RIVER Privacy Policy

1. Introduction

RIVER Group Ltd (t/a RIVER) (“we”, “us”, “our”) is committed to protecting the privacy of individuals whose personal information we collect. This Privacy Policy explains how we collect, use, store, and disclose personal information in accordance with the New Zealand Privacy Act 2020 and, where applicable, the Australian Privacy Principles (APPs).

This policy applies to personal information collected through our website (rivergroup.ai), our services, and our business interactions. For information about how we handle data during client engagements, please also refer to our Terms of Engagement and Security & Governance pages.

2. Information We Collect

Website visitors

When you visit our website, we may collect:

• Usage data: pages visited, time spent, referral source, browser type, device type, and approximate location (country or region level).
• Cookies and similar technologies: functional cookies for site preferences, and analytics cookies where you have consented (see section 8).

The AI assistant (Moana)

When you talk to the AI assistant on our website, we keep the conversation: the messages you send, the replies you receive, and when they happened. This includes conversations held without signing in, which we keep against a random identifier stored in your browser rather than against your name.

We keep them so you can pick a conversation back up, and so we can see how the assistant is actually used and improve it. They are not used to train public AI models (see section 4).

Free tools on our website

The AI Readiness Check, the engagement builder and similar tools keep what you produce with them - your answers, the read they generate, and the brief you assemble - on the same basis as above. If you give us your name and email to receive a result, we hold those with it.

Site accounts

You can create an account on our website. Nothing on the site requires one: an account exists so the conversations, checks, briefs and messages you have already made stay yours across devices. When you sign in, what you made in that browser before signing in is linked to your account.

For an account we hold your email address, your name if you give one, and, where you sign in with a password rather than a third-party provider, a one-way hash of that password. We never store your password itself.

Contact and enquiry forms

When you contact us or submit a form, we collect:

• Contact details: name, email address, phone number, company name.
• Enquiry information: your message, service interest, and any other information you choose to provide.

We keep a copy of what you send, so that you can see it again on your account and so our team has a record of it.

Client engagements

During client engagements, we may process additional personal information as required to deliver the agreed services. This is governed by the terms of the specific engagement (Proposal/SOW) and our Terms of Engagement.

Business contacts

We collect professional contact details of individuals we interact with in a business context (e.g., name, job title, email, phone) for relationship management and communication purposes.

3. How We Use Your Information

We use personal information for the following purposes:

• Responding to enquiries: to reply to your contact form submissions and questions.
• Service delivery: to deliver the professional services agreed in client engagements.
• Website improvement: to understand how our website is used and improve the experience.
• Business communication: to send relevant updates about our services (you can opt out at any time).
• Legal compliance: to comply with applicable laws and regulations.

We do not sell personal information. We do not use personal information for purposes unrelated to those described above without your consent.

4. AI-Specific Data Handling

As an enterprise AI partner, we take additional care with data that flows through AI systems:

• No training on your data: we do not use client data or personal information to train public AI models. Where third-party AI services are used, we use configurations designed to prevent provider training on client data.
• Purpose limitation: data processed through AI systems is used only to deliver the agreed services and for no other purpose.
• Human oversight: AI outputs that affect individuals are subject to appropriate human review. We do not make automated decisions that have legal or significant effects on individuals without human oversight.
• Transparency: when AI processes personal information as part of a client engagement, this is disclosed and governed by the engagement terms.

For more detail on AI governance controls, see our Security & Governance page.

5. Who We Share Information With

We may share personal information with the following parties, only to the extent necessary for the purposes described above:

• Service providers: trusted third parties who help us operate our website and business (e.g., hosting, analytics, email services). These providers are bound by confidentiality obligations.
• AI service providers: where third-party AI services are used to deliver client engagements, as agreed in the Proposal/SOW. We use configurations designed to prevent training on client data.
• Professional advisors: legal, accounting, or insurance advisors as needed.
• Legal requirements: where required by law, court order, or regulatory authority.

We do not sell, rent, or trade personal information to third parties for marketing purposes.

6. Data Security

We take reasonable steps to protect personal information from unauthorised access, modification, disclosure, or destruction. Our security measures include:

• Your data is encrypted in transit and at rest;
• Role-based access controls with least-privilege principles;
• Regular review of access permissions;
• Secure credential and secret management;
• Incident response procedures for confirmed security incidents.

For more detail, see our Security & Governance page.

7. Your Rights Under the NZ Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right to:

• Access: request access to personal information we hold about you (Information Privacy Principle 6).
• Correction: request correction of personal information that is inaccurate, incomplete, or misleading (Information Privacy Principle 7).
• Know the purpose: be told why your personal information is being collected and how it will be used (Information Privacy Principle 3).
• Complain: make a complaint to the Office of the Privacy Commissioner if you believe your privacy has been interfered with.

To exercise any of these rights, please contact us using the details in section 12 below. We will respond to access and correction requests within 20 working days, as required by the Privacy Act 2020.

Australian residents: if you are located in Australia, you may also have rights under the Australian Privacy Principles (APPs). Please contact us to discuss your specific requirements.

8. Cookies and Tracking

Our website uses the following types of cookies:

• Essential cookies: required for the website to function (e.g., session management, security). These cannot be disabled.
• Analytics cookies: help us understand how visitors use our website. We use privacy-friendly analytics that do not track individuals across websites.
• Preference cookies: remember your settings (e.g., theme preference).
• Visitor cookie: a random identifier, readable only by our server and never by scripts in your browser, which is what lets the work you do on this site without signing in stay yours. It carries no personal information and identifies nobody on its own.

We do not use advertising or remarketing cookies. We do not build advertising profiles based on your browsing activity.

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy:

• Contact enquiries: retained for up to 24 months after your last interaction, then securely deleted.
• Website AI conversations and free-tool results: retained for up to 24 months after they were last used, then securely deleted. You may ask us to delete yours sooner (section 7).
• Account information: retained while your account exists. Ask us to close it and we delete it, together with what it holds.
• Client engagement data: retained for the duration of the engagement plus any period required by law or contractual obligation.
• Analytics data: aggregated and anonymised. Individual session data is not retained long-term.
• Business contacts: retained while we have an active business relationship or until you ask us to remove your details.

10. International Data Transfers

Our primary operations are in New Zealand. Some of our service providers may store or process data in other jurisdictions (e.g., Australia, the United States). Where personal information is transferred internationally, we take reasonable steps to ensure it is protected to a comparable standard, including:

• selecting providers with appropriate privacy and security practices;
• using contractual protections where appropriate;
• offering sovereign/local hosting options for client engagements where required.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be noted with an updated “Last updated” date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how your personal information has been handled, please contact us:

• Email: hello@rivergroup.ai

You may also contact the Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Phone: 0800 803 909