Privacy policy

Introduction

Volley Payments Ltd (Volley, we, us, our) operates Paid and complies with the Privacy Act 2020 (the Act) when handling personal information. This policy explains how we collect, use, share and protect your personal information when you use Paid. It does not limit your rights under the Act.

Volley is an accredited requestor under the Customer and Product Data Act 2025. Paid accesses your bank data through Volley's accreditation, and only with your authorisation.

Changes to this policy

We may change this policy by uploading a revised version to this website. Changes apply from when they are published.

The personal information we collect from you

When you sign up for a Paid account:

• personal and contact details including your name and email address
• your browser, device ID and IP address, and how you use Paid (including through cookies and analytics), so we can analyse how Paid works, fix any problems, and monitor for fraud and automated bot activity

When you connect a bank account:

• the name and account number of each bank account you connect
• your transactions, including amounts, dates, descriptions, references, and the names and account numbers of people who pay you or who you pay

When you set up notifications:

• the channels you send notifications to, such as Slack or Teams workspaces and channels, or webhook URLs

Your transactions may include personal information about other people, such as the name of someone who has paid you. We treat it the same way as yours.

What we use your personal information for

We use your personal information to:

• authenticate you within our service
• fetch your transactions and send notifications
• understand how Paid is used and fix problems
• keep Paid secure and monitor for malicious use
• improve our services using anonymised data, such as for transaction categorisation
• respond to you and meet our legal obligations

We will not sell your personal information.

How long we store your transaction data

We hold your transaction data for 30 days, then delete it. Anonymised data, which cannot identify you or anyone in your transactions, may be retained in some form as part of improving our services, e.g. for improving transaction classification or merchant descriptors. Notifications already sent to your channels are held by those services, and we cannot delete them.

Disclosing your personal information

We only share your personal information:

• with the channels you send notifications to
• with businesses that help us run Paid, such as hosting and analytics providers, some of which may be outside New Zealand
• where the law requires or allows, such as with a regulator or law enforcement
• with your authorisation
• as part of a sale, merger or restructure of our business

Protecting your personal information

We will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse.

Accessing, correcting or deleting your personal information

You can ask to access, correct or delete the personal information we hold about you by emailing hello@volley.nz. We'll need to confirm your identity first. In some cases the Act allows us to refuse a request, and if we do, we'll tell you why.

Contacting us

For questions, complaints, or to exercise any of the rights above, contact us at hello@volley.nz. If you're not satisfied, you can complain to the Office of the Privacy Commissioner, or for complaints about your bank data, to our dispute resolution scheme, the Financial Dispute Resolution Service.