Effective date: 22 July 2026

This Privacy Policy explains how Daom Limited, trading as Communi, collects, uses, stores, discloses and protects personal information. It applies to the Communi website, apps and services (together, the "Services").

Who we are

Communi is a New Zealand company and an "agency" under the Privacy Act 2020. That Act, and its 13 information privacy principles (IPPs), is the primary law governing how we handle your personal information. Where you are in another country we also comply with the law that applies to you, including the General Data Protection Regulation (EU/UK), the Privacy Act 1988 (Australia), the Personal Data Protection Act (Singapore) and the California Consumer Privacy Act (US). Where those laws give you stronger rights than the Privacy Act 2020, we apply the stronger standard.

1. What we collect

Information you give us

• Identity and contact details — name, email address, postal address, phone number.
• Account information — username, profile details, group memberships, preferences.
• Payment information — billing address and purchase history. Full card numbers are collected and stored by our payment processors (such as Stripe and PayPal), not by Communi.
• Payout and tax information for affiliates — bank or payout account details, tax residency, and identity verification documents where our payment providers require them.
• Content you post — posts, comments, messages, uploads and course activity.
• Support correspondence — the content of tickets and emails you send us.
• Social media profile information, if you choose to connect an account.

Information we collect automatically

• Technical data — IP address, browser type, device characteristics, operating system.
• Usage data — pages viewed, interactions, referring URLs, timestamps.
• Cookies and similar technologies — see section 9.

We collect personal information directly from you wherever it is reasonably practicable to do so (IPP 2). We only collect what we actually need for the purposes in section 2 (IPP 1).

2. Why we collect it, and our legal basis

We use personal information to:

We will not use your personal information for a materially different purpose without telling you first, unless the Privacy Act permits it (IPP 10).

Google Workspace APIs. Communi does not use data obtained through Google Workspace APIs to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

Automated decisions. We do not make decisions that significantly affect you based solely on automated processing without human review. Fraud and abuse signals may be generated automatically, but any resulting suspension, payout hold or termination is reviewed by a person, and you can ask for that decision to be reconsidered under section 7.

3. Who we share it with

We disclose personal information only:

• To service providers who process it on our behalf under contract — hosting, payment processing, email delivery, analytics, customer support tooling. They may use it only to provide services to us.
• To group owners and community administrators, where you are a member of their group, limited to what they need to run it. Group owners are separate agencies under the Privacy Act and are responsible for their own handling of your information.
• Where the law requires it — to comply with a court order, statutory demand, or a request from a regulator or law enforcement agency acting under lawful authority.
• To protect people — where we believe on reasonable grounds that disclosure is necessary to prevent or lessen a serious threat to someone's life, health or safety (IPP 11(1)(f)).
• In a business transfer — if Communi is sold, merged or restructured, subject to the buyer agreeing to protect your information on terms no less protective than this policy.
• With your authorisation.

We do not sell your personal information.

4. Sending information overseas

Our infrastructure is hosted with DigitalOcean, and our primary servers are located in the United States. Some of our other service providers are also located outside New Zealand.

Under IPP 12 we may only disclose personal information to a person or entity outside New Zealand where one of the permitted grounds applies. We rely on:

• contractual comparable safeguards (IPP 12(1)(f)). Our agreement with DigitalOcean incorporates a Data Processing Agreement and the European Standard Contractual Clauses, under which DigitalOcean and its subprocessors are contractually required to protect personal information to a standard at least as protective as the GDPR — which, overall, provides safeguards comparable to the Privacy Act 2020. Our other overseas providers are engaged on equivalent terms; and
• comparable privacy laws, where a provider is independently subject to them (IPP 12(1)(c)).

For EU and UK users, transfers out of the EEA or UK are made under the same Standard Contractual Clauses and the UK International Data Transfer Addendum.

You should be aware that information held overseas may be accessible to overseas courts, law enforcement and government agencies under the laws of that country. If you would rather not have your information disclosed on this basis, contact our Privacy Officer — but note that we may not be able to provide the Services without it.

5. How long we keep it

We do not keep personal information for longer than we need it (IPP 9). When we no longer need it we delete it or de-identify it.

