Effective: 22 March 2026 | Version 1.3 | Harbor Tech Limited | harbor.co.nz
Changes in v1.3 (22 March 2026): Corrected internal cross-references, strengthened breach notification section, verified document links. Changes in v1.2 (22 March 2026): Refined security language, strengthened AI provider retention guarantees, expanded sub-processor detail, added dedicated privacy contact. Changes in v1.1 (22 March 2026): Added sections on AI features (section 6), cross-border data transfers (section 8), sub-processor register (section 9), data retention (section 11), and privacy rights process (section 12).
Harbor Tech Limited, trading as Harbor ("Harbor", "we", "us", "our") is committed to protecting the privacy of the people who use our platform. This Privacy Policy explains what personal information we collect, how we use and store it, who we share it with, and what rights you have.
Harbor operates the Harbor platform (app.harbor.co.nz), a management system for international student operations used by New Zealand schools. We also operate related websites and services at harbor.co.nz.
This policy applies to: school staff, agents, host families, students, and students' families or guardians who access or use Harbor's platform or services.
Harbor complies with the New Zealand Privacy Act 2020 and the 13 Information Privacy Principles (IPPs) it contains. Where we handle personal information about people in the European Union, we also comply with applicable GDPR requirements.
Harbor operates as a data processor for the schools that use our platform. This means the school is the data controller for information about their students, host families, and programme participants — they determine the purposes for which that information is collected and used. Harbor processes it on their behalf and in accordance with their instructions.
When a school sets up a Harbor account for a staff member, we collect:
When a student is enrolled or managed through the platform, we collect information as provided by the school or agent, which may include:
When a host family applies to host international students, we collect information as provided through the application process, which may include:
When an agent accesses the platform to submit applications or manage enrolments, we collect:
When you use our platform or website, we automatically collect:
This technical information is used for security monitoring, platform improvement, and troubleshooting. It is not used to profile individual users for commercial purposes.
We use personal information:
We do not use personal information for advertising or marketing to third parties. We do not sell personal information.
Some of the information handled through the Harbor platform is particularly sensitive, including:
We apply appropriate care to this information. Access within the platform is restricted on a need-to-know basis. Schools control who has access to sensitive information within their programme.
We share personal information only in the following circumstances:
We do not share personal information with government agencies except where required by law.
We do not share personal information with education agents or other third parties for marketing or commercial purposes without the explicit authorisation of the relevant school.
Harbor uses artificial intelligence to assist school staff with operational tasks such as navigating the platform, generating document summaries, and searching school policy documents. AI features are optional and supplementary — they do not make decisions about students, families, or placements.
AI features are powered by two third-party providers:
AI features process only limited operational context provided by school staff:
The following categories of personal information are never sent to any AI provider under any circumstances:
These data categories are architecturally isolated from the AI code paths within the platform.
Schools can disable all AI features at any time. The platform continues to function fully without AI — these features are additive, not essential. For full technical details, see Harbor's AI Information Audit — available on request from privacy@harbor.co.nz.
Personal information collected through the Harbor platform is stored in cloud infrastructure hosted by Supabase in the AWS ap-southeast-2 region (Sydney, Australia). This means all core school and student data is stored in the Australasia region.
We use industry-standard technical and organisational security measures, including:
We take all reasonable steps to protect personal information against unauthorised access, loss, or disclosure. Our security measures are designed to meet or exceed industry standards for education platforms, and we regularly review and improve them.
Harbor's primary database is hosted in Sydney, Australia. Some third-party services we use to operate the platform involve transferring limited data to the United States for processing:
All US-based providers have executed Data Processing Agreements (DPAs) with contractual safeguards. Each provider holds industry-standard security certifications (SOC 2 Type II and/or ISO 27001).
These transfers comply with Information Privacy Principle 12 of the New Zealand Privacy Act 2020, which permits cross-border disclosure where the recipient is subject to comparable privacy protections.
Harbor uses the following third-party service providers to operate the platform. Data Processing Agreements are in place with all providers.
For detailed information about each provider — including what data they can and cannot access, where it is processed, and the safeguards in place — see Harbor's Sub-processor Register, available on request from privacy@harbor.co.nz.
Harbor maintains a documented privacy breach response process. If we become aware of a privacy breach, we will:
We treat all breaches seriously, including near-misses, and conduct post-incident reviews to prevent recurrence.
We retain personal information for as long as it is needed for the purposes described in this policy, and as required by law or the agreements we have with schools.
When a school's relationship with Harbor ends, we will retain programme data for a period of up to 7 years (consistent with standard New Zealand record-keeping obligations for education providers), after which it will be deleted unless the school requests earlier deletion or extended retention.
Data sent to AI providers is retained by those providers for a maximum of 30 days for trust and safety purposes, then permanently deleted. These retention periods are contractually guaranteed under our Data Processing Agreements with each provider.
Individual users can request deletion of their own personal information by contacting us or their school. We will fulfil deletion requests to the extent possible, noting that some information may need to be retained to meet legal or contractual obligations. Schools can request a full data export or deletion at any time.
Under the New Zealand Privacy Act 2020, you have the right to:
To exercise these rights, please contact us at privacy@harbor.co.nz. We will acknowledge your request within 5 working days and respond substantively within 20 working days, as required by the Privacy Act 2020. If we are unable to comply with a request (for example, because the information is subject to a legal obligation to retain), we will explain the reasons in writing.
If you are a student or host family whose information is held by a school using Harbor, your school is the primary point of contact for access and correction requests. We will work with the school to fulfil your request.
The Harbor platform uses cookies and similar technologies to:
We use session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period). You can disable cookies in your browser settings, but doing so may affect the functionality of the platform.
We do not use third-party advertising cookies or allow third parties to serve advertising on the Harbor platform.
If Harbor is involved in a merger, acquisition, or sale of assets, personal information held by Harbor may be transferred to the acquiring entity. We will ensure that personal information continues to be protected in accordance with this policy following any such transfer, and we will notify affected users of any material change to how their information is handled.
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The current version will always be available at harbor.co.nz/privacy. We will notify schools of material changes. Continued use of the platform after a change is posted constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or how we handle personal information, please contact us:
If you are not satisfied with our response to a privacy concern, you can contact the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.