Utogi Privacy Policy

Version 001 | Last Updated: 03 September 2026

Utogi Ltd, NZBN 9429053309945 ("Utogi", "we", "us", or "our") is committed to handling personal information in a transparent, lawful, secure, and practical way.

This Privacy Policy explains how we collect, use, disclose, hold, protect, retain, and otherwise handle personal information in connection with our business and our advocate marketing platform and related services (together, the "Platform").

Utogi is based in New Zealand and complies with the New Zealand Privacy Act 2020. Where other privacy or data protection laws apply to our handling of personal information, we will comply with those laws to the extent required. Such laws may apply depending on factors such as the location of individuals, the nature of the services provided, and how the Platform is used.

By creating an account, accessing or using the Platform, enrolling in a Program, using our websites, using any CRM or related Platform feature, or otherwise interacting with Utogi and/or the Platform, this Privacy Policy applies to you. You acknowledge that you have read and understood and accept the terms of this Privacy Policy. If you do not agree with this Privacy Policy, you should not engage with Utogi or access or use the Platform.

If you choose not to provide personal information requested by us or required for use of the Platform, we may be unable to provide some or all of the Platform, features, or services to you.

Capitalised terms used in this Privacy Policy that are not defined here have the meaning given to them in the Advocate Terms & Conditions or the Organisation Terms & Conditions, as applicable.

1. Introduction

1.1 Purpose of this Policy

This Privacy Policy explains, among other things:

• what personal information we collect and from whom

• how we use personal information

• how we disclose and share personal information

• how long we retain personal information

• the rights of individuals in relation to their personal information

• how we protect personal information

• how to contact us about privacy

1.2 Documents to read with this Policy

This Privacy Policy should be read together with the Advocate Terms & Conditions, the Organisation Terms & Conditions, any applicable Program Terms, the Stripe Agreements that govern Connected Accounts and payment processing, and any notice or disclosure presented to you at the time information is collected.

2. Roles and relationship structure

The Platform is a multi-party platform. Personal information may be handled by more than one party depending on how the Platform is used, and different parties are responsible for different things.

2.1 Utogi's role

Utogi owns, operates and controls the Platform and the Advocate Network. In that capacity we handle personal information in order to operate the Platform, administer Programs, record attribution, calculate and route commission, measure Ambassador Activity, administer the Influencer Fund, maintain the Ledger, protect the integrity of the Platform, and meet our own legal obligations.

Utogi acts as the Organisation's limited collection and payment agent for the purpose of collecting Referral Commission and routing it to Advocates through Stripe Connect, and as an Advocate's agent for the purpose of receiving that Referral Commission. Utogi is the payer of Ambassador Commission. Utogi is not the merchant of record for any Customer transaction and is not the supplier of an Advocate's Referral Services.

2.2 Organisations' role

Organisations create and operate Programs through the Platform. An Organisation is the merchant of record for its own Customer transactions and is responsible for the personal information it collects from its Customers, for its own privacy notices and consents, and for ensuring that its collection, use, disclosure and holding of personal information complies with the Privacy Act 2020 and any other applicable law.

An Organisation must use Advocate names, contact details, performance information and related data made available through the Platform solely for legitimate Program purposes.

2.3 Advocates' role

Advocates are independent participants in the Advocate Network and may participate in one or more Programs. Advocates may also use CRM, contact management, lead tracking, workflow, communication and reporting tools made available through the Advocate Portal for their own lawful business activities.

An Advocate is responsible for the lawfulness of the CRM Data they collect and hold, for having a lawful basis to contact each person, for honouring opt-outs, for complying with applicable anti-spam law, and for ensuring that their collection, use, disclosure and holding of personal information complies with the Privacy Act 2020 and any other applicable law.

2.4 Each party is responsible for its own compliance

Each of Utogi, an Organisation and an Advocate is responsible for its own compliance with the Privacy Act 2020 and any other applicable data protection law in respect of the personal information it handles.

3. Information we collect

We collect several categories of personal information in connection with operating the Platform.

3.1 Account and contact information

We may collect:

• full name or legal entity name

• display name

• email address

• phone number

• username or profile identifier

• organisation or business name

• registered address or business address

• jurisdiction of incorporation

• role or job title

• communication preferences

• profile information

• authentication and account credential information

3.2 Identity verification, due diligence and compliance information

In some circumstances we, Stripe, or our other service providers may collect personal information for verification, compliance, payment routing, fraud controls or Connected Account onboarding, including:

• identity verification records

• proof of identity or authority

• business registration details

• beneficial ownership information

• tax status, residency and registration declarations

• Connected Account onboarding and KYC records

• payout recipient verification details

• sanctions, restricted industry and restricted jurisdiction screening records

• licensing, registration or approval records for regulated categories

• due diligence materials and compliance documentation

3.3 Advocate information

Where you are an Advocate, we may collect or generate:

• Advocate Account details

• Advocate Network membership and Program enrolment records

• profile information and application information

• acceptance records for these and other terms, including version, date and time of acceptance

• Tracking Link, Referral Code and coupon code assignments

• performance metrics

• click, referral and conversion records

• Referral Commission, hold, reversal, deduction and payment records

• Ambassador Activity and Ambassador Commission records

• dispute submissions and evidence

• fraud and risk review data

• communications, CRM and workflow records created through the Advocate Portal

3.4 Organisation information

Where you are an Organisation or represent one, we may collect:

• legal name and trading name

• registered address or principal business address

• business contact names and details

• billing and payment method or mandate details

• Set Schedule of Fees, subscription and invoicing records

• Program settings, Program Terms and Program history

• Hold Period, attribution and commission configuration

• integration settings

• website, brand or marketing asset information

• support and account communications

3.5 CRM, contact, lead and workflow data

The Platform may allow Organisations and Advocates to create, upload, collect, store, manage and use CRM Data and related data through the Platform. Depending on how the Platform is used, this may include:

• contact names

• email addresses

• phone numbers

• company names

• notes and comments

• deal or pipeline records

• task or reminder records

• activity history

• communication logs

• workflow or automation records

• tags, labels or custom fields

• lead source information

• customer status information

• internal notes and related business records

3.6 Referral, tracking and attribution data

The Platform relies on referral tracking and attribution systems. We therefore collect, use and generate data such as:

• Tracking Link identifiers

• Referral Code and coupon code assignments

• Qualifying Click timestamps

• session and event timestamps

• Attribution Windows and Attribution Modes

• referrer URLs and landing page information

• browser or device information associated with events

• IP address data

• event IDs and sequencing records

• tie-breaker records

• correction, override and reassignment logs and reason codes

• audit logs relating to attribution

3.7 Customer and transaction-related information

The Platform may collect, use, disclose and hold Customer-related data provided by or on behalf of an Organisation, or generated through referral activity, including:

• customer identifiers

• order or transaction references

• payment event identifiers

• purchase values or commissionable amounts

• product or subscription identifiers

• refund, cancellation, chargeback or dispute events

• Advocate attribution identifiers

• transaction status information

3.8 Financial, billing, payout and tax information

We, Stripe and our other service providers may collect, use, disclose or hold:

• billing contact details

• invoice, statement and Ledger records

• subscription and fee records

• Connected Account identifiers and status

• payout currency selections and payout recipient details

• bank or transfer details handled by Stripe or another payment provider

• transaction and transfer identifiers

• payment processor references

• tax, GST/VAT and residency declarations

• buyer-created taxable supply information issued by us on an Advocate's behalf

• withholding, deduction, remittance and reporting records

• fee, reversal, negative balance and reconciliation records

We do not store full payment card numbers ourselves. Card and bank details are handled by Stripe or another payment provider under its own terms.

3.9 Ambassador Activity and advocacy measurement data

Where Ambassador Commission is available for a Program, we collect, generate and use information about your Ambassador Activity so that it can be measured by the Ambassador Algorithm. Depending on the Ambassador Eligibility set for the Program, this may include:

• content you create, post or publish in connection with a Program

• social media handles, posts, tags, mentions and comments you make in connection with a Program

• engagement, reach and audience metrics you or a third-party platform make available to us

• mentoring, training, coaching and education activity recorded through the Platform

• network growth and Advocate support activity recorded through the Platform

• evidence you provide, or we request, to verify Ambassador Activity

• eligibility, qualifying period, scoring and distribution records

• Ambassador Commission calculation and payment records

• eligibility flags, and whether each eligibility gate for a Program was met

• audience size and composition on each connected social media account and on the Platform

• sales, referral and attribution counts used as scoring inputs

• engagement scores recorded for your posts in earlier periods

• the score, rank, selection decision and allocation amount produced for you by the Allocation Algorithm

• records of posting offers issued to you, and whether each was accepted, declined or allowed to expire

• a copy or record of a qualifying post, and of the engagement data relating to it, retained as evidence supporting a payment

We may require evidence of Ambassador Activity at any time, and may audit it.

3.9A Connected social media accounts

Where you connect a social media account to the Platform so that we can operate the Influencer Fund, we collect data from that account and from the platform that operates it. The platforms we support are TikTok, Facebook, Instagram and LinkedIn. We access only the data covered by the permissions you grant when you connect the account, and only for the purposes described in section 5.3.

Depending on the platform and the permissions granted, this may include:

• account identifiers, handle, display name, profile image and account type

• follower, connection or subscriber counts

• the access tokens needed to maintain the connection, which we store in encrypted form

• post identifiers, permalinks, publication timestamps, captions, hashtags, mentions and tags, and the media contained in a post

• post-level engagement metrics, including impressions, reach, views, watch time, likes, comments, shares and saves

• aggregate audience information the platform makes available, such as broad location or age-band breakdowns

You can disconnect a social media account at any time through the Platform or through the relevant platform’s own settings. Section 10.9 explains what happens to data we have already collected, and how to ask us to delete it. Disconnecting an account during a hold period may affect a payment, as set out in the Advocate Terms & Conditions.

We do not build the technical connection to these platforms ourselves. We use a third-party connector service, the Social Connector supplied by The Network Software Limited trading as Penguin Pilot (NZBN 9429048076104), a New Zealand company that is not related to us. The connector makes the connection to your social media account, publishes content you post through the Platform, and retrieves the statistics we use. It receives the access tokens for your connected account, the content of posts published through it, and the statistics returned by the platform, and it may only use them to provide the service to us.

The connector service is provided to us under our agreement with that company, and its own service providers are listed in its privacy policy. Its infrastructure is hosted in Australia. You deal only with Utogi: your agreement is with us, this policy governs how your information is handled, and any request or complaint about your information should come to us using the details in section 23.

