Privacy Policy

Hublle Limited ("Hublle", "we", "us", or "our") is committed to protecting the privacy of individuals who interact with our platform and website. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information.

Hublle is a New Zealand-based company and is bound by the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs) set out therein. We also comply with international privacy frameworks including the European Union's General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Australia's Privacy Act 1988, and Canada's PIPEDA, to the extent applicable.

By using our platform or website, you acknowledge that you have read and understood this Privacy Policy.

Hublle Limited New Zealand

Email: hello@hublle.co

For GDPR purposes, Hublle acts as a data controller in respect of the personal information of individuals who visit our website or engage with us directly, and as a data processor in respect of personal information processed on behalf of our customers through the Hublle platform.

We collect personal information in the following ways:

Information you provide directly: - Name, email address, job title, and company name when you register, contact us, or complete a form - Billing and payment information when you subscribe to a paid plan - Communications you send us, including support requests and feedback

Information collected automatically: - Usage data including pages visited, features used, time spent, and interactions with our platform - Device and browser information (type, operating system, IP address) - Log data and error reports - Cookies and similar tracking technologies (see our Cookie Policy)

Information from third parties: - Integration data from tools you connect to Hublle (e.g. Jira, Microsoft Project, Salesforce) — only what is necessary to deliver the service - Publicly available information to verify business details

We use personal information for the following purposes:

• Providing our services: To operate, maintain, and improve the Hublle platform
• Account management: To create and manage your account and subscriptions
• Communications: To respond to enquiries, send service updates, and provide customer support
• Marketing: To send promotional communications where you have consented or where we have a legitimate interest (you may opt out at any time)
• Analytics: To understand how our platform is used and to improve user experience
• Security: To detect, prevent, and address fraud, abuse, and security incidents
• Legal compliance: To meet our obligations under applicable laws and regulations
• Billing: To process payments and manage your subscription

We rely on the following legal bases under GDPR (where applicable): - Contract: Processing necessary to perform our contract with you - Legitimate interests: Where our interests do not override your rights - Consent: Where you have given explicit consent - Legal obligation: Where we are required to process data by law

We do not sell your personal information. We may share it with:

Service providers: Third-party vendors who assist us in operating our platform, including cloud infrastructure providers, payment processors, email platforms, and analytics tools. These parties are bound by data processing agreements and may only use your data as instructed.

Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Legal requirements: We may disclose information if required by law, court order, or government authority, including in response to lawful requests from New Zealand agencies or international equivalents.

With your consent: We may share information in other ways with your explicit consent.

Key sub-processors include: - Cloud hosting (e.g. AWS, Google Cloud, or equivalent) - Payment processing (e.g. Stripe) - Analytics platforms - Communication tools (e.g. email delivery services)

A full list of sub-processors is available on request.

As a New Zealand company using global cloud infrastructure, your data may be transferred to and processed in countries outside New Zealand, including the United States, European Union, and Australia.

Where we transfer personal data outside of the European Economic Area (EEA) or United Kingdom, we ensure appropriate safeguards are in place, such as: - Standard Contractual Clauses (SCCs) approved by the European Commission - Adequacy decisions where applicable - Binding Corporate Rules or other approved transfer mechanisms

New Zealand has been recognised by the European Commission as providing an adequate level of data protection.

We take all reasonable steps to ensure that overseas recipients handle your information in accordance with this policy and applicable law.

We retain personal information for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law.

Specifically: - Account data is retained for the duration of your subscription plus up to 3 years after account closure - Usage and analytics data is retained for up to 2 years - Financial records are retained for up to 7 years to meet tax and legal obligations - Marketing data is retained until you opt out or withdraw consent

When data is no longer required, we securely delete or anonymise it.

Depending on your location, you may have the following rights regarding your personal information:

All users (New Zealand Privacy Act 2020): - Right to access your personal information - Right to request correction of inaccurate data - Right to complain to the Office of the Privacy Commissioner

EEA / UK users (GDPR / UK GDPR): - Right to access, rectification, and erasure ("right to be forgotten") - Right to restriction of processing - Right to data portability - Right to object to processing based on legitimate interests - Right to withdraw consent at any time - Right to lodge a complaint with your local supervisory authority

California residents (CCPA / CPRA): - Right to know what personal information is collected, used, or disclosed - Right to delete personal information - Right to opt out of the sale or sharing of personal information (we do not sell data) - Right to non-discrimination for exercising your rights - Right to correct inaccurate personal information

Australian users (Privacy Act 1988): - Right to access and correct personal information - Right to complain to the Office of the Australian Information Commissioner (OAIC)

Canadian users (PIPEDA): - Right to access personal information and challenge its accuracy - Right to withdraw consent

To exercise any of these rights, contact us at hello@hublle.co. We will respond within the timeframes required by applicable law (generally 30 days).

We use cookies and similar technologies to operate our platform, analyse usage, and support our marketing activities.

Types of cookies we use: - Essential cookies: Required for the platform to function - Analytics cookies: Help us understand how the platform is used (e.g. Google Analytics) - Preference cookies: Remember your settings and preferences - Marketing cookies: Used to deliver relevant advertising (only where consent is obtained)

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our platform.

Where required by law (e.g. in the EEA), we obtain your consent before placing non-essential cookies.

We implement industry-standard technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest (AES-256)
• Role-based access controls and multi-factor authentication
• Regular security audits and penetration testing
• Incident response procedures
• Employee training on data protection

While we take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. If you believe your account has been compromised, contact us immediately at hello@hublle.co.

In the event of a data breach that is likely to cause serious harm, we will notify affected individuals and the relevant authorities as required by law.

Our platform is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

Our platform may contain links to third-party websites or integrate with external services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before sharing your information with them.

When you connect a third-party integration to Hublle, we access only the data necessary to provide the requested functionality.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by: - Posting the updated policy on our website with a revised effective date - Sending an email notification to registered users for significant changes

Your continued use of our platform after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

Hublle Limited Email: hello@hublle.co

New Zealand: You may also contact the Office of the Privacy Commissioner at www.privacy.org.nz

EEA/UK: You have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK, or your relevant EU supervisory authority).

Australia: You may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au

We take all privacy concerns seriously and will respond promptly.