Privacy policy

Last updated: 20 September 2026

GridPilot handles personal information in accordance with the New Zealand Privacy Act 2020 and other applicable privacy law.

Who we are

“GridPilot EV Solutions” is the registered trading name of GridPilot EV Solutions Limited. In this policy, “GridPilot”, “we”, “us”, and “our” refer to GridPilot EV Solutions Limited.

Email: info@gridpilot.co.nz

Information we may collect

We may collect information reasonably required to operate and protect our business, assess sites, recommend and supply products, process transactions, facilitate authorised introductions to independent providers, and provide support, including:

• identity and contact information;
• billing, delivery, account, quote, invoice, and payment-status information;
• property address, access instructions, photographs, plans, parking layout, switchboard and electricity-supply information;
• EV make, model, charging capability, connector, adapter, and intended use;
• builder, electrician, landlord, body-corporate, property manager, tenant, or project contact information;
• order history, charger serial numbers, commissioning, warranty, maintenance, and service records;
• support communications, recordings where lawfully made and notified, fault codes, device serial numbers, commissioning and configuration records, diagnostic logs, firmware and connectivity information, charging-session or energy-use data made available to GridPilot, and app or platform account identifiers;
• website, device, browser, IP address, approximate location, cookies, analytics, fraud, and security information; and
• marketing preferences and consent records.

How we collect information

We may collect information directly from you, from a person authorised by you, from a referring dealer or business partner, from an electrical contractor, supplier, manufacturer, warranty or software provider, from public sources where lawful, and automatically through website and security technologies.

Where GridPilot collects personal information about an individual from another person or organisation, GridPilot will take reasonable steps to make the individual aware of the collection and the matters required by Information Privacy Principle 3A, as soon as reasonably practicable, unless the individual has already been notified or another lawful exception applies. This may include notifying the individual of GridPilot's identity and contact details, the fact and circumstances of collection, the purpose of collection, the intended recipients, whether supply is voluntary or mandatory, the consequences of not providing the information, and the individual's rights of access and correction.

You must ensure that information you provide is accurate and that you are authorised to provide information about another person. Providing another person's information does not remove GridPilot's independent privacy obligations.

How we use information

We may use personal information to:

• assess enquiries and site suitability;
• prepare recommendations, quotes, orders, invoices, and project documentation;
• process payments, refunds, deliveries, and collections;
• where authorised or reasonably necessary, communicate and share relevant information with suppliers, independent licensed electrical workers, installers, manufacturers, couriers, software providers, and warranty partners;
• activate, register, configure, monitor, support, update, and troubleshoot products and platforms;
• verify identity, manage credit and payment risk, prevent fraud, and protect our systems, customers, contractors, and legal rights;
• maintain safety, warranty, tax, accounting, insurance, and compliance records;
• improve products, services, operations, and website performance;
• respond to complaints, disputes, regulators, insurers, and legal processes; and
• send service communications and permitted marketing.

Where GridPilot is given access to device, app, cloud-platform, charging-session, or diagnostic information, GridPilot will use that information only as reasonably necessary for the authorised purpose, such as initial commissioning, configuration, troubleshooting, safety review, product support, warranty administration, recall management, or resolving a complaint. GridPilot does not routinely require access to a customer's complete app history or unrelated location, payment, contact, or device information.

If requested information is necessary for an order or service and is not provided, GridPilot may be unable to quote, supply, deliver, commission, support, or process a warranty claim.

Site photographs, videos, and technical records

GridPilot may collect and retain site photographs, videos, plans, switchboard images, parking layouts, product serial numbers, configuration details, and installation records for quoting, site assessment, project delivery, electrical safety, certification, warranty, support, dispute, insurance, and compliance purposes.

Before uploading or sending site photographs or videos, customers should, where reasonably practicable, avoid including faces, vehicle licence plates, identity documents, house-number details not needed for the project, security cameras, alarm controls, keys, access codes, valuables, neighbouring properties, or other unrelated personal or sensitive information. Customers may crop, blur, or obscure information that is not needed, provided this does not conceal a matter relevant to electrical safety, access, site conditions, or the requested work.

If submitted material contains identifiable people, vehicles, security features, or third-party property, GridPilot will process that information only where reasonably necessary for the purposes described in this policy or another lawful purpose. By providing the material, the customer confirms that they are authorised to provide it and authorises GridPilot to use and disclose it for the relevant enquiry, quotation, installation, certification, support, warranty, safety, and compliance purposes. This is not a waiver of any privacy right and is not consent to unrelated marketing or public use.