When you connect a social media account, the social media platform will show you a permission screen naming the application that is requesting access. That application may be operated by us or by our connector provider.

3.9B Information about other people in engagement data

Engagement data can include information about people who interact with a post, such as those who comment on or share it. Those people have not dealt with us directly.

We collect engagement information in aggregate form only. We collect counts and totals — how many people viewed, liked, commented on, shared or saved a post — and we do not collect, store or use the identity, handle, profile or contact details of the individual people who engaged with it. We do not use engagement data to build profiles of, contact, or market to those people.

Where we need to detect artificial or purchased engagement, we do so using patterns in aggregate data, such as timing, velocity and distribution, rather than by identifying individual people.

3.10 Promotional content

Where you create promotional content in connection with a Program, that content may contain personal information about you or others. We handle it for the purpose of operating, evidencing, auditing and promoting the relevant Program and the Advocate Network, in accordance with the licence granted under the Advocate Terms & Conditions. You are responsible for having any consent or authority required for personal information you include in that content.

3.11 Usage data and technical information

We collect or generate usage and technical data such as:

• device type

• browser type and version

• operating system

• language settings

• IP address

• approximate geolocation inferred from IP

• session data and timestamps

• page and screen views

• clicks, interactions and navigation events

• performance and crash data

• diagnostics and logs

3.12 Cookies and similar technologies

We may use cookies, local storage, beacons, pixels, SDKs and similar technologies for authentication, security, session management, preferences, attribution, analytics, diagnostics and, where permitted by law, communications or campaign measurement.

3.13 Communications data

If you contact us or use communications features, we may collect:

• your name and contact details

• the content of messages or support requests

• attachments and files

• support notes

• complaint, dispute or escalation details

• email or in-Platform communications records

• other communications history reasonably connected to use of the Platform

3.14 Data from integrations and third parties

We may receive data from Stripe, other payment and payout providers, analytics providers, communications providers, hosting providers, verification providers, fraud providers, social media platforms, and other third-party systems where integrations are enabled or external systems are used. The social media platforms we integrate with are TikTok, Facebook, Instagram and LinkedIn, and section 3.9A describes what we receive from them.

We rely on those third-party providers, and on the relevant Organisations and Advocates, to ensure that any personal information shared with us is collected and disclosed lawfully.

3.15 Business information

We may also collect personal information relating to suppliers, contractors, visitors or other business contacts of Utogi, including contact details, communications, access records, and other information reasonably necessary for business operations, security and administration.

3.16 Sensitive information

The Platform is not intended to require sensitive personal information such as health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation, except where lawful, necessary and permitted by law. We ask users not to submit unnecessary sensitive personal information through the Platform.

3.17 Children's information

The Platform is intended for business and commercial use. It is not directed to children, and we do not knowingly collect personal information from children.

4. Sources of personal information

We collect personal information from a range of sources. Where reasonably practicable, we collect personal information directly from you. In some cases we may collect personal information from third parties where permitted by applicable law.

4.1 Directly from you

We collect personal information directly from you when you:

• create an Advocate Account or Organisation account

• apply to join the Advocate Network or enrol in a Program

• configure or administer a Program

• update your profile or settings

• complete Connected Account onboarding

• connect integrations

• enter CRM Data or contact data

• use workflow or communication tools

• submit evidence of Ambassador Activity

• request support

• raise a dispute

• respond to compliance or verification requests

• set up billing or payment details

• communicate with us

4.2 From organisations, employers or colleagues

We may receive your personal information from an organisation, employer, partner, agency or colleague if they invite you, register you, submit your details, or otherwise cause your personal information to be handled through the Platform.

4.3 From Organisations using the Platform

If you are an Advocate, applicant, Customer, lead or contact connected to a Program, the relevant Organisation may provide personal information to the Platform in connection with Program administration, Advocate approval, attribution, reporting, CRM activity, commission processing or payment processing.

4.4 From Advocates

Advocates may cause personal information to be handled through the Platform through Tracking Links, coupon codes, Referral Codes, CRM tools, workflows, communications tools and related activity.

4.5 Automatically through the Platform

We collect technical, event and usage data automatically through websites, dashboards, APIs, tracking mechanisms, integrations, cookies and system logs.

4.6 From Stripe and other third-party providers

We may receive data from Stripe and other third-party systems such as payment and payout providers, cloud providers, analytics services, support platforms, fraud tools, communications providers, CRM systems, or other integrations enabled by users. This includes Connected Account status, verification outcomes, payment and transfer events, reversals, and compliance flags.

4.7 From public and third-party platform sources

Where Ambassador Commission is available and Ambassador Activity is measured, we may collect information about publicly available or platform-reported advocacy activity, such as posts, tags, mentions, comments and engagement metrics connected to a Program, from social media platforms and similar sources, to the extent permitted by applicable law and by those platforms’ terms. Where you have connected a social media account to the Platform, we also receive the data described in section 3.9A directly from that platform under the permissions you granted.

5. How we use personal information

We generally use personal information for the purposes for which it was collected, or for related purposes as permitted by the Privacy Act 2020. We use personal information for the purposes described below.

5.1 To provide the Platform

We use personal information to provide, operate and support the Platform, including to:

• create and manage accounts

• authenticate users

• operate the Advocate Network

• enable Advocate Portal and Organisation dashboard access

• administer Programs and Program Terms

• display the Program Summary Box and record acceptance

• generate and manage Tracking Links, Referral Codes and coupon codes

• record Qualifying Clicks, attribution events and conversions

• calculate Referral Commission

• manage Hold Periods, reversals, deductions, negative balances and payments

• maintain the Ledger

• provide CRM, contact, workflow, communication and reporting features

• facilitate dispute, support and review processes

5.2 To operate payments through Stripe Connect

We use personal information to collect Referral Commission from Organisations and route it to Advocates using Stripe Connect, including to:

• onboard and verify Connected Accounts

• confirm eligibility for payment

• initiate charges against an Organisation's payment method or mandate

• route Referral Commission and transfer Ambassador Commission

• deduct the Platform Commission Fee

• apply currency conversion and payment processing costs

• manage failed, delayed, restricted or returned payments

• effect reversals, offsets, clawbacks and recoveries

• respond to holds, restrictions or decisions made by Stripe

5.3 To measure Ambassador Activity and administer the Influencer Fund

We use personal information to determine Ambassador Eligibility and to apply the eligibility gates set for a Program, to score and rank eligible Advocates and to select which Advocates receive a posting offer and the amount allocated to each of them, to measure Ambassador Activity using the Ambassador Algorithm, to verify that a post has been published and remains published and compliant throughout its hold period, to calculate and distribute Ambassador Commission from the Influencer Fund, to detect artificial or purchased engagement, followers, connections or sales, to retain a record of a post and its engagement data as evidence supporting a payment, to audit Ambassador Activity, and to enforce the Ambassador Guardrails.

5.4 Tax, invoicing and record-keeping

We use personal information to issue statements, invoices and buyer-created taxable supply information (including on an Advocate's behalf where authorised), to make records available through the Advocate Portal and Organisation dashboards, to apply any withholding, deduction, remittance or reporting required by law or by a tax authority, regulator, court or payment provider, and to meet our own accounting and record-keeping obligations.

5.5 Platform administration and business operations

We use personal information to run our business and administer the Platform, including:

• onboarding users

• managing subscriptions, Utogi Fees, billing and Influencer Fund Contributions

• maintaining system records and configuration history

• carrying out audits and reconciliations

• improving onboarding and support

• testing, maintaining and upgrading systems

• planning capacity, reliability, resilience and performance

5.6 Security, integrity and fraud prevention

We use personal information to protect the Platform and its users, including to:

• monitor suspicious activity and apply risk scoring

• detect self-referrals contrary to Program Terms, duplicate claims, artificial traffic, bot traffic, cookie stuffing, forced clicks, fake leads, unusual velocity, related accounts and collusion

• investigate fraud, abuse, manipulation or non-compliance

• validate attribution and payment integrity

• detect unauthorised access or misuse

• place and manage holds on affected commission during an investigation

• maintain audit logs and risk records

• protect against scraping, spam or security threats

5.7 Misuse of data, network protection and anti-circumvention

We use personal information and related data to detect, investigate, prevent and respond to misuse of the Platform, including:

• unauthorised access or account misuse

• fraud, manipulation or artificial activity

• misuse of contact, referral or Advocate data

• attempts to circumvent the Platform, tracking systems or fee mechanisms

• off-Platform solicitation or diversion of Advocates, Customers or relationships

• attempts to interfere with the Advocate Network or the operation of the Platform

• any activity that may breach applicable law, the Advocate Terms & Conditions, the Organisation Terms & Conditions, or applicable Program Terms

5.8 Communications

We use personal information to communicate with you, including to:

• send verification messages

• respond to support requests

• send service notices and security alerts

• send billing, fee, commission, reversal or payment notices

• notify you of corrections, holds, suspensions or terminations and the reasons for them

• notify users of policy or terms changes

• send product and service updates where permitted by law

• request feedback, survey responses, or information relevant to support or compliance

5.9 Compliance and legal purposes

We use personal information where necessary to comply with laws or protect legal rights, including to:

• comply with accounting, tax and record-keeping requirements

• meet anti-money-laundering, sanctions and payment network requirements

• respond to lawful requests from regulators, courts or law enforcement

• handle claims, disputes, complaints and investigations

• enforce our terms, policies and network protections

• preserve evidence for disputes or legal proceedings

• conduct due diligence and compliance checks

5.10 Product improvement, analytics and research

We use personal information and usage data to understand use of the Platform and improve it, including by analysing feature usage, identifying errors and friction points, evaluating performance and reliability, improving fraud models, reporting and workflows, and developing new features and services. Where appropriate, we use aggregated, anonymised or de-identified data for these purposes.

5.11 Aggregated, anonymised and de-identified data

We may create, use, retain, analyse, disclose and commercialise aggregated, anonymised, de-identified, statistical, operational, security-related, benchmark and reporting data derived from the Platform and from data handled through it, provided that such data does not identify an individual except as permitted by applicable law.

5.12 Marketing and service messages

Where permitted by law, we may use personal information to send service-related updates, product announcements, newsletters or marketing messages. You can opt out of marketing communications, but we may still send service, billing, security, legal or operational messages.

Where Ambassador Commission is available to you, we send notifications telling you that you have been selected for a posting offer and what it is worth. These relate to your participation in the Advocate Network. We ask for your consent to receive them when you enrol, you can change how you receive them in your notification preferences at any time, and every message identifies us as the sender and tells you how to stop receiving them.

5.13 Automated systems and decision support

The Platform uses automated systems to handle Qualifying Clicks, attribution events, event matching, commission calculation, Hold Periods, fraud signals, risk scoring, workflow triggers, anomaly detection and related system logic. The Ambassador Algorithm is an automated system used to measure Ambassador Activity and calculate the distribution of Ambassador Commission.

These processes support the operation of the Platform. Human review may be used where appropriate, including for disputes, fraud investigations, escalations, corrections and manual overrides.

Two of these decisions are made by automated means and affect what you are paid. The Allocation Algorithm decides which Advocates in a Program receive a posting offer and the amount allocated to each of them. The Ambassador Algorithm produces an engagement score that determines how much of that allocation is earned. The categories of information used are set out in sections 3.9 and 3.9A and in the Advocate Terms & Conditions.

6. Legal grounds (where required by applicable law)

This section applies only where applicable law requires us to identify a legal basis for collecting, using or disclosing personal information. Where required by law, we may rely on one or more of the following grounds.

6.1 Contractual necessity

We collect, use and disclose personal information where necessary to perform our contract with you, or to take steps at your request before entering into a contract, including for account administration, Platform access, Program participation, CRM functionality, payment processing, support and billing.

6.2 Legitimate interests

Where permitted by applicable law, we may collect, use and disclose personal information for our legitimate business purposes including Platform security, fraud prevention, service improvement, analytics, audit integrity, enforcement of terms, network protection, and communications necessary for operating the Platform.

6.3 Legal obligation

We collect, use and disclose personal information where necessary to comply with legal obligations, including tax, accounting, record-keeping, anti-money-laundering, sanctions, lawful disclosure, court orders, regulatory enquiries and compliance requirements.

6.4 Consent

In some circumstances we rely on consent, such as for certain optional marketing communications, certain cookies or tracking technologies where required, and certain disclosures or transfers where consent is an appropriate mechanism.

7. Disclosure of personal information

We disclose personal information only where necessary for operation of the Platform, to comply with law, or as otherwise described in this Policy.

7.1 Disclosure to Organisations

If you are an Advocate or an applicant, an Organisation whose Program you apply to join, join or participate in may receive information such as:

• your name or display name

• contact details

• profile and application information

• approval status and related records

• performance metrics

• referral and attribution activity

• Referral Commission and payment-related information

• Ambassador Activity information relevant to that Organisation’s Program, including the fact that you published a post about that Organisation, the content and permalink of that post, engagement metrics for it, and the Ambassador Commission paid to you in connection with that Program

• fraud or compliance indicators where reasonably necessary for Program administration

• information reasonably required to investigate misuse, fraud, or breaches of Platform rules or applicable law

We do not disclose to an Organisation the scores, rankings or allocations of any Advocate who was considered but not selected in an allocation run for its Program, the size of any notional allocation held for the Program at Advocate level, or the weightings applied by the Allocation Algorithm.

An Organisation must use that information solely for legitimate Program purposes, in compliance with applicable privacy law, and must not use it for off-Platform solicitation, data harvesting or any purpose prohibited by the Organisation Terms & Conditions.

7.2 Disclosure to Advocates

Where an Advocate participates in a Program, we may make available to that Advocate information reasonably necessary for that participation, including Program Terms, attribution records, commission and Ledger entries relating to them, Customer or transaction identifiers required to evidence an Attributable Sale, and, where an Organisation has failed to pay an amount due, the Ledger records, statements and attribution evidence relating to that amount.

7.3 Disclosure to Stripe and payment providers

We share information with Stripe and, where applicable, other payment or payout providers, to support Connected Account onboarding and verification, identity and KYC checks, event ingestion, reconciliation, payment routing, transfers, reversals, failed transfer handling, fraud controls, and compliance. Stripe handles that information under the Stripe Agreements and its own privacy terms.

7.4 Disclosure to service providers

We use third-party providers to support hosting, storage, analytics, diagnostics, email delivery, support, payment processing, communications, logging, monitoring, verification, fraud prevention, legal, accounting, audit and other operational functions. We rely on those providers to handle personal information in accordance with applicable law.

We also use a third-party connector service to connect the Platform to social media platforms, to publish content you post through the Platform, and to retrieve statistics from those platforms. Section 3.9A identifies that provider and what it receives. We may change, add or remove providers, and we require each of them to handle personal information only to provide its service to us and in accordance with applicable law.

7.5 Disclosure for legal and regulatory reasons

We may disclose personal information where necessary to comply with applicable law, lawful requests, court orders, regulatory or payment network requirements, or to protect the rights, property, safety or legal interests of Utogi, users, Organisations, Advocates, Customers or others.

7.6 Business transfers

If we are involved in a merger, acquisition, financing, due diligence process, restructuring, insolvency event or sale of assets, personal information may be disclosed to advisers, counterparties or successors, subject to appropriate safeguards.

7.7 Aggregated and de-identified information

We may disclose aggregated, anonymised, statistical, benchmark or de-identified information that does not reasonably identify any individual.

7.8 No sale of personal information in the ordinary sense

We do not sell personal information in the ordinary sense of that term. We also do not disclose personal information to unrelated third parties for their independent direct marketing use without consent.

