Privacy Policy

1. Introduction

‍

CATO ("CATO", "we", "us" or "our") is an independent, expert-led advisory and delivery platform connecting organisations with experienced practitioners to address complex business challenges, strengthen organisational capability and deliver practical outcomes.

‍

CATO is operated by CATO, a business established in New Zealand.

‍

We are committed to protecting personal information and handling it responsibly, transparently and securely.

‍

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you interact with CATO, including through:

• Our website, www.catoltd.com, and CATO-operated websites or landing pages that link to this policy;
• Enquiries, consultations and professional correspondence;
• Applications to join our practitioner and specialist network;
• Advisory, consulting, expert access and other professional engagements;
• Executive programmes, workshops, events and educational activities; and
• Other business activities involving the collection or processing of personal information.

‍

We handle personal information in accordance with the New Zealand Privacy Act 2020, including its Information Privacy Principles, and other applicable privacy and data protection laws where relevant.

‍

This policy should be read alongside our Website Terms of Use and any applicable client agreements, practitioner agreements or specific privacy notices.

‍

Where a separate contractual arrangement governs how CATO processes information on behalf of a client, that arrangement may establish additional obligations and controls.

‍

2. Who Is Responsible for Your Information

‍

For the purposes of this policy, CATO is responsible for the personal information it collects and holds in connection with its own business operations.

‍

Business details

Legal entity: CATO

Trading name: CATO

New Zealand Business Number (NZBN): 9429052384868

Country of establishment: New Zealand

Address: PO Box 224, Auckland, New Zealand 6000, NZ

Website: www.catoltd.com

Email: info@catoltd.com

‍

Privacy enquiries

Our designated Privacy Officer can be contacted at info@catoltd.com.

‍

Where CATO processes information on behalf of another organisation under a professional engagement, responsibility for particular privacy decisions may be allocated between CATO and that organisation in accordance with applicable law and the relevant agreement.

‍

3. Personal Information We Collect

‍

We collect personal information reasonably necessary for our business activities, professional services and legitimate operational requirements.

‍

The information collected depends on your relationship and interactions with CATO.

‍

3.1 Information provided directly to us

When you submit an enquiry, contact us or communicate with CATO, we may collect:

• Full name and preferred name;
• Business email address and telephone number;
• Organisation name, position and professional responsibilities;
• Country, region or business location;
• Professional website or LinkedIn profile;
• Business requirements, project objectives and enquiry details;
• Correspondence, meeting arrangements and communication preferences; and
• Any other information you voluntarily provide.

‍

3.2 Practitioner and specialist information

When you apply to join, or participate in, the CATO practitioner network, we may collect:

• Professional contact information;
• Curriculum vitae, professional biographies and employment history;
• Qualifications, certifications, professional memberships and credentials;
• Industry experience, specialist expertise and areas of practice;
• Professional references and publicly available professional information;
• Availability, engagement preferences and geographical location;
• Commercial information relevant to prospective engagements, including fees and contractual details; and
• Information reasonably required to assess suitability, verify credentials, manage engagements or meet applicable obligations.

Submitting an application does not guarantee acceptance into the network or an opportunity for professional engagement.

‍

3.3 Client and engagement information

When organisations engage with CATO, we may collect information relating to:

• Client representatives and authorised contacts;
• Project requirements, proposals and engagement correspondence;
• Commercial arrangements, billing contacts and payment records;
• Meeting notes, project communications and agreed deliverables;
• Individuals involved in the delivery or management of professional engagements; and
• Information reasonably necessary to administer and deliver the agreed services.

‍

Some professional engagements may involve confidential, commercially sensitive or personal information relating to employees, stakeholders or other individuals.

Such information is handled according to applicable privacy law, our confidentiality obligations and any relevant contractual arrangements.