GridPilot will not use identifiable customer, person, vehicle, or property images for public marketing, case studies, social media, or promotional material without separate permission or another lawful basis.

Sharing information

We may disclose relevant information to:

• Shopify, payment processors, banks, accountants, insurers, and fraud-prevention providers;
• suppliers, manufacturers, distributors, hardware OEMs, charger-app and cloud-platform operators (which may include Autel, TELD, Zeeda, or another provider associated with the selected product), OCPP providers, SIM and network providers, and warranty agents;
• electricians, installers, engineers, assessors, couriers, warehouses, and project partners;
• IT, cloud, CRM, email, SMS, analytics, advertising, document, and cybersecurity providers;
• professional advisers, debt-recovery providers where lawful, regulators, courts, government agencies, and emergency services; and
• parties involved in a proposed business sale, restructure, financing, or transfer.

We share only information reasonably relevant to the purpose, authorised by you, or required or permitted by law.

Where information is shared with an independent electrician, installer, assessor, builder, engineer or other provider, GridPilot will seek to limit the information to what is reasonably necessary for the authorised introduction, quotation, product supply, support, safety, certification or related purpose. This may include the customer's name and contact details, site address and access information, relevant photographs or plans, switchboard and supply information, vehicle details, product details and project records.

Independent providers contract directly with the customer and are separately responsible for their own privacy notices, lawful use, security, retention and disclosure of information they receive. They must not use information provided by GridPilot for unrelated marketing or prospecting without the individual's separate consent or another lawful basis. GridPilot remains responsible for its own collection, use and disclosure of personal information and for obligations that cannot lawfully be excluded.

Third-party charger apps and cloud platforms

A charger may use a mobile app, web portal, cloud platform, OCPP backend, payment service, SIM service, or manufacturer account operated by an independent third party, which may include Autel, TELD, Zeeda, or another provider associated with the selected product. When a customer downloads, registers for, or directly connects a charger to such a service, the third-party operator may collect and use personal information independently under its own privacy policy and terms.

Depending on the service and permissions selected, information collected directly by the third party may include the customer's name and contact details, account identifiers, charger serial number, device identifiers, vehicle or charging-session information, energy-use records, approximate or precise location, Wi-Fi or Bluetooth permissions, IP address, app diagnostics, payment information, and support communications. GridPilot does not determine every data field, permission, retention period, security measure, or processing location used by an independent third-party service.

Customers should review the third party's privacy policy, account permissions, terms, fees, and available privacy controls before creating an account, entering payment information, or connecting a charger. A third-party app account is separate from a GridPilot website or Shopify account unless expressly stated otherwise.

GridPilot may receive limited information from a third-party app or platform where necessary for authorised commissioning, configuration, troubleshooting, safety, support, warranty, recall, or complaint handling. Customers must not provide GridPilot with their third-party app password, payment password, complete payment-card details, or other reusable authentication credentials. Where access is required, customers should use an approved in-app sharing function, delegated support access, temporary diagnostic permission, one-time code, screen-sharing method that does not expose credentials, or another secure method supported by the provider.

Overseas processing and disclosure

Third-party charger apps, cloud platforms, OCPP services, payment providers, manufacturers, and technical-support providers may process or store information outside New Zealand, including in jurisdictions where the provider or its infrastructure is located. When a customer registers directly with an independent provider, information may be collected directly by that provider and processed overseas under its own privacy policy.

Where GridPilot discloses personal information to an overseas person or organisation for that recipient's own purposes, GridPilot will assess the disclosure under Information Privacy Principles 11 and 12 and take the steps required by the Privacy Act 2020. Depending on the circumstances, this may involve confirming that the recipient is subject to the New Zealand Privacy Act, is protected by comparable safeguards, is bound by an agreement providing comparable safeguards, or obtaining the individual's informed authorisation where legally permitted.

Where an overseas provider stores or processes information solely on GridPilot's behalf as GridPilot's agent and does not use it for its own purposes, the transfer may not be treated as a cross-border disclosure under Information Privacy Principle 12. In that situation, GridPilot remains responsible for ensuring that information handled on its behalf is protected in accordance with applicable New Zealand privacy obligations.

Payments

Payment information may be processed by Shopify and third-party payment providers. GridPilot does not ordinarily store complete payment-card numbers. Payment providers operate under their own terms and privacy policies.

Shopify, cookies, analytics, and advertising pixels

Our online store is hosted on Shopify. Shopify provides e-commerce, checkout, order-management, security, fraud-prevention, payment-related, and built-in analytics functionality. Shopify and its service providers may use cookies, pixels, local storage, device identifiers, and similar technologies that are necessary to operate and secure the store or that support preferences, performance measurement, analytics, and permitted marketing.

