com

Website: www.catoltd.com

Contact us

‍

Discretion is not an additional service. It is part of how CATO works.