How we handle personal information under the Privacy Act 2020.
Version 2026-08-15 · Effective 15 August 2026
LorryLink operates a marketplace that connects businesses needing goods moved (hirers) with truck operators (operators), their drivers, and suppliers to the industry (vendors). In this policy "we", "us" and "LorryLink" mean the operator of that marketplace. We are the agency responsible for the personal information described here.
We are not a carrier. We do not move goods, we are not a party to the transport contract between a hirer and an operator, and we do not process payment for transport work. Our role is to introduce the parties and to hold the records that support that introduction.
Operators are separate agencies in their own right. When an operator invites a driver onto LorryLink, assigns them work, or views their location during a job, the operator is handling that driver's personal information as an employer or principal. That handling is governed by the operator's own obligations under the Privacy Act, not by this policy. This policy covers what we do with the information. Drivers with questions about how their own operator uses their information should raise them with that operator, and may also contact us.
As required by section 201 of the Privacy Act 2020, we have appointed a privacy officer responsible for compliance with the Act, for dealing with requests for access and correction, and for working with the Office of the Privacy Commissioner.
You can reach our privacy officer at support@lorrylink.co.nz. Everything in this policy that asks you to contact us goes to that address.
We collect only what we need to run the platform. What we collect depends on your role.
If you enter someone else's contact details — a site foreman, a receiving depot, a customer of yours — you are giving us their personal information. You must have a proper basis for doing so, and you should tell them their details are being passed to the operator who will attend the site.
Wherever we reasonably can, we collect personal information directly from the person it is about. There are three situations where we do not:
We do not buy personal information, and we do not scrape it from other sources.
We collect personal information for these purposes and no others:
If we ever want to use your information for a materially different purpose, we will tell you and, where the Act requires it, seek your authorisation first.
Location data is the most sensitive information we handle, and we have deliberately constrained it.
Drivers should be aware that an operator can see their location during a job. If you are a driver and this has not been explained to you by your operator, tell us and we will raise it with them.
Drivers capture photographs and a receiver's signature at delivery. These are shared with the operator and the hirer for that job, and form the record that the goods arrived.
Operators enter certification and insurance details — Certificate of Fitness, Road User Charges, Transport Service Licence, driver licence classes, insurance cover and expiry dates. We store these, track the dates, and warn before they lapse.
This information is self-reported. We do not verify it against NZ Transport Agency records or with insurers, and we do not warrant that any operator's certification is current. Expiry status is visible to hirers considering that operator for a job, because it is directly relevant to whether the work can lawfully be performed.
Hailey is an AI assistant that answers questions about your own fleet, jobs and compliance dates. When you ask Hailey something, the relevant data from your account is sent to Google's Gemini service to generate an answer.
Please do not paste information into Hailey that is not needed to answer your question — particularly anything about a person that is not already in your account.
Operator subscriptions and vendor listing fees are processed by Stripe. Card details are entered directly with Stripe and are never stored on our systems. We retain a record of what was charged, when, whether it succeeded, and the last four digits and card type so you can recognise your own payment method.
Payment for transport work does not pass through LorryLink. What a hirer pays an operator is arranged directly between them. We hold no record of it beyond any figure a party chooses to enter as a quote, and we take no commission on any job.
If anyone asks you to send money through LorryLink, or claims we hold funds in escrow for a job, that is a scam. Report it to us immediately.
LorryLink is a marketplace, so some information is deliberately visible to other users. This is what is shared, and with whom:
| Information | Visible to |
|---|---|
| Operator business name, regions, vehicle types, compliance expiry status | Hirers browsing or receiving quotes |
| Job details you post as a hirer | Operators eligible to quote on it |
| Your quote and price | The hirer who posted that job |
| Site contact name and phone | The operator and driver assigned to that job |
| Driver name and phone | Their own operator, and the hirer for jobs they are assigned |
| Live vehicle location during a job | That job's operator and hirer only |
| Proof of delivery | That job's operator and hirer only |
| Vendor listing content | All signed-in users |
Your email address is not shown to other users. Your cost figures, margins and internal notes are never visible to anyone outside your own account.
