BEST BRAINS NEW ZEALAND PRIVACY POLICY

Effective Date: 16 July 2026
Last Updated: 16 July 2026

1. Introduction

Best Brains of New Zealand Ltd, trading as Best Brains New Zealand (“Best Brains,” “we,” “us,” or “our”), respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, hold, use, disclose, store, and protect personal information when you:

·         visit or use our New Zealand website, online portals, applications, or other digital services

·         submit an enquiry or request information about our programs

·         book a consultation, placement assessment, orientation, trial class, or other appointment

·         enroll or seek to enroll a child in a Best Brains program

·         communicate with our corporate office or a participating Best Brains learning center

·         attend a Best Brains event

·         apply for employment, teaching, contractor, or franchise opportunities

·         subscribe to marketing communications or

·         otherwise interact with Best Brains New Zealand.

We handle personal information in accordance with the Privacy Act 2020, including the Information Privacy Principles, and other applicable New Zealand laws.

2. Who This Policy Applies To

This Policy applies to personal information handled through the Best Brains New Zealand corporate website and related corporate systems.

Best Brains learning centers may be independently owned and operated by franchisees. A franchisee may be a separate “agency” under the Privacy Act 2020 and may have its own privacy notice or privacy practices.

When we send an enquiry, enrolment lead, appointment request, complaint, or other information to a local Best Brains learning center, that center may independently collect, use, and hold the information for the purpose of responding to the enquiry or providing its services.

This Policy does not apply to third-party websites, applications, platforms, or services that are not controlled by us, even where our website links to them.

3. Our Identity and Privacy Officer

For the purposes of the Privacy Act 2020, the agency responsible for the personal information described in this Policy is:

Legal entity: Best Brains of New Zealand Ltd.
Email: info@bestbrains.com

Best Brains has appointed a Privacy Officer to oversee privacy compliance, access and correction requests, complaints, privacy incidents, and communications with the Office of the Privacy Commissioner.

4. Meaning of Personal Information

“Personal information” means information about an identifiable individual.

Depending on the circumstances, this may include names, contact details, photographs, recordings, online identifiers, account information, payment information, educational records, assessment results, attendance information, communications, or other information that identifies or can reasonably be linked to a person.

Personal information may relate to a parent, guardian, student, child, employee, job applicant, contractor, franchise applicant, website visitor, or another person who interacts with us.

5. Personal Information We May Collect

5.1 Parent and guardian information

We may collect:

·         name

·         postal and residential address

·         email address

·         telephone number

·         preferred contact method

·         relationship to the student

·         account and login information

·         billing and payment information

·         appointment and enrolment details

·         communication preferences

·         copies of correspondence and

·         Information included in enquiries, feedback, complaints, or support requests.

5.2 Student and child information

We may collect information such as:

·         name

·         date of birth or age

·         year level or grade

·         school information, where relevant

·         parent or guardian details

·         educational needs and program interests

·         placement-assessment responses and results

·         program level and class placement

·         attendance and scheduling information

·         homework, classwork, assessment, and progress information

·         teacher comments and learning observations

·         account or student identification numbers

·         information required to provide safe and appropriate services

·         allergy, medical, accessibility, or emergency information voluntarily provided where reasonably necessary

·         photographs, audio recordings, or video recordings where appropriate notice or permission has been provided and

·         communications involving the student.

We recognise that information about children and young people requires particular care.

5.3 Website and technical information

When someone visits our website or uses our digital services, we may automatically collect:

·         IP address

·         device type

·         browser type and version

·         operating system

·         approximate location derived from an IP address

·         language and time-zone settings

·         referring website

·         pages viewed

·         links selected

·         dates and times of access

·         session information

·         cookie identifiers

·         error logs

·         security logs and

·         information about interactions with our website or online advertising.

5.4 Payment and transaction information

We may collect information associated with payments, refunds, invoices, enrolments, subscriptions, or other transactions.

Where we use a third-party payment provider, the provider may collect and process payment-card or bank-account information directly. We may receive limited transaction information, such as payment status, transaction reference, amount, date, or the last digits of a payment card.

We do not intentionally retain complete payment-card details unless this is necessary, lawful, appropriately secured, and clearly disclosed.

5.5 Communications and customer-service information

We may keep records of telephone calls, emails, text messages, online chats, forms, survey responses, reviews, complaints, social media messages, and other communications.

Calls or online meetings will only be recorded where there is a legitimate reason, and appropriate notice is provided.

5.6 Employment and contractor information

Where someone applies for employment, teaching, grading, contractor, or other work with Best Brains, we may collect:

·         contact information

·         curriculum vitae or résumé

·         qualifications

·         employment history

·         professional registrations or certifications

·         references

·         interview notes

·         right-to-work information

·         background or safety-check information where lawful and relevant and

·         other information voluntarily included in an application.

5.7 Franchise and business enquiries

For franchise enquiries, we may collect:

·         name and contact information

·         location and territory interests

·         business background

·         professional experience

·         financial capacity information

·         ownership and partnership information

·         communications and meeting notes and

·         information reasonably required to assess or administer a franchise enquiry.

Any separate franchise application, disclosure, financial review, or contracting process may be governed by additional notices and documents.

6. How We Collect Personal Information

We generally collect personal information directly from the person concerned or, for student information, from a parent or guardian.

We may collect information when someone:

·         completes a website form

·         creates an account

·         books an appointment

·         registers for or enrolls in a program

·         contacts us by telephone, email, chat, text message, or social media

·         attends an event, assessment, class, consultation, or meeting

·         submits homework, assessments, surveys, reviews, or feedback

·         makes a payment

·         applies for employment or a franchise opportunity

·         uses our website, applications, portals, or digital learning tools or

·         Otherwise, provides information to us.

7. Information Collected from Other Sources

In some circumstances, we may collect personal information from someone other than the individual concerned. Sources may include:

·         a parent, guardian, or authorised representative

·         another family member

·         a local Best Brains franchisee or learning center

·         Best Brains corporate affiliates

·         referral partners

·         schools, teachers, or education professionals where appropriately authorised

·         booking, advertising, or lead-generation platforms

·         service providers acting on our behalf

·         referees named in an employment or franchise application

·         publicly available sources or

·         government, regulatory, legal, or law-enforcement bodies where authorised or required.

Where Information Privacy Principle 3A applies, we will take reasonable steps to ensure that the individual is informed, as soon as reasonably practicable, about:

·         the fact that the information was collected

·         why it was collected

·         its intended recipients

·         the identity and address of the collecting and holding agencies

·         any law authorising or requiring the collection and

·         the person’s rights to request access to or correction of the information.

We may not provide a separate indirect-collection notice where an exception permitted by the Privacy Act 2020 applies, including where the person has already been appropriately informed, the information is publicly available, notification would not prejudice the person’s interests, notification is not reasonably practicable, or another statutory exception applies.

8. Why We Collect and Use Personal Information

We may collect and use personal information for purposes that include:

·         responding to enquiries

·         identifying an appropriate Best Brains learning center

·         arranging placement assessments, consultations, orientations, trials, or classes

·         evaluating program suitability and student placement

·         enrolling and administering students

·         delivering educational programs and learning support

·         monitoring attendance, engagement, academic work, and progress

·         communicating with parents, guardians, students, and authorised contacts

·         managing accounts, invoices, payments, refunds, and financial records

·         providing customer service and technical support

·         maintaining the safety, security, and integrity of our systems, centers, and services

·         investigating concerns, incidents, complaints, or suspected misconduct

·         verifying identity and authority

·         operating, maintaining, testing, and improving our website, applications, curriculum, programs, and services

·         understanding website use and program demand

·         maintaining business, tax, insurance, legal, and compliance records

·         managing staff, contractors, recruitment, and training

·         considering franchise or business applications

·         protecting our legal rights and intellectual property

·         meeting legal and regulatory requirements

·         preventing fraud, misuse, cyberattacks, and other unlawful activity

·         sending service-related notices

·         sending marketing communications where lawful and

·         carrying out another purpose authorised by the individual or permitted by law.

We will not use personal information for a materially different purpose unless the new use is authorised, directly related to the original purpose, reasonably expected, or otherwise permitted by law.

9. Whether Providing Information Is Mandatory

In most cases, providing personal information to us is voluntary.

However, certain information may be required to:

·         respond to an enquiry

·         verify identity

·         book an assessment or appointment

·         determine program placement

·         create or administer an account

·         enroll a student

·         process a payment

·         respond to a health, accessibility, or safety need

·         meet legal requirements or

·         consider an employment or franchise application.

Where required information is not provided, we may be unable to offer the requested service, complete an enrolment, process a transaction, respond fully to an enquiry, or assess an application.

Where the collection is authorised or required by a particular law, we will provide information about that law where reasonably required.

10. Children and Young People

The Privacy Act 2020 applies to individuals regardless of age. Children and young people have privacy rights in relation to their own personal information.

Because Best Brains provides educational services to children, we take additional care when collecting, using, disclosing, and securing their information.

Where appropriate, we will:

·         collect information through a parent or guardian

·         explain privacy matters in language suitable for the child’s age and understanding

·         collect only information reasonably necessary for the relevant purpose

·         consider the child’s interests, maturity, and ability to understand

·         restrict access to authorised personnel

·         avoid using children’s information for unrelated advertising purposes

·         avoid publishing a child’s full name together with sensitive identifying information

·         obtain appropriate permission before using a child’s image or work for promotional purposes and

·         Consider both the child’s privacy rights and the authority of a parent, guardian, or representative when responding to information requests.

A parent or guardian does not automatically have an unrestricted right to every item of information concerning a child. We may need to consider the child’s own rights, the requester’s authority, safety considerations, confidentiality, and any lawful grounds for withholding information.

Our website is primarily directed to parents, guardians, educators, prospective employees, and prospective franchisees. Children should not independently submit personal information through general website forms without the involvement of a parent, guardian, or responsible adult unless the form or service clearly allows this.

11. Student Photographs, Videos, and Work

We may take or receive photographs, video recordings, audio recordings, testimonials, artwork, written work, or other student materials for purposes such as:

·         classroom and program administration

·         documenting participation or progress

·         communicating privately with a parent or guardian

·         staff training and quality assurance

·         center events

·         internal records or

·         Marketing and promotional activities.

Where information will be used publicly for advertising, social media, promotional publications, or similar purposes, we will obtain appropriate authorisation or provide another lawful and transparent basis for the use.

Where practical, permission for promotional use will be separate from consent required to participate in ordinary educational services.

Permission may be withdrawn for future uses by contacting us. Withdrawal will not necessarily require us to retrieve or remove material that has already been lawfully printed, published, distributed, or incorporated into completed materials, although we will consider reasonable requests.

12. Cookies and Similar Technologies

Our website may use cookies, pixels, tags, software development kits, local storage, and similar technologies.

These technologies may be used to:

·         operate essential website functions

·         remember settings and preferences

·         maintain sessions

·         prevent fraud and improve security

·         measure website traffic and performance

·         understand how visitors interact with our website

·         diagnose technical issues

·         measure the effectiveness of communications or advertising and

·         provide or measure relevant advertising where permitted.

Cookies may include:

Essential cookies

These are necessary for the website, portal, account, security, or requested service to function.

Functional cookies

These remember choices, preferences, or settings.

Analytics cookies

These help us understand website traffic, performance, and usage.

Advertising cookies

Where used, these may help us measure campaigns or provide advertisements based on website activity.

Visitors can usually control cookies using their browser settings, or any cookie-preference tool made available on our website. Blocking some cookies may affect website functionality.

Our use of cookies and tracking technologies must remain consistent with this Policy and applicable New Zealand privacy requirements. Where another country’s law also applies to a particular visitor, we may provide additional consent or preference of controls.

13. Analytics and Advertising Services

We may use analytics, search, social media, advertising, customer relationship management, or conversion-measurement providers.

These providers may process information such as:

·         IP address

·         device and browser information

·         cookie or advertising identifiers

·         website activity

·         referral source

·         campaign interaction and

·         form or conversion events.

We will configure these services in a manner reasonably designed to limit unnecessary collection and will provide disclosures or controls required by applicable law.

We do not authorise advertising providers to knowingly use identifiable student educational records for their own unrelated advertising purposes.

14. Marketing Communications

We may send information about Best Brains programs, events, promotions, center openings, educational resources, and related services where we have an appropriate basis to do so.

Commercial electronic messages with a New Zealand link will be sent in accordance with the Unsolicited Electronic Messages Act 2007. This generally means that commercial messages must:

·         be sent with express, inferred, or deemed consent

·         accurately identify the sender

·         provide valid contact information and

·         include a functioning and easy-to-use unsubscribe facility.

We will honour an electronic marketing unsubscribe request within the period required by law.

Unsubscribing from marketing will not prevent us from sending necessary administrative or service communications, including enrolment, appointment, payment, safety, account, or program notices.

We will not use electronic-address-harvesting software or knowingly use unlawfully harvested mailing lists.

15. When We May Disclose Personal Information

We may disclose personal information where reasonably necessary to:

·         a selected or local Best Brains franchisee or learning center

·         Best Brains corporate entities and affiliated companies

·         teachers, graders, program administrators, and authorised staff

·         cloud-hosting, information-technology, cybersecurity, communications, and software providers

·         customer-relationship-management and booking providers

·         payment processors, banks, and accounting providers

·         curriculum, learning-platform, and educational-technology providers

·         email, text-message, and customer-support providers

·         analytics, marketing, and advertising providers

·         professional advisers, including lawyers, accountants, insurers, and auditors

·         background-check or recruitment providers where lawful

·         contractors and service providers working on our behalf

·         a purchaser, successor, or adviser in connection with a proposed or completed business transaction

·         regulators, courts, tribunals, law-enforcement agencies, or government authorities or

·         another person authorised by the individual or permitted by law.

We require service providers to handle personal information only for authorised purposes and to apply appropriate confidentiality and security protections.

We do not sell or rent personal information as a business model. Information sharing necessary to operate our franchise network, respond to enquiries, deliver services, process transactions, or use properly configured advertising tools is not treated by us as the sale of personal information.

16. Franchisees and Shared Enquiries

Where a visitor asks about a specific center, submits a general enrolment enquiry, enters a postcode, or requests a placement assessment, we may send the enquiry to the most appropriate Best Brains learning center.

The receiving franchisee may contact the visitor directly and may become responsible for information it collects or holds for its own center operations.

Corporate and franchisee systems may exchange information for purposes such as:

·         lead management

·         enrolment administration

·         program delivery

·         billing

·         materials

·         technology support

·         curriculum administration

·         quality assurance

·         complaints

·         compliance and

·         franchise support.

Where Best Brains Corporate and a franchisee have separate responsibilities, each party is expected to comply with its own obligations under the Privacy Act 2020.

17. Service Providers Acting on Our Behalf

We may engage third-party providers to store or process personal information on our behalf.

Where a provider acts solely on our instructions and does not use the information for its own purposes, we remain responsible for the information as required by the Privacy Act 2020.

We take reasonable steps to:

·         assess the provider’s privacy and security practices

·         limit the information provided

·         contractually restrict the provider’s use and disclosure

·         require appropriate safeguards

·         require prompt reporting of security incidents

·         support access, correction, retention, and deletion requirements and

·         manage the return or secure disposal of information when services end.

18. Overseas Storage and Disclosure

Because Best Brains operates internationally and may use global technology providers, personal information may be stored, accessed, supported, or processed outside New Zealand.

Countries involved may include THE UNITED STATES, INDIA.

Where Information Privacy Principle 12 applies to an overseas disclosure, we will take reasonable steps to ensure that the overseas recipient:

·         is subject to the New Zealand Privacy Act 2020

·         is subject to privacy laws providing overall comparable safeguards

·         participates in an approved binding scheme

·         is located in a prescribed country

·         is contractually required to provide safeguards comparable to those under New Zealand law or

·         Receives the information with the individual’s express authorisation after the individual has been informed that comparable protections may not apply.

An overseas service provider that stores or processes information solely on our behalf may, depending on the arrangement, be treated as our agent rather than as a separate recipient. In that situation, we remain responsible for the information.

19. Data Security

We use reasonable administrative, technical, organisational, and physical safeguards appropriate to the nature and sensitivity of the personal information we hold.

Measures may include:

·         access controls based on business need

·         password and authentication requirements

·         multifactor authentication where appropriate

·         encryption in transit and, where appropriate, at rest

·         network and endpoint security

·         secure system configuration

·         staff confidentiality obligations

·         privacy and security training

·         supplier assessments and contractual protections

·         logging and monitoring

·         backup and recovery procedures

·         secure document storage

·         incident-response procedures and

·         Secure deletion or destruction.

No website, transmission method, or electronic storage system is completely secure. We therefore cannot guarantee absolute security, but we will take reasonable steps required by law to protect personal information against loss, unauthorised access, misuse, modification, disclosure, or other harm.

Individuals should protect their passwords and notify us promptly if they believe an account or personal information has been compromised.

20. Privacy Breaches

A privacy breach may include unauthorised or accidental access to, disclosure of, alteration of, loss of, destruction of, or inability to access personal information.

Where a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, unless an applicable exception permits otherwise.

Our response may include:

·         containing the incident

·         investigating what occurred

·         assessing the information and individuals affected

·         evaluating the likelihood of serious harm

·         notifying relevant parties

·         taking steps to reduce harm

·         restoring security

·         documenting the incident and

·         improving our systems or procedures.

21. Retention and Disposal

We retain personal information only for as long as it is reasonably required for the purpose for which it was collected or for another lawful purpose.

Retention periods may depend on:

·         whether a student remains enrolled

·         the nature of the educational or business relationship

·         the sensitivity of the information

·         safeguarding and complaint considerations

·         financial, tax, insurance, and contractual requirements

·         legal limitation periods

·         dispute or investigation requirements

·         system backup cycles and

·         applicable recordkeeping obligations.

When information is no longer reasonably required, we will take reasonable steps to securely delete, destroy, anonymise, or de-identify it.

Information may remain temporarily in backups or archives until it is overwritten or deleted in accordance with established retention processes.

22. Accuracy and Updating Information

We take reasonable steps before using or disclosing personal information to ensure that it is accurate, complete, relevant, up to date, and not misleading.

Individuals should inform us when their contact, account, student, emergency, or other relevant information changes.

We may ask for documentation or verification before making a significant change.

23. Access to Personal Information

Individuals have the right to ask whether we hold personal information about them and to request access to that information.

A request should be sent to our Privacy Officer and should include enough detail for us to identify the requester and locate the relevant information.

We may:

·         request proof of identity

·         verify the authority of a parent, guardian, representative, or agent

·         ask for clarification

·         transfer the request where another agency is responsible

·         provide the information in an appropriate form or

·         Withhold information where a ground in the Privacy Act 2020 permits or requires us to do so.

We will respond to an access request as soon as reasonably practicable and ordinarily no later than 20 working days after receiving it, subject to any lawful extension.

Access is generally provided without charge, although a reasonable charge may be permitted in limited circumstances.

24. Correction of Personal Information

An individual may ask us to correct personal information they believe is inaccurate, incomplete, out of date, or misleading.

If we make the requested correction and the information has previously been disclosed to another person or organisation, we will take reasonable steps to inform that recipient where required.

If we do not make the requested correction, the individual may ask us to attach a statement of the requested correction to the information so that it is read together with the disputed information.

We will respond within the timeframe required by the Privacy Act 2020.

25. Requests Concerning Children

A child or young person may exercise their own access and correction rights.