8. Cookies and similar technologies

We use cookies and similar technologies to operate, secure, analyse and improve the Platform, and to support referral tracking and attribution.

8.1 Types of technologies we use

These may include essential cookies, authentication cookies, session cookies, preference cookies, attribution and tracking cookies, analytics cookies, local storage, server-side identifiers, web beacons or pixels, and SDKs and similar technologies.

8.2 Purposes

We use these technologies to keep users logged in, remember preferences, secure sessions, record Qualifying Clicks and attribute transactions, detect suspicious activity, understand Platform usage, improve navigation and performance, and support diagnostics and debugging.

8.3 Your choices

You can usually manage cookies through browser settings or relevant cookie controls. Disabling some cookies may affect Platform functionality, and may affect whether a referral is successfully tracked or attributed.

9. International data transfers

The Platform may store, host or disclose personal information in or to countries other than the country where you are located.

9.1 New Zealand base

Utogi is based in New Zealand.

9.2 Possible handling locations

Information handled through our social media connector service is hosted in Australia. Information held by the social media platforms themselves is handled in the locations set out in their own privacy policies, which commonly include the United States.

Depending on our infrastructure and service providers, including Stripe, personal information may be handled in New Zealand, Australia, the United States, the United Kingdom, the European Union, or other jurisdictions where our service providers operate.

9.3 Cross-border safeguards

Where personal information is transferred overseas, we may use contractual safeguards, service provider terms, standard contractual clauses, technical and organisational safeguards, encryption, provider assessments or other lawful mechanisms where appropriate and reasonably available. We take reasonable steps to ensure comparable protections apply.

9.4 New Zealand Privacy Act considerations

Where the New Zealand Privacy Act 2020 applies, we take reasonable steps to ensure cross-border disclosures are handled consistently with applicable requirements, including, where applicable, Information Privacy Principle 12.

9.5 Organisations and Advocates remain responsible

Organisations and Advocates remain responsible for ensuring that any disclosure of personal information outside New Zealand by them complies with applicable law and that appropriate safeguards are in place.

9.6 International users

By using the Platform, you understand that your personal information may be transferred to and handled in jurisdictions other than your own, and we take steps intended to protect personal information wherever it is handled.

10. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to meet legal or contractual obligations, to resolve disputes, to preserve records, and to protect the integrity of the Platform.

10.1 Account data

We generally retain account information while an Advocate Account or Organisation account is active, and for a reasonable period afterwards, including as needed to wind down outstanding matters. Where an Advocate Account remains inactive or a Connected Account remains unverified and a balance remains, we retain and use recorded contact details in order to attempt to contact the account holder before dealing with that balance.

10.2 Ledger, attribution and audit records

Because the Platform deals with attribution, commission, payments, disputes, fraud controls, acceptance records and audit history, we may retain Ledger records, attribution logs, correction and override logs, acceptance records, transaction mappings and related records for extended periods where reasonably necessary for fraud detection, enforcement of Platform rules, investigation of misuse, and protection of the Platform and its users.

10.3 Financial, payment and tax records

We retain billing, commission, payment, invoice, statement, buyer-created taxable supply information and tax-related records for as long as required by applicable law or business record-keeping standards.

10.4 CRM and communications records

We may retain CRM Data, communication logs, workflow records and related data for as long as reasonably necessary to provide the Platform, support users, comply with legal obligations, resolve disputes, maintain security or support operational continuity, subject to applicable law and to the Advocate Terms & Conditions and Organisation Terms & Conditions.

10.5 Ambassador Activity records

We may retain Ambassador Activity, eligibility, measurement, evidence and distribution records for as long as reasonably necessary to administer the Influencer Fund, evidence and audit distributions, respond to disputes, meet tax and record-keeping obligations, and protect the integrity of the Ambassador Commission scheme.

Engagement scores and allocation records are retained and re-used as inputs to later allocation runs, so they remain in active use rather than being held only as historical records. We also retain copies or records of qualifying posts and the engagement data relating to them, as evidence supporting the payments we made.

Data we obtain from a connected social media account is retained in accordance with the requirements of the platform that supplied it, and is deleted or de-identified when those requirements or section 10.9 require it.

10.6 Logs and security data

We may retain system logs, access records, risk indicators and diagnostics for periods appropriate to security, fraud prevention, support and integrity purposes.

10.7 Backup retention

Backups may contain personal information for a limited rolling period after deletion from active systems.

10.9 Disconnecting a social media account and requesting deletion

You can disconnect a connected social media account at any time, in the Platform under your account settings, or by removing Utogi’s access in the settings of the relevant platform. Disconnecting stops any further collection of data from that account.

To ask us to delete the data we have already collected from a connected social media account, contact us using the details in section 23, or use the deletion request facility in the Platform. We will confirm receipt of your request, tell you what will be deleted and what we are required to keep, and give you a way to check the status of the request.

When we act on a deletion request we delete the access tokens, account and audience data, and post and engagement data we obtained from that platform. We may retain a limited record where we are required or permitted to do so, including records evidencing a payment we made to you, records required for tax, accounting and anti-money-laundering purposes, records needed to resolve a dispute or investigate fraud, and information in backups for the limited rolling period described in section 10.7. Anything retained is used only for those purposes.