6. Keeping it secure

We protect personal information with reasonable security safeguards (IPP 5), including encryption in transit and at rest for sensitive data, access controls and authentication, role-based staff access on a need-to-know basis, logging and monitoring, and periodic security review.

No system is perfectly secure. If something goes wrong, section 10 explains what we do.

7. Your rights

Under the Privacy Act 2020 you have the right to:

• Access the personal information we hold about you (IPP 6).
• Correct it, or ask us to attach a statement of correction if we do not agree to change it (IPP 7).

Depending on where you live you may also have the right to erasure, to restrict or object to processing, to data portability, to withdraw consent, and — if you are a California resident — not to be discriminated against for exercising a privacy right. We apply these rights to all users wherever we reasonably can.

How to make a request

Contact our Privacy Officer (details below) or submit a request through the Support Centre.

• We will acknowledge your request promptly.
• We will decide on access and correction requests as soon as reasonably practicable and no later than 20 working days after we receive them, as required by s 66 of the Privacy Act 2020. If we need longer we will tell you within that period, and explain why.
• We may ask you to verify your identity first.
• Access and correction are free. We will tell you in advance if a charge applies to anything else, and you can withdraw the request.
• If we refuse a request we will tell you why, and tell you that you can complain to the Privacy Commissioner.

If you are not happy with how we handled it

Complain to us first if you can — Privacy Officer, details below. You can also complain directly to the Office of the Privacy Commissioner:

privacy.org.nz · 0800 803 909 · enquiries@privacy.org.nz
PO Box 10094, The Terrace, Wellington 6143

If the Commissioner cannot resolve your complaint, it may proceed to the Human Rights Review Tribunal.

Outside New Zealand you may complain to your local privacy or data protection authority.

8. Marketing messages

We only send you marketing by email or other electronic message where you have agreed, or where you are an existing customer and the message relates to something similar to what you already have from us.

Every marketing message from us identifies Communi as the sender, includes accurate contact information, and includes a working unsubscribe link. Unsubscribing takes effect promptly and at most within 5 working days. This is required by the Unsolicited Electronic Messages Act 2007.

Unsubscribing from marketing does not stop service messages about your account, billing or security.

9. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember preferences, measure how the Services are used, and support marketing where you have agreed. You can control cookies through your browser, and through our cookie banner where one is shown. See our Cookies Policy for detail.

10. If there is a privacy breach

If we become aware of a privacy breach — unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information we hold — we assess whether it is reasonable to believe it has caused or is likely to cause serious harm, considering the factors in s 113 of the Privacy Act 2020.

If it is a notifiable privacy breach:

• we notify the Privacy Commissioner as soon as practicable after becoming aware of it, as required by s 114; and
• we notify you as soon as practicable, as required by s 115, unless one of the limited exceptions in s 116 applies — in which case we notify you as soon as that exception no longer applies.

Our notification will tell you what happened, what information was involved, what we are doing about it, what you can do, and how to contact us and the Privacy Commissioner.

11. Age

The Services are for people aged 18 and over. We do not knowingly collect personal information from anyone under 18, and we do not market to them. If you believe a person under 18 has given us personal information, contact our Privacy Officer and we will delete it. The Privacy Act 2020 protects people of all ages, and where a breach affects someone under 16 we apply s 116(2)(a) in deciding how to notify.

12. Privacy Officer and Data Protection Officer

Privacy Officer (Privacy Act 2020, s 201) — responsible for our compliance with the Privacy Act, handling access and correction requests, and working with the Privacy Commissioner:

Dan Kung, Privacy Officer
Daom Limited trading as Communi
25 Broderick Road, Johnsonville, Wellington 6037, New Zealand
privacy@communi.com

Data Protection Officer (GDPR) — for EU and UK matters:

Daniel Kung, Data Protection Officer
daniel.kung@lduasia.com

13. Changes to this policy

We may update this policy. If a change materially affects how we handle your personal information we will give you at least 30 days' notice by email and in the platform before it takes effect. The effective date at the top of this page always shows the current version.