Welcome to Diwalco Limited ("Diwalco," "we," "us," or "our"). We are a New Zealand company committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and share your data in accordance with New Zealand's Privacy Act 2020.

This policy should be read in conjunction with our Terms and Conditions. By using our website, applications, and services (collectively, the "Service"), you agree to the handling of your information as described in this policy.

1. Information We Collect

We collect information necessary to provide and improve our Service.

2. How We Use Your Information

Your information is used for the following purposes:

• To Provide the Service: Operate, maintain, and deliver all features including building and displaying your family tree.
• To Communicate With You: Send essential service-related notifications and, with your consent, other communications.
• For Safety and Improvement: Protect users, enforce our terms, prevent fraud, and analyse usage to improve the Service.
• To Comply with NZ Law: Meet legal obligations within New Zealand.

3. How We Share Your Information

We do not sell your personal data. We share information only in these limited circumstances:

• With Other Users in Your Family Tree: Information you add is shared with other invited members of that same tree.
• With Trusted Service Providers: Third parties who support our operations (e.g., cloud hosting) under contractual confidentiality and security obligations.
• For Legal Reasons: Where required by New Zealand law, court order, or to protect rights and safety.

4. Third-Party Services

We rely on third-party providers for infrastructure and operational services (e.g., hosting, analytics, communications, customer support). Each provider operates under its own terms and privacy policy.

Current providers include (non-exhaustive):

• Amazon Web Services (AWS) – Cloud hosting and infrastructure
• Google Analytics – Usage analytics and performance insights

Your data may be processed or transmitted through these services. We take reasonable steps to ensure they meet security and privacy obligations, but we are not responsible for their independent practices.

5. Data Retention and Deletion

We retain personal data only as long as necessary to provide the Service and comply with legal obligations. Our account deletion policy is conditional:

• If your node in a family tree has no descendants, your entire record (including your name) is permanently deleted upon request.
• If your node has descendants, all personal data is permanently deleted except your first and last name, retained solely to preserve the structural integrity of the tree.

6. Your Rights and Choices (NZ Privacy Act 2020)

You have the following rights:

• Access: Request a copy of personal information we hold about you.
• Correction: Request correction of inaccurate information. Most fields can be updated in account settings.
• Deletion: Request account deletion subject to the conditional retention policy in Section 5.
• Communication Preferences: Opt out of non-essential (marketing) communications anytime.

We will take reasonable steps to verify your identity before actioning requests. To exercise your rights, contact our Privacy Officer (see Section 12).

7. Security of Your Information

We implement technical and organisational safeguards (including encryption and access controls) to protect your information from unauthorised access, alteration, or destruction. No system is entirely secure, and residual risk remains.

8. Jurisdiction and International Users

Diwalco is a New Zealand company. Our Service is operated on infrastructure in various jurisdictions, controlled from New Zealand.

Governing Law: This Policy and our data handling practices are governed by New Zealand law, specifically the Privacy Act 2020.

International Users: If you access the Service from outside New Zealand, you do so at your own risk and are responsible for compliance with local laws. By using the Service, you consent to transfer and processing of your information under New Zealand jurisdiction.

9. Children's Privacy

Our Service is not directed to individuals under 16. We do not knowingly collect personal information from children.

10. Aggregated & Anonymised Data

We may anonymise and aggregate information collected through the Service. Once de-identified so it can no longer reasonably identify you, it is no longer personal information and may be used for any lawful business purpose (e.g., research, analytics, service improvement).

11. Changes to This Policy

We may update this Policy periodically. Material changes will be communicated by email or a prominent in-Service notice at least 30 days before taking effect. Continued use after the effective date constitutes acceptance of the revised Policy.

12. Automated Decision-Making and Profiling

We may use algorithms to analyze information for automated suggestions. Where automated decisions produce legal or similarly significant effects on you, you may have the right to obtain human intervention, express your point of view, and contest the decision.

13. Contact Us

If you have questions or concerns, contact our Privacy Officer: