MotorMinder Privacy Policy

Privacy at a glance

MotorMinder helps businesses manage vehicle reminders and related customer communications. A workshop or other business may enter information about you and your vehicle, and you may give further information by replying or using a customer link. That business uses the information to manage its relationship with you; MotorMinder supplies the supporting technology.

We also handle information for our own account administration, billing, support and security. We do not sell customer contact lists, automatically share a workshop's records with other workshops or related products, or use identifiable customer records to train general-purpose AI models. You can ask about information held about you, request access or correction, and stop unwanted reminder messages.

This overview is not a substitute for the detail below. The policy applies to information about identifiable individuals, including information that can identify someone when combined with other records.

1. Who is responsible and how to contact us

MotorMinder is operated by Smart Limited, New Zealand, referred to as "MotorMinder", "we", "us" or "our". Our website is motorminder.co.nz and our contact address is 163 West Street | PO Box 270 | Ashburton | 7700.

Our Privacy Officer can be contacted at accounts@motorminder.co.nz. For general support, use accounts@motorminder.co.nz. You do not need a MotorMinder account, a paid subscription or a particular form to raise a privacy concern.

Where a workshop or other business uses MotorMinder to contact you, its identity and contact details should be shown in the message or associated customer page. Contact that business about the reason for a particular reminder, its records or a booking. You may also contact us, and we will help identify the appropriate organisation without disclosing another person's private information.

2. Who this policy covers

This policy covers visitors to our website; prospective and current business customers; account administrators and staff; people whose contact or vehicle details a business processes through MotorMinder; people replying to reminders or using customer-facing links; and people contacting us for support or other enquiries.

The New Zealand Privacy Act 2020 is our principal privacy framework, including Information Privacy Principle 3A for covered indirect collections from 1 May 2026. Other laws may apply to particular activities or people. This policy does not remove protections that apply by law.

A workshop's own privacy notice also applies to its collection and use of customer information. External websites or independently provided services may have their own policies. A link to another policy does not release us from responsibilities that apply to our own handling of information.

3. Workshop information and MotorMinder's own records

For customer and vehicle records processed solely on behalf of a subscribing business, that business decides why the information is collected and used, who it contacts and how it manages the customer relationship. MotorMinder stores and processes those records to perform the business's lawful instructions.

Under New Zealand's agency provisions, information processed solely on another agency's behalf can be treated as held by that agency. However, that description is not a blanket exemption for MotorMinder. If we collect, use or disclose information for our own purposes, the responsibilities for that activity must be assessed separately.

We are responsible for our own business-contact, subscription, payment-administration, support, security and legal-compliance activities described here. We remain responsible for the commitments we make to protect information and assist the businesses we serve. A workshop cannot authorise us to use personal information for an unrelated purpose simply by claiming ownership of its database.

For example, a workshop decides which customer's WoF date to record and which reminder to send. MotorMinder processes those records on its behalf. We may separately keep a limited security log to investigate unauthorised access to the service. The purpose, access and retention for those activities are not interchangeable.

4. Information we handle

The information depends on which functions are actually used. We seek to collect only what is reasonably needed for the relevant purpose.

A registration plate or other vehicle detail can be personal information when associated with an identifiable person. Free-text notes and message bodies can also contain personal information even where the field is not labelled as a personal-information field.

Please do not put payment-card details, passwords, identity-document copies, medical information or unrelated sensitive information into reminder notes or messages. Where a card processor is used, payment-card details should be entered only into the approved payment flow. We do not require full card details or card security codes to be supplied in customer records or support messages.

We do not operate a vehicle-location tracking service. Ordinary web connections may reveal an approximate location associated with an IP address; that is not the same as receiving the vehicle's GPS location.

5. Where information comes from

We collect information directly when you create an account, complete a form, contact us, reply to a message or use a customer action. We may also receive it from a business you deal with, an authorised account user, that business's lawful import, a communications or payment provider, or a separately authorised integration that is actually enabled.

The service itself generates records such as reminder history, changes, delivery events, consent and suppression activity and security logs. When a person acts for someone else, the business must assess that person's authority and any applicable notification obligations.

We do not automatically obtain customer records from Panel Quote or another related product. Being a Panel Quote customer, receiving a discounted plan or having the same business owner does not authorise information sharing. Any future integration must be explained and separately authorised before it is used.

A date entered by a workshop, imported from a file or stated by a customer is not automatically verified government information. We do not claim access to an official vehicle register merely because a registration plate is recorded.

6. Why information is used

On a subscribing business's behalf, we use relevant information to maintain its records, prepare authorised imports, calculate and send configured reminders, receive responses, support booking requests, record customer actions, apply communication preferences and provide its account history and reports.