We disclose personal information to the following service providers, only to the extent needed to run the platform, and under contracts that require them to protect it:
| Provider | What it does |
|---|---|
| Google (Firebase & Google Cloud) | Hosting, database, file storage, authentication, push notifications |
| Google Maps Platform | Addresses, routing and distance calculations |
| Google (Gemini) | Powers the Hailey assistant |
| Stripe | Subscription and listing fee payments |
| Twilio | SMS notifications |
| Resend | Transactional email |
| Xero | Our own accounting records |
We may also disclose information:
We do not sell personal information. We do not share it with advertisers. We do not use it to build advertising profiles.
If we add or change a service provider that handles personal information, we will update the table above and note the change in the version history.
LorryLink runs on Google Cloud infrastructure, and your information is stored and processed outside New Zealand:
| What | Where |
|---|---|
| Main database — accounts, jobs, quotes, compliance records | United States |
| Live tracking data | Singapore |
| File storage — proof-of-delivery photographs, uploads | Australia |
| Server processing | Australia and the United States |
| Payment processing | United States and Ireland |
| Email and SMS delivery | United States |
Information privacy principle 12 requires us to satisfy ourselves that an overseas recipient will protect your information to a standard comparable to the Privacy Act. We rely on the contractual data protection terms in our agreements with these providers, which impose obligations covering security, confidentiality, restrictions on use, breach notification, and deletion on termination.
You should be aware that once information is held overseas it may be accessible to authorities in that country under their own laws, and that privacy laws there differ from New Zealand's. By using LorryLink you acknowledge this.
We send two kinds of message, and they are treated differently.
We comply with the Unsolicited Electronic Messages Act 2007. We do not sell or rent your contact details to anyone for their marketing.
We use a small number of browser storage technologies:
We do not use advertising cookies, cross-site tracking pixels, or third-party marketing trackers. You can block or clear cookies in your browser, but you will not be able to stay signed in if you block the essential ones.
We keep personal information only as long as we need it for the purposes above, or as long as the law requires. Our approach is to deactivate rather than delete business records, because they may be needed for tax, dispute resolution or regulatory purposes.
| Information | Retention |
|---|---|
| Account and profile records | While active, then deactivated and retained for 7 years |
| Job, quote and proof-of-delivery records | 7 years from job completion |
| Billing and tax records | 7 years, as required by the Tax Administration Act 1994 |
| Compliance and certification records | 7 years from expiry |
| Live location feed | Not retained after the job ends |
| Hailey conversations | Deleted automatically within 90 days |
| Diagnostic and error logs | Up to 12 months |
| Marketing contact records | Until you unsubscribe, plus a suppression record so we do not contact you again |
If you want your information removed entirely, contact us. We will tell you specifically what can be deleted, what we are required to keep, and why.
We take reasonable safeguards against loss, unauthorised access, use, modification and disclosure. In practice that means:
Your part matters too: use a strong unique password, turn on two-factor authentication where offered, do not share logins between staff, and tell us immediately if you think an account has been compromised.
No system is perfectly secure, and we do not claim otherwise.
If we suffer a privacy breach that we believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as Part 6 of the Privacy Act 2020 requires.
Our notification will describe what happened, what information was involved, what we are doing about it, and what steps you can take to protect yourself. We maintain an internal register of breaches and near-misses whether or not they meet the notification threshold.
Under principles 6 and 7 of the Privacy Act 2020 you may ask us for the personal information we hold about you, and ask us to correct it if it is wrong.
If you think we have mishandled your personal information, contact our privacy officer first at support@lorrylink.co.nz. We will acknowledge your complaint promptly, investigate it, and tell you the outcome and our reasons.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:
privacy.