‍

3.4 Events, workshops and educational programmes

When you register for or participate in a CATO event, Executive Lab, briefing, workshop or educational programme, we may collect:

• Participant name and professional contact information;
• Organisation and professional role;
• Registration and attendance details;
• Payment and invoicing information;
• Accessibility or dietary requirements voluntarily provided for event arrangements;
• Feedback and programme evaluation responses; and
• Photographs, recordings or participation information where relevant and appropriately notified.

We may use third-party registration, payment or event management providers to administer these activities.

‍

3.5 Website and technical information

When you access our website, certain technical information may be collected automatically, including:

• Internet Protocol (IP) address;
• Browser type and version;
• Device type and operating system;
• Pages visited and interactions with website features;
• Referring website or traffic source;
• Approximate geographical location derived from technical data;
• Date, time and duration of visits; and
• Cookie identifiers or similar technical information.

This information may be collected through our hosting infrastructure, website functionality, analytics systems and other technologies enabled on the website.

‍

3.6 Information obtained from other sources

In appropriate circumstances, CATO may obtain relevant professional information from:

• Publicly available professional profiles and business websites;
• Professional directories and public registers;
• Business networking platforms;
• Referrals and professional introductions;
• Existing clients and business contacts;
• Practitioner recommendations;
• Professional recruitment or business information providers; and
• Other lawful sources relevant to our services.

We seek to collect such information only where reasonably necessary for a legitimate business purpose and permitted by applicable law.

‍

Where required under Information Privacy Principle 3A of the New Zealand Privacy Act 2020, we take reasonable steps to notify individuals about the indirect collection of their information, including its purpose, intended recipients and their privacy rights, unless an applicable exception applies.

‍

3.7 Sensitive information

CATO does not generally seek sensitive personal information through its public website or standard enquiry forms.

‍

Please avoid submitting health information, identity documents, financial account credentials or other sensitive personal information unless CATO has specifically requested it through an appropriate channel.

‍

Where sensitive information is necessary for a legitimate engagement or operational purpose, we take reasonable steps to limit its collection, use and disclosure.

‍

4. How and Why We Use Personal Information

‍

CATO uses personal information for legitimate, specified purposes connected with its business activities and professional responsibilities.

‍

These purposes include:

4.1 Responding to enquiries

To respond to requests, arrange consultations, understand organisational requirements, prepare proposals and communicate about potential services.

‍

4.2 Providing professional services

To establish, administer and deliver advisory, consulting, specialist access, retained advisory and other agreed professional services.

‍

4.3 Practitioner assessment and engagement

To evaluate professional experience, assess suitability, verify relevant credentials, identify suitable practitioners, facilitate introductions and manage professional relationships.

‍

4.4 Business relationship management

To maintain relevant records of professional contacts, prospective clients, existing clients and practitioners; manage communications; and support ongoing business relationships.

‍

4.5 Events and professional development

To manage registrations, payments, attendance, programme administration, communications, feedback and relevant event-related activities.

‍

4.6 Website administration and improvement

To operate, maintain, troubleshoot, secure, evaluate and improve our website, services and user experience.

‍

4.7 Professional communications and marketing

To provide relevant information about CATO services, insights, programmes, events and opportunities where we have the required consent or another lawful basis to communicate.

‍

4.8 Legal, regulatory and contractual obligations

To maintain appropriate business records, comply with legal requirements, respond to lawful requests, manage disputes and protect legitimate business interests.

‍

We do not use personal information for purposes that are incompatible with the original collection purpose unless permitted or required by applicable law.

‍

Where consent is required, we seek that consent and provide appropriate means for it to be withdrawn.

‍

5. Professional Communications and Marketing

‍

CATO may communicate with individuals and organisations regarding its services, relevant industry insights, professional programmes and potential opportunities.

These communications may include:

• Responses to enquiries and requests;
• Information relating to existing professional relationships;
• Relevant invitations to events, workshops or briefings;
• Practitioner opportunities;
• Service updates and professional insights; and
• Business development communications relevant to a recipient's professional responsibilities.