Where information is held by a service provider on our behalf, including our social media connector service, deletion also takes place in that provider’s systems, on the timetable set by our agreement with it. That timetable includes a short period during which data remains available for export before it is removed from production systems, and a further period before it ages out of backups. We cannot delete information faster than that provider is able to.

Content you have already published on a social media platform lives on that platform, not with us. Removing a post through the Platform does not delete it from the social media platform unless that platform supports deletion and the deletion succeeds. To be certain a post is gone, remove it on the platform itself.

10.8 Deletion, de-identification and anonymisation

Where appropriate and reasonably practicable, we may delete, de-identify, anonymise or aggregate personal information when it is no longer needed, subject to legal, accounting, support, dispute, fraud prevention, security and operational requirements.

11. Security measures

We implement reasonable technical and organisational measures designed to protect personal information.

11.1 Technical measures

These may include encryption in transit, encryption at rest where appropriate, access controls, credential protections, logging and monitoring, backup protections, patching and maintenance, anomaly detection and fraud systems, secure session controls, and monitoring and controls designed to detect misuse of data, unauthorised access, or attempts to extract or misuse Platform data.

11.2 Organisational measures

These may include role-based access controls, confidentiality obligations, internal policies and procedures, vendor oversight, incident response processes, least-privilege access principles, and training and awareness.

11.3 Your responsibilities

You are responsible for the security of your account credentials and for activity carried out through your account. You must notify us immediately of any suspected unauthorised access, misuse or security breach.

11.4 Limits of security

No system can guarantee absolute security.

12. Data breach and incident response

We maintain processes for identifying, managing and responding to security incidents and privacy breaches. If we become aware of a breach involving personal information, we will assess the incident and take appropriate action, which may include containment, investigation, mitigation, remediation, and notifications where required by law.

A breach may occur in a system operated by one of our service providers rather than in ours. Our agreements require those providers to tell us without undue delay and to give us the information we need to assess it. We then assess the incident and, where a notification is required, we make it. We do not rely on a provider to notify you on our behalf.

Where an Organisation or an Advocate is the party responsible for the relevant personal information, we may notify or work with that party in accordance with our contractual role and applicable law.

13. Your rights and choices

Under the New Zealand Privacy Act 2020 you have the following rights in relation to personal information we hold about you. If other laws apply in relation to your personal information, you may have additional rights.

13.1 Access

You have the right to request access to personal information we hold about you. Access may be refused in some circumstances permitted by the Privacy Act 2020. We may charge a reasonable fee for providing access to personal information where permitted by the Privacy Act 2020.

13.2 Correction

You have the right to request correction of personal information we hold about you that is inaccurate, incomplete, misleading or not up to date. If we do not agree to a requested correction, you may request that a statement of correction be attached.

13.3 Withdrawal of consent

Where we rely on consent to collect or use personal information, you may withdraw that consent at any time.

13.4 Complaints

If you have a concern about our handling of your personal information, please contact us using the details in section 23 and we will investigate. If you are not satisfied with our response, you may make a complaint to the Office of the New Zealand Privacy Commissioner.

13.5 How to exercise your rights

You can contact us using the details in section 23. We may need to verify your identity before acting on a request.

13.6 Requests relating to another party's information

If your request relates to information provided by, or held on behalf of, an Organisation or an Advocate using the Platform, we may direct you to that party. Requests relating to information held by Stripe in connection with your Connected Account may need to be made to Stripe.

14. GDPR and UK GDPR information

This section applies only to the extent that the GDPR or UK GDPR applies to our handling of personal information:

• our role in relation to personal information will depend on the circumstances and the applicable law

• lawful grounds are described in section 6

• individuals may have rights under those laws, which may include rights of access, correction, erasure, restriction, objection, portability and complaint

• where international transfers occur, we seek to use lawful transfer mechanisms where required

Nothing in this section is intended to extend the application of the GDPR or UK GDPR beyond what is required by law.

15. United States state privacy disclosures

For residents of U.S. states with privacy laws, where applicable:

• we may collect identifiers, contact information, commercial information, internet activity information, professional information, financial and payment information, and inferences used for service integrity or improvement

• sources and purposes are described throughout this Policy

• we do not sell personal information in the ordinary sense

• individuals may have rights to know, access, correct, delete, and opt out of certain uses or disclosures depending on applicable state law

• we do not discriminate against individuals for exercising applicable privacy rights, subject to the practical consequences of their request

16. Platform records and audit functionality

We may maintain records and functionality including:

• acceptance records and version history for these and other terms

• attribution logs, correction logs and override logs

• dispute records and evidence

• fraud and risk signals

• Ambassador Activity measurement and distribution records

• eligibility, scoring, selection and allocation records

• copies or records of qualifying posts and their engagement data

• records of requests for human review of an automated decision, and their outcomes

• CRM and workflow records

• Ledger, commission and payment records

• audit logs and related operational records

17. Data minimisation and proportionality

We aim to collect, use, disclose and hold only the personal information reasonably necessary for the purposes described in this Policy. The exact data handled will vary depending on how Organisations and Advocates use and configure the Platform.

18. Accuracy of information

We take reasonable steps to ensure personal information we use is accurate, complete, relevant and up to date for the purposes for which it is used. Users are responsible for keeping their own account, billing, tax, residency, payment, CRM and related personal information accurate and current.