For our own operations, we use the information reasonably needed to establish and administer accounts, confirm authority, charge agreed fees, answer support requests, protect the service against abuse, investigate faults and incidents, keep required business records and establish or respond to legal claims.

We may use genuinely de-identified or aggregated information to understand service performance and improve the product. Before doing so, we take reasonable steps to ensure people and confidential business records are not identifiable. Merely removing a name, assigning a code or hashing an identifier does not necessarily make information anonymous. We do not attempt to re-identify information represented as anonymous.

We do not sell personal information or customer lists, allow one workshop to browse another's records, use a workshop's customer database for our unrelated marketing, or provide identifiable records to insurers, parts suppliers, other group products or competitors merely because they have a commercial relationship with us.

We do not treat this policy as permission for an incompatible new purpose. Where a new use requires further notice, authorisation or another lawful basis, we will address that before starting the use.

7. Direct and indirect collection notices

At direct collection, we aim to make clear who is collecting and holding the information, why it is needed, who may receive it, whether supplying it is voluntary or required, the practical consequence of not supplying it, and how to seek access or correction. If a particular law requires information, the relevant notice must identify that law rather than implying that all our collection is compulsory.

Providing information to MotorMinder is generally voluntary. However, without the required business contact and account details we may not be able to open or administer an account. Without a valid contact method and the relevant vehicle or booking details, the business may not be able to send a reminder or deal with your request through the service. Optional information should not be treated as required.

When personal information is collected from another source, the organisation carrying out that collection must assess both its authority to collect indirectly and any notification duty. Where IPP 3A applies, it must take reasonable steps to notify the person of the collection and the required matters as soon as reasonably practicable, unless a valid exception applies.

For a workshop importing its own existing records into MotorMinder solely for processing on its behalf, the analysis is different from a new organisation acquiring a list for its own purposes. There is no automatic rule that every technical import requires a fresh notice from every technology supplier. Equally, a pre-existing business relationship or a privacy policy buried on a website is not, by itself, proof that the necessary notice has reached the person.

Where a notice is needed, it should identify the relevant business, explain that contact and vehicle details have been collected, describe the reminder and response purposes and relevant recipients, identify who collects and holds the information, provide an address or suitable contact equivalent, and explain access and correction rights. We will provide suitable information about our role to support those notices and meet any separate notification obligation that applies to us.

8. Reminders, marketing and communication preferences

A business using MotorMinder is responsible for establishing appropriate permission and other legal requirements for the messages it instructs us to send. A vehicle reminder can have a commercial purpose; calling it a service reminder does not automatically exempt it from electronic-messaging requirements.

Commercial electronic messages must identify the authorising sender and provide a clear, functional, free unsubscribe facility using the same communication medium. For SMS, follow the stated STOP instruction. For email, use the unsubscribe facility or send the request using the stated email contact. You do not need to create an account or explain why you want to stop reminders.

We process clear opt-outs promptly and require applicable unsubscribe requests to be honoured within five working days. The unsubscribe facility must remain usable for at least 30 days after the relevant message. Some messages already handed to a network may arrive after a request, but we do not continue scheduling reminders as though the request had not been made.

A STOP request normally applies to reminders from the identified business to that mobile number. A request to stop all communication is treated according to that wider scope. It does not necessarily cancel an appointment or change a separate relationship with an unrelated business. If a shared sender creates uncertainty, the affected reminders should be paused while the scope is resolved.

Limited, genuinely necessary account-security, billing, requested-booking or legal communications may still be appropriate for their own purpose. This is not a basis to disguise promotions as essential notices or continue unwanted reminders. We distinguish our own marketing permission from permission for a workshop's messages.

We may retain a minimal suppression record to avoid contacting someone again. It is used for compliance, not as a new marketing list. A new import must not silently undo an opt-out.

9. Automation and optional AI

MotorMinder uses ordinary automation to schedule reminders and process clearly defined actions. For example, a configured system can record a STOP instruction, route a BOOK reply as a booking request or flag a reply for staff attention. These operations do not independently verify a vehicle's condition, a completed inspection or the authority of a new owner.

The optional AI Import Assistant can use the external OpenAI API to suggest which supplied CSV columns correspond to MotorMinder import fields. It is disabled by default and operates only for an enabled, selected pilot account. MotorMinder sends sanitised column-label hints first. If a user requests sample assistance, MotorMinder creates up to three locally redacted examples that preserve useful value types or date formats; names, email addresses, phone numbers, vehicle registrations, addresses and source identifiers become synthetic examples or placeholders. An uploaded CSV and raw customer rows are not sent to OpenAI. Where safe context is insufficient, the field stays unmapped for manual review.