CATO conducts electronic marketing in accordance with applicable laws, including New Zealand's Unsolicited Electronic Messages Act 2007 and equivalent requirements in other jurisdictions where applicable.

‍

We do not treat the submission of a general enquiry as unrestricted consent to receive marketing.

‍

Where required, commercial electronic communications will identify CATO and provide a functional method of unsubscribing.

‍

You may opt out of marketing communications at any time by following the unsubscribe instructions provided or contacting info@catoltd.com.

‍

Opting out of marketing will not prevent us from sending communications reasonably necessary to administer an existing engagement, fulfil a request or comply with legal obligations.

‍

We may retain limited information necessary to respect unsubscribe requests and prevent unwanted future communications.

‍

6. Cookies and Website Analytics

‍

CATO uses cookies and similar technologies to support website functionality, assess performance and understand how visitors interact with our online services.

‍

Cookies are small files or identifiers that may be stored on your device when visiting a website.

‍

Depending on the website functionality and technologies enabled, cookies may include:

Essential cookies: Support core website functions, security and technical performance.

Functional cookies: Remember relevant settings and improve the browsing experience.

Analytics cookies: Help us understand website traffic, visitor interactions and website performance.

Marketing cookies: May be used to measure campaigns or support relevant advertising where such technologies are implemented.

‍

Some cookies may be set by third-party technology providers.

‍

Where applicable law requires consent for non-essential cookies or tracking technologies, CATO will seek that consent before using them.

‍

You can manage or disable cookies through your browser settings and, where provided, the website's cookie preferences controls.

‍

Disabling certain cookies may affect website functionality.

‍

Information collected through cookies and similar technologies is handled in accordance with this Privacy Policy.

‍

7. Disclosure and Sharing of Personal Information

‍

CATO does not sell personal information or make personal information available to third parties for their independent marketing purposes without an appropriate lawful basis.

We may disclose personal information only where reasonably necessary, appropriately authorised or otherwise permitted or required by law.

‍

7.1 CATO personnel and authorised representatives

Personal information may be accessed by authorised CATO personnel and representatives who require it to perform legitimate business functions.

‍

Access should be proportionate to their responsibilities and subject to appropriate confidentiality expectations.

‍

7.2 Practitioners and specialist advisers

Where relevant to a prospective or existing engagement, CATO may disclose limited information to suitably selected practitioners or specialist advisers.

‍

Such disclosures are limited to information reasonably necessary for assessment, introduction, scoping or service delivery and are made subject to appropriate authorisation and confidentiality safeguards.

‍

Where practicable, initial project discussions may use summaries or de-identified information to minimise unnecessary disclosure.

‍

CATO does not routinely distribute detailed confidential client material throughout its practitioner network.

‍

7.3 Clients and prospective clients

Where a practitioner is being considered for a professional engagement, CATO may provide appropriate information concerning their professional experience, qualifications, expertise and suitability.

‍

Non-public personal information is disclosed consistently with the applicable authorisation, collection notice, agreement and privacy obligations.

‍

7.4 Technology and operational providers

We may share personal information with third-party providers who assist with:

• Website hosting and form processing;
• Business email and communications;
• Customer relationship management;
• Secure document storage and collaboration;
• Scheduling and video conferencing;
• Event registration and administration;
• Payment processing and invoicing;
• Website analytics and performance;
• Information technology support and cybersecurity; and
• Other legitimate business operations.

Depending on the service, these providers may include platforms such as Webflow, Stripe and other providers selected by CATO.

‍

We take reasonable steps to assess relevant privacy and security arrangements and apply appropriate contractual safeguards where necessary.

‍

7.5 Professional and legal advisers

Information may be disclosed where reasonably necessary to accountants, auditors, lawyers, insurers and other professional advisers acting in connection with CATO's legitimate business requirements.

‍

7.6 Legal and regulatory requirements

We may disclose information where required or authorised by applicable law, court order, regulatory obligation or other lawful process.