Where information about you is used as an input to a decision that affects what you are paid, including your audience size, your sales activity and your engagement scores, we take reasonable steps to check that it is accurate before we rely on it. You can see the inputs recorded for you in the Advocate Portal, and you can ask us to correct them. Where an input is found to have been materially incorrect, we may re-run an allocation or recalculate a score.

19. Third-party websites and services

The Platform may link to, or be used with, third-party websites, tools or services, including Stripe and the social media platforms we integrate with, being TikTok, Facebook, Instagram and LinkedIn. We are not responsible for their privacy practices, and their handling of your personal information is governed by their own terms and privacy policies. Connecting an account to the Platform does not change the relationship between you and that platform.

20. Business contact and B2B data

Where we collect, use, disclose and hold information about representatives of Organisations, vendors, partners or other business contacts, we use that information for relationship management, support, contracting, billing, account administration and compliance.

21. Marketing communications and preferences

If you receive marketing communications from us, you can opt out using the unsubscribe mechanism or by contacting us. We may still send transactional, service-related, billing, security, legal or operational messages.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, operations, legal obligations or privacy practices. If we make material changes, we may notify users by appropriate means, including by updating the "Last Updated" date, posting an updated version on our website or the Platform, or sending an email or in-Platform notice where appropriate.

23. Contact us

If you have any questions, requests or complaints about this Privacy Policy or our handling of personal information, please contact us:

Utogi Ltd

NZBN 9429053309945

Email: support@utogi.com

If your request relates to personal information held on behalf of an Organisation or an Advocate using the Platform, you may also need to contact that party directly.

24. Additional detail

The following supplemental explanations are intended to provide greater detail for readers who want more context. They do not limit anything set out above.

24.1 Multi-party data flows

The Platform is not a simple single-user product. It sits between multiple parties, including Utogi, Organisations, Advocates, Customers, leads, contacts, Stripe, and other service providers. A single item of information may be relevant to different parties for different reasons. For example, an Advocate's email address may be visible to an Organisation for Program administration, while the same Advocate's acceptance records, Ledger entries and fraud records are also maintained by Utogi for Platform integrity.

24.2 Tracking and attribution data

Tracking and attribution systems rely on data such as Tracking Links, timestamps, code usage, event IDs, metadata, device information, browser information, session information and audit logs. We may retain and use such data to determine attribution outcomes, apply Attribution Modes and tie-breakers, correct or reassign attribution, detect fraud, resolve disputes and preserve Platform integrity. We do not guarantee that every transaction will be tracked or attributed, and attribution depends on technical factors outside our control.

24.3 CRM Data

The Platform may make CRM and related tools available to both Organisations and Advocates. In some cases CRM Data may be supplied by an Organisation or derived from an Organisation's Customer relationship. In other cases an Advocate may create or upload their own CRM Data for their own lawful business activity.

The party that collects and holds CRM Data through the Platform is responsible for the lawfulness of that data, for having a lawful basis for it, and for complying with applicable privacy and anti-spam law. Nothing in the applicable terms prevents Utogi from hosting, handling, securing, backing up, retaining, analysing and using CRM Data as reasonably necessary to provide, operate, support, secure, improve and enforce the Platform, or from creating aggregated, anonymised, de-identified, statistical, benchmark, operational, security-related or reporting data derived from it, where permitted by the applicable terms and by law.

An Advocate must not use CRM Data or other Platform-derived information for a purpose prohibited by the Advocate Terms & Conditions, and must not export or retain it after termination other than data relating to their own pre-existing contacts.

24.4 The Ambassador Algorithm

Ambassador Commission is calculated using the Ambassador Algorithm, which measures Ambassador Activity against the Ambassador Eligibility set for a Program. We will tell you the total Ambassador Commission credited to you for each period, and the categories of factor the Ambassador Algorithm takes into account. The detailed weighting, methodology and factor-by-factor breakdown of the Ambassador Algorithm is our confidential information and is not disclosed. This does not affect any right you have under applicable privacy law to request access to personal information we hold about you, subject to the grounds on which access may lawfully be refused, including where disclosure would reveal a trade secret or unreasonably prejudice our commercial position.

The Allocation Algorithm, which determines which Advocates receive a posting offer and the amount allocated to each of them, is treated the same way. We will tell you the categories of factor it takes into account and your own allocation. We will not disclose its detailed weighting or methodology, the score or allocation of any other Advocate, or the size of the amount Utogi has allocated to a Program. Section 5.13 sets out your right to ask for a human review of a decision made using either algorithm, and this section does not limit your right under privacy law to request access to personal information we hold about you.

24.5 Single-tier structure

Referral Commission is payable only to the Advocate to whom an Attributable Sale is attributed. The Platform does not operate multi-tier, downline, override, hierarchy-based or recruitment-based commission structures, and does not maintain hierarchy or downline data for the purpose of paying commission. Where you invite another person to join the Advocate Network, they join as an independent Advocate of Utogi, and you acquire no right over their account, participation, earnings or personal information.

24.6 Record retention and network protection

Because Utogi operates a network-wide platform, we may retain information for longer where reasonably necessary to preserve records, detect fraud, resolve disputes, support legal compliance, protect Platform integrity, maintain network protections, or enforce our contractual rights.

24.7 No waiver of legal rights

Nothing in this Privacy Policy is intended to waive or limit any privacy right or legal protection that cannot lawfully be waived or limited under applicable law.