Suggestions require explicit user review, can be edited or dismissed, and do not automatically import, change workshop records, confirm due dates or send messages. The normal import preview, validation and date-confirmation controls still apply. Manual imports remain available when AI is disabled, unavailable or at a usage limit. MotorMinder retains limited request, usage, model/version and review metadata rather than unnecessary prompt or sample content. OpenAI may process the redacted request outside New Zealand under its API data controls. We disable stored Responses, but do not claim that Zero Data Retention is active or that provider security/abuse-monitoring retention is absent. Sending unredacted customer information would require a separately approved change and appropriate notice before use.

We assess the provider and data handling before enabling an AI function, minimise unnecessary personal information and require suitable confidentiality, security, retention and use restrictions. We do not use identifiable customer data to train general-purpose AI models or authorise suppliers to use it for their general model training. We do not use public consumer-chatbot accounts as an undisclosed channel for customer records.

AI outputs can be wrong. Uncertain replies and material changes should be presented for human review. A clear opt-out must not wait for an AI decision. AI must not fabricate permission, confirm a booking that the business has not accepted, or mark an official requirement as independently verified.

Optional AI Reply Interpretation uses the same default-off, selected-pilot controls. Only locally sanitised semantic words and indexed vehicle/timing references are sent to OpenAI; the original reply, customer identities, registration, address and actual personal dates stay in MotorMinder. Quoted evidence is displayed locally from the unchanged original reply and receipt time. Unknown, unsafe or ambiguous context requires manual review. Suggestions cannot perform a business action or send a response. A workshop user must explicitly choose and approve a validated action; booking requests are not appointment confirmations. Existing opt-outs and deterministic STOP handling remain authoritative. Manual reply review is available without AI. Request usage and accepted, edited, declined or misleading-proposal feedback are retained for audit and quality review under the same provider data-control limits described above.

Only features actually available and enabled in an account operate on that account's information. Mentioning optional AI in this policy does not mean it is active for every customer. Ask the relevant business or our Privacy Officer about the features used for your records and available alternatives.

10. Who information may be shared with

Information is accessible to authorised users of the relevant business according to their roles. Necessary parts are made available to the intended message recipient or the business receiving that person's request. We do not make the complete account visible through a customer link.

We use specialist suppliers for hosting and backup, communications delivery, payment processing, support and security, and optional AI where enabled. They receive only the information reasonably needed for their role and are subject to suitable safeguards. A messaging provider may need the destination number, sender information, message content and delivery events; a payment provider may need billing and payment information. Those are different data flows, not permission to share all account information with every supplier.

Staff, contractors and professional advisers may access necessary information for authorised support, operational, legal or accounting work, subject to confidentiality and appropriate access restrictions. Related companies are not automatically entitled to the information simply because they are related.

We may disclose information where required by law, a valid legal process, or another applicable lawful basis, including responding to a serious threat where the law permits it. We assess requests, limit disclosure to what is justified and, where lawful and appropriate, tell the affected business or individual. We do not promise to notify where doing so is legally prohibited or would defeat a lawful investigation.

For a genuine proposed business transfer, any due-diligence disclosure must be necessary, proportionate and protected; identifiable information should be avoided where it is not needed. A successor receiving information must take on the relevant privacy commitments, and affected people or account holders will receive appropriate notice of a material change. A business sale is not blanket permission for unrelated reuse.

Some recipients, such as telecommunications carriers or payment providers performing their own legal and fraud functions, may act independently rather than solely on our instructions. Their applicable policies and purposes must be considered. We remain responsible for assessing the lawfulness of our own sharing.

11. Hosting and processing outside New Zealand

MotorMinder's primary application hosting is in New Zealand. That does not mean that every message, support activity, payment transaction, provider log or backup necessarily remains in New Zealand. The actual locations depend on the specific suppliers and functions used. We maintain information about relevant providers and processing locations, available from our Privacy Officer.

Before using an overseas provider, we assess the information involved, the provider's role and terms, location and access arrangements, security and retention, and the safeguards available. Where a provider stores or processes information solely as an agent, we remain accountable for the responsibilities that apply to that arrangement.

Where an arrangement is a disclosure to a foreign person or entity to which IPP 12 applies, we must have a permitted basis for the disclosure, such as reasonable grounds for believing comparable safeguards apply through relevant law or enforceable commitments. An overseas storage arrangement and an independent overseas disclosure are not automatically the same legal situation.