A parent, guardian, or representative may assist the child or make a request where they have appropriate authority. Before disclosing information, we may consider:

·         the child’s age and maturity

·         the child’s wishes

·         the relationship between the requester and the child

·         guardianship or care arrangements

·         the purpose of the request

·         whether disclosure could affect the child’s safety, privacy, or wellbeing

·         information relating to other people and

·         any applicable ground for refusing or limiting access.

We may request evidence of identity, guardianship, authority, or consent.

26. Complaints

A person who believes we have not handled their personal information appropriately should contact our Privacy Officer first.

Please provide:

·         the person’s name and contact information

·         a description of the concern

·         relevant dates

·         copies of relevant communications and

·         The outcome being requested.

We will acknowledge and investigate the complaint fairly and within a reasonable period.

If the matter is not resolved, the person may complain to the Office of the Privacy Commissioner of New Zealand.

27. Automated Tools and Artificial Intelligence

We may use software, analytics, or artificial-intelligence-assisted tools to support limited activities such as:

·         website administration

·         customer-service assistance

·         appointment scheduling

·         communication drafting

·         fraud or security detection

·         data analysis

·         program administration or

·         educational support.

We will not knowingly submit identifiable or sensitive student information to a public generative AI service unless the use has been appropriately assessed, authorised, secured, and disclosed.

Where an automated tool could materially affect an individual, we will apply appropriate human oversight and will use the information consistently with this Policy and applicable law.

28. Third-Party Links and Platforms

Our website may link to social media services, maps, videos, payment platforms, booking tools, job sites, franchise portals, or other third-party services.

Those services may independently collect personal information and apply their own privacy policies. We are not responsible for the privacy, content, security, or practices of a third-party service that is not acting on our behalf.

Visitors should review the applicable third party’s privacy information before providing personal information.

29. Social Media

Information posted publicly on a Best Brains social media page may be visible to other users and governed by the social media platform’s terms and privacy practices.

We may collect or retain messages, comments, reviews, or other interactions where reasonably required to respond, provide support, moderate content, protect safety, or maintain business records.

Individuals should not publicly post sensitive information about themselves or a child.

30. Do Not Track and Browser Controls

Some browsers or devices provide “Do Not Track,” privacy, or advertising controls.

Our response to these signals may depend on the technology used by our website and service providers. Where technically supported and reasonably practicable, we will respect recognised privacy preferences.

Visitors may also use browser settings, advertising settings, or website preference tools to manage certain tracking technologies.

31. New Zealand Regional Application

New Zealand does not have separate state or provincial general privacy laws equivalent to the state privacy regimes found in some other countries.

Accordingly, this Policy and the Privacy Act 2020 framework apply across New Zealand, including all regions, cities, districts, and territorial-authority areas.

No separate Auckland, Wellington, Canterbury, Waikato, Bay of Plenty, Otago, or other regional privacy addendum is currently required for general website and business personal information handling.

However, additional requirements may arise from:

·         a particular contract

·         a school or government partnership

·         employment obligations

·         local-authority requirements unrelated to general privacy law

·         sector-specific legislation

·         a specific type of information or activity or

·         The laws of another country apply to a particular individual or transaction.

Where another applicable law provides greater protection or imposes an additional obligation, we will seek to comply with that requirement.

32. International Visitors

The website is intended primarily for New Zealand users.

People accessing the website from another country should understand that their information may be processed in New Zealand and in the other countries described in this Policy.

Where the privacy law of another country applies to our activities, we may provide a separate regional notice, consent mechanism, or rights process.

33. Changes to This Privacy Policy

We may update this Policy to reflect changes in:

·         privacy law

·         regulatory guidance

·         our services

·         our franchise network

·         our technology

·         our service providers or

·         Our information handling practices.

The updated Policy will be posted with a revised, effective or last-updated date.

Where a change materially affects how we use information already collected, we will provide additional notice or obtain authorisation where required.

34. Contact Us

Questions, access requests, correction requests, complaints, and privacy concerns should be directed to:

Best Brains of New Zealand Ltd
Email: info@bestbrains.com

Please write “Privacy Request” in the email subject line where possible.