Information processed through Shopify may include contact, billing, delivery, order, transaction-status, device, browser, IP-address, cookie, security, and fraud-prevention information. Shopify may process information in New Zealand and overseas under its applicable privacy terms. More information is available in the Shopify Consumer Privacy Policy and Shopify Cookie Policy.

GridPilot may in future enable non-essential analytics or advertising technologies such as Google Analytics 4, Meta Pixel, TikTok Pixel, or comparable services. If enabled, the active tools and relevant purposes will be identified in this policy, a cookie notice, or the website's consent interface as appropriate. These tools may collect information about page views, interactions, device and browser details, approximate location, referring pages, advertising identifiers, and purchase or conversion events.

Where consent is required by applicable law or by the settings GridPilot has chosen to offer, non-essential analytics and advertising technologies will be configured so that they do not activate before the user has made the applicable choice. Users will be able to accept, reject, or adjust available non-essential cookie preferences and, where supported, withdraw or change those choices later. Strictly necessary technologies required for security, fraud prevention, network management, cart, checkout, payment, account, or requested functions may operate without optional consent where lawful.

Browser settings and recognised privacy controls may also affect cookies and tracking. Disabling technologies may affect checkout, account, preference, analytics, or other store functions. If GridPilot changes its analytics, advertising, CRM, email, SMS, review, booking, or other third-party tools, this policy and the website's consent settings will be reviewed and updated as appropriate.

Marketing

We send commercial electronic messages only where permitted by law. Messages will identify the sender and provide a functional unsubscribe method.

Unsubscribing from marketing does not prevent operational communications concerning an enquiry, quote, order, payment, delivery, safety issue, warranty, recall, platform, or existing service.

Security and independent platforms

GridPilot uses reasonable safeguards appropriate to the information it holds or controls. However, no website, email, app, cloud platform, wireless connection, or transmission method is completely secure. Customers should not send payment-card details, app passwords, payment passwords, Wi-Fi passwords, or other reusable credentials by ordinary email, text message, web form, or support chat.

Independent charger-app and cloud-platform operators control their own systems, security practices, account recovery, service availability, breach response, data locations, retention, and privacy policies. GridPilot does not operate or control those independent systems and cannot guarantee their security, uptime, continued support, or freedom from data loss or cyber incidents. Customers are encouraged to review the provider's privacy and security information before creating an account or submitting personal information.

This allocation of responsibility does not exclude GridPilot's responsibility for personal information held or controlled by GridPilot, for GridPilot's own acts or omissions, for a disclosure or integration arranged by GridPilot, for representations made by GridPilot, or for any obligation that cannot lawfully be excluded.

Retention and deletion

We may retain information for as long as reasonably necessary for the purpose collected and for legal, tax, accounting, electrical safety, certification, product-lifecycle, warranty, insurance, dispute, fraud-prevention, cybersecurity, and business-record requirements. Retention periods may vary according to the type of information and the purpose for which it is held. Information may then be securely deleted, de-identified, or anonymised where reasonably practicable.

You may ask GridPilot to delete or de-identify personal information that we hold. New Zealand privacy law does not provide an unlimited right to immediate erasure in every circumstance. GridPilot may decline or defer a deletion request, or retain a restricted record, where the information is reasonably required to complete a transaction or service, comply with law, maintain tax or accounting records, preserve electrical safety and certification records, administer a product or workmanship warranty, respond to a recall, establish or defend legal rights, resolve a complaint or dispute, prevent fraud, protect systems, or maintain an accurate record of prior communications and consent.

Where complete deletion is not reasonably available, GridPilot may restrict use, remove information that is no longer required, or retain only the minimum record reasonably necessary. Deletion from active systems may not immediately remove information from secure backups, audit logs, archived records, or systems operated by independent providers, although information in those systems will remain subject to applicable safeguards and retention processes.

Access, correction, and deletion requests

You may request access to or correction of personal information held about you, subject to legal exceptions, and may ask us to delete or de-identify information as described above. We may verify identity and authority before responding and may request enough information to locate the relevant records.

Privacy Officer
Email: info@gridpilot.co.nz

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner at privacy.org.nz.

Privacy breaches

GridPilot will assess suspected privacy breaches and make notifications required by the Privacy Act 2020 where the breach has caused or is likely to cause serious harm.

Policy changes

We may update this policy. The current version and effective date will be published on our website.