We do not rely on your mere use of this website as blanket authorisation for disclosures without comparable safeguards. If we ever seek the specific informed authorisation permitted by IPP 12 for such a disclosure, the notice must explain that comparable protection may not apply and provide a genuine choice before the disclosure.

12. How we protect information

We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the information and the risks of the service. These include restricting access to authorised people, separating business accounts, protecting authentication and customer-action links, securing communications, maintaining and updating systems, and maintaining backup and incident-response processes.

Authorised support access is limited to a legitimate need. Staff and contractors must not browse customer records out of curiosity or copy live information into personal tools or unrelated test environments. Where data is needed to investigate an issue, access and copies should be limited to the issue and retained only as justified.

No internet service can promise absolute security. Our responsibility is to take reasonable protective steps and respond appropriately to risks and incidents, not to claim that a breach is impossible. Please protect account credentials, restrict shared-device access and report a suspected compromise promptly.

13. Cookies, website information and usage measurement

We use necessary cookies or equivalent browser storage to support functions such as sign-in sessions, security and preferences. Server and security logs can record requests independently of cookies. Blocking necessary storage may prevent authenticated functions from working.

We do not use reminder recipients' records to build third-party advertising profiles. If optional analytics or other non-essential tracking is introduced, we will identify what it does, the provider and relevant choices before enabling it. Our implementation standard is not to activate non-essential tracking before the visitor has made the relevant choice. Rejecting it must not prevent access to legal notices or privacy and unsubscribe functions.

Message delivery information and recorded use of a MotorMinder action link may be used to operate and explain the relevant reminder workflow. Such a record is not reliable proof that a particular person read a message. We do not represent the absence of advertising cookies as the absence of all technical logging.

Security tokens, private link contents, message bodies and complete imported records must not be sent to advertising or unrelated analytics systems. Any actual analytics tools must be disclosed consistently with what the website uses, not merely described as a hypothetical category.

14. Customer links and information visible to others

A customer-facing link may use a secure token to permit limited access without an ordinary account login. Anyone receiving a forwarded link may be able to see the limited information or actions it authorises while it remains valid. We restrict the information shown and use protections suitable to the action, including expiry and validation where appropriate.

The page should identify the relevant business and clearly distinguish a request from a confirmed booking. A wrong-recipient report should stop unnecessary disclosure and be referred for correction, not require the recipient to reveal additional unrelated personal details.

Be cautious when using shared devices or forwarding messages. SMS and ordinary email may be visible on a lock screen, shared inbox or device, and a message already delivered cannot necessarily be withdrawn. Avoid sending sensitive information through a reminder reply when a safer contact method is available.

15. Retention, account closure and backups

We keep personal information only for as long as it is needed for a purpose for which it may lawfully be used. An active subscription does not, by itself, justify retaining every old record indefinitely. Businesses using MotorMinder must review their records and use available deletion or support processes when information is no longer needed.

Our standard retention arrangements are below. A shorter period applies where the purpose ends sooner and deletion is appropriate. A longer period requires a specific legal obligation, documented dispute or other justified purpose, and access is restricted accordingly.

Suppression records may remain necessary after an ordinary customer record is deleted, so that a new import does not trigger renewed contact. Even a coded or hashed suppression identifier is handled as personal information where it can still be associated with an individual. We review whether continued retention remains necessary.

Backups are protected recovery copies, not searchable customer archives for ordinary use. If a backup is restored, relevant deletion and suppression instructions must be reapplied before routine processing resumes. Independent providers may have their own justified legal records; we require appropriate limits for providers processing solely on our behalf and can explain relevant differences on request.

16. Access and correction

You may ask whether personal information about you is held and request access to it. You may also ask for inaccurate or misleading information to be corrected. Contact the business whose customer records are involved or our Privacy Officer. We will reasonably assist rather than simply send you back and forth.

We may ask for enough information to verify your identity and the records concerned, or your authority to act for another person. Verification must be proportionate. We do not routinely require a full identity-document copy when a less intrusive method is sufficient, and a privacy request must not require payment of a subscription debt.

For requests covered by the Privacy Act's access and correction procedures, we notify you of our decision as soon as reasonably practicable and no later than 20 working days, unless a lawful extension applies. An acknowledgement alone is not that decision. If a lawful extension is needed, we will notify you within the original timeframe, explain the reason and new timeframe, and explain your right to complain about the extension. Where a statutory transfer to another agency is appropriate, it must be made within the applicable period, generally 10 working days, and you must be told. Where access is granted, the information must be provided without undue delay.

Access may be limited on a lawful ground, for example to protect another person's privacy or legally privileged information. We will explain any refusal or redaction and the available complaint rights as required. We do not promise access to another person's complete records simply because some of the same records mention you.