‍

7.7 Business restructuring

If CATO is involved in a genuine business sale, merger, restructuring or similar transaction, relevant information may be disclosed where lawful and reasonably necessary, subject to appropriate confidentiality and privacy safeguards.

‍

We do not disclose personal information beyond what is reasonably necessary for the relevant purpose.

‍

8. Confidentiality and Client Information

‍

Confidentiality is fundamental to CATO's professional relationships.

‍

Organisations may approach CATO regarding commercially sensitive matters, including strategy, governance, organisational restructuring, operational risks, transformation programmes and other matters requiring discretion.

‍

CATO takes reasonable steps to protect confidential information received in connection with these relationships.

‍

In particular:

• Access to confidential information is limited to those with a legitimate need to know.
• Confidential information is not disclosed to unrelated parties for promotional or other unauthorised purposes.
• Information shared with practitioners is limited to what is necessary for the relevant engagement and is subject to appropriate safeguards.
• Client and practitioner information is not published as a case study, testimonial or endorsement without appropriate authorisation.
• Confidential information is handled in accordance with applicable contractual obligations.

Personal information contained within confidential business material remains subject to applicable privacy law.

‍

Additional confidentiality, intellectual property, information security and data handling requirements may be established through separate engagement agreements or non-disclosure agreements.

‍

This Privacy Policy does not replace those agreements.

‍

9. Storage, Security and International Transfers

‍

9.1 Information security

CATO takes reasonable technical, administrative and organisational measures to protect personal information against:

• Unauthorised access or disclosure;
• Loss, theft or misuse;
• Unlawful alteration or destruction; and
• Other reasonably foreseeable security risks.

Safeguards may include appropriate access restrictions, account security controls, secure communication methods, technology provider assessments and internal information handling procedures.

‍

Security arrangements are reviewed and adjusted where appropriate to the nature and sensitivity of information held.

‍

No electronic transmission, digital platform or storage system can be guaranteed to be completely secure.

‍

9.2 International storage and processing

CATO operates from New Zealand and may work with clients, practitioners and technology providers located in other countries.

‍

Personal information may therefore be accessed, stored or processed outside New Zealand, including in Australia and other jurisdictions in which relevant providers operate.

‍

Where overseas service providers act solely on CATO's behalf, we take reasonable steps to ensure appropriate protection of information.

‍

Where personal information is disclosed to an overseas recipient for its own purposes, CATO applies the requirements of Information Privacy Principle 12 of the Privacy Act 2020 where relevant.

‍

This may include ensuring that the recipient is subject to comparable privacy safeguards, establishing appropriate contractual protections or obtaining properly informed authorisation where required.

‍

9.3 Privacy incidents

Where a privacy or information security incident occurs, CATO will take reasonable steps to investigate, contain and address it.

‍

Where a privacy breach meets the applicable statutory notification threshold, we will notify the relevant regulator and affected individuals as required by law.

‍

10. Retention and Disposal of Personal Information

CATO retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, meet legitimate operational requirements, or comply with legal and contractual obligations.

‍

Retention periods may vary according to the nature of the information and the relevant relationship.

‍

Examples include:

• Enquiry records retained while a potential engagement is being assessed and for a reasonable subsequent period;
• Practitioner information retained while an application or professional relationship remains relevant;
• Client engagement records retained for appropriate contractual, professional, risk management and legal purposes;
• Event records retained for administration, accounting and legitimate follow-up requirements; and
• Financial and taxation records retained for the period prescribed by applicable law.

New Zealand tax records are generally required to be retained for at least seven years.

When information is no longer required, CATO takes reasonable steps to securely delete, destroy or de-identify it, subject to lawful retention requirements and technical limitations such as backup retention cycles.

‍

We periodically review the necessity of retaining personal information.

‍

11. Your Privacy Rights

Under the New Zealand Privacy Act 2020, individuals have rights concerning personal information held about them.

‍

11.1 Access

You may request access to personal information CATO holds about you.

‍

11.2 Correction

You may request that inaccurate or incomplete personal information be corrected.

Where a correction is not made, you may have the right to request that a statement of the correction sought be attached to the information.

‍

11.3 Marketing preferences

You may unsubscribe from promotional communications or request changes to your marketing preferences.

‍

11.4 Consent

Where we rely on consent for a particular activity, you may withdraw that consent.

Withdrawal does not necessarily affect processing already lawfully undertaken or information we must retain for another lawful purpose.

‍

11.5 Other applicable rights

Depending on your location and the privacy laws applicable to the relevant processing, you may have additional rights concerning the use, disclosure, deletion or transfer of personal information.

‍

Such requests will be considered in accordance with the applicable legal requirements.

‍

11.6 Making a privacy request

To make a request, contact:

Privacy Officer — CATO

Email: info@catoltd.com

Please provide sufficient information for us to identify the relevant records and understand your request.

‍

We may take reasonable steps to verify your identity before disclosing or amending personal information.

‍

We will respond within the timeframes required by applicable law. Under New Zealand law, decisions on access and correction requests must generally be made within 20 working days, subject to any lawful extensions or exceptions.

‍

12. Providing Personal Information

‍

In most circumstances, providing personal information to CATO is voluntary.

However, certain information may be necessary for us to:

• Respond effectively to an enquiry;
• Evaluate a practitioner application;
• Confirm an event registration;
• Prepare a proposal or engagement agreement;
• Provide an agreed professional service; or
• Meet an applicable legal or contractual obligation.

‍

If necessary information is not provided, we may be unable to process a request, assess an application, complete a registration or provide particular services.

‍

Where information is specifically required by law, we will provide any notice required concerning that requirement.

‍

We encourage individuals and organisations to provide only information that is relevant and appropriate for the particular purpose.

‍

13. Third-Party Websites and Services

‍

Our website may include links to external websites, booking systems, payment platforms, professional networks, event registration services and other third-party resources.

These services may operate under their own terms, privacy notices and information security practices.

‍

CATO does not control the independent privacy practices of third parties.

‍

We encourage you to review the relevant privacy notices before providing personal information directly to an external provider.

‍

Where a third party processes information on behalf of CATO, we remain responsible for meeting our applicable legal obligations concerning that information.

‍

14. Children's Privacy

CATO's website, professional services and programmes are intended primarily for organisations, executives, professionals and adult participants.

‍

Our services are not directed at children under 18 years of age, and we do not knowingly seek to collect personal information from children through our general website or professional enquiry channels.

‍

If we become aware that personal information about a child has been collected inappropriately, we will take reasonable steps to address the matter in accordance with applicable law.

‍

15. Changes to This Privacy Policy

CATO may amend this Privacy Policy from time to time to reflect changes in:

• Applicable privacy laws or regulatory requirements;
• Our services or business operations;
• Website functionality and technology providers;
• Information handling and security practices; or
• Other relevant operational circumstances.

The updated policy will be published on our website with a revised "Last updated" date.

Where a change materially affects the handling of personal information, we will provide additional notice or obtain consent where required by law.

‍

We encourage visitors to review this policy periodically.

‍

16. Privacy Complaints and Contact Information

‍

If you have a question, concern, request or complaint relating to our handling of personal information, please contact our Privacy Officer.

‍

CATO — Privacy Officer

Email: info@catoltd.com

Website: www.catoltd.com

Address: PO Box 224, Auckland, New Zealand 6000, NZ

‍

We will consider privacy complaints fairly and take reasonable steps to investigate and resolve concerns.

‍

If you are dissatisfied with our response, you may raise a complaint with the New Zealand

Office of the Privacy Commissioner.

‍

Office of the Privacy Commissioner

Website: www.privacy.org.nz

Where another jurisdiction's privacy law applies, you may also have the right to raise a complaint with the relevant supervisory or regulatory authority.

‍