If we do not make a requested correction, you may ask for a statement of the correction sought to be attached so it is read with the information. Where required and reasonably practicable, we will take steps to communicate an accepted correction or attached statement to relevant recipients. Statutory personal-information requests are generally handled without charge; any charge permitted by law would be explained in advance.

17. Deletion, preferences and other choices

You can ask for information to be deleted, for reminders to stop, or for inaccurate contact or vehicle details to be corrected. New Zealand privacy law does not provide an unconditional right to erase every record immediately. We assess whether the information is still needed, whether the relevant business controls the record, whether a legal retention requirement applies and whether minimal evidence is needed for a complaint, suppression or dispute.

Where deletion is appropriate, we will delete, de-identify or arrange the relevant action. Where it is not, we will explain the reason and consider limiting access or use. Removing a record from MotorMinder does not automatically remove records the workshop lawfully holds in its own other systems, and does not remove a separate legal obligation concerning a vehicle.

You may decline optional information and optional marketing or tracking. A business's authority to process a record is not always based on revocable consent alone, so withdrawing a particular permission does not necessarily stop justified billing, security or legal record-keeping. It does stop the activity for which that permission is required, unless another applicable legal basis genuinely permits it.

A business's contractual right to an account export is separate from an individual's statutory access right. We do not describe an account export as a universal statutory right to data portability.

18. Privacy breaches and incident response

If we become aware of a possible privacy breach, we assess it, take reasonable steps to contain it, identify affected information and people, and address the cause. Where information is processed for a business, we notify and assist that business as soon as reasonably practicable so it can meet its responsibilities.

Where a breach has caused serious harm or is likely to do so, the responsible agency must notify the Privacy Commissioner and affected individuals as soon as practicable, unless a lawful exception applies. If we have that responsibility, we will make the required notifications. We do not wait for every detail to be final before giving a notification that is required, and we provide material updates as information becomes available.

This policy does not convert a recommended operational timeframe into a different statutory deadline or allow either party to delay a necessary notification merely because the other is investigating. Report a suspected breach to our Privacy Officer promptly and avoid including more personal information than is needed to identify the concern.

19. Young people and information about others

MotorMinder is a business service administered by adults; it is not designed as a children's consumer platform. However, a business may have a legitimate customer who is a young person. Their information still requires suitable care, appropriate authority and clear communication. We do not assume that being under 18 removes a person's privacy rights.

Where you supply information about another person, provide only what is relevant and authorised. Do not add a purchaser's, family member's or new vehicle owner's details merely because you know them. The receiving business must establish an appropriate basis for that collection and any required notice.

20. People outside New Zealand

MotorMinder is intended for New Zealand business use. Internet communications and some providers can involve other countries, and an individual may be overseas when receiving a message. The international-processing safeguards in section 11 still apply where relevant.

We do not claim that this New Zealand policy, by itself, fulfils every obligation under every overseas law. Where another law applies to our activity, we will address the additional requirements and preserve rights that cannot lawfully be excluded. Businesses must not use the service for an undisclosed overseas programme that requires additional legal or technical arrangements without agreeing those arrangements first.

21. Changes to this policy

We will keep this policy aligned with the service's actual practices and show its version and effective date. Material changes will be highlighted through an appropriate notice, such as an account message or email to the relevant administrator, and through a direct notice to affected people where the law or circumstances require it.

Where a change introduces a materially different purpose or processing arrangement, notice must be provided before the change takes effect where required. An updated policy alone is not retroactive consent, authority to disregard an opt-out, or permission to remove accrued rights.

Earlier versions will be retained so the information provided at a particular time can be identified. An acknowledgement that a person has read a policy is not treated as agreement to every possible future use of their information.

22. Complaints and contact

Contact our Privacy Officer at accounts@motorminder.co.nz, or write to Smart Limited at 163 West Street | PO Box 270 | Ashburton | 7700. Please explain the issue, how to contact you and the outcome you are seeking. We will acknowledge the concern and investigate promptly. You do not need legal wording or a paid account to complain.

For records managed on a workshop's behalf, we will explain the respective responsibilities and help direct the concern appropriately. That does not prevent you from complaining about MotorMinder's own actions or omissions.

If the concern is not resolved after you have raised it with the relevant organisation, you can complain to the Office of the Privacy Commissioner using its official complaints process. Its website is privacy.org.nz and its enquiries number is 0800 803 909. You may also contact the Department of Internal Affairs about suspected unlawful commercial electronic messages.

Related page: Terms of Use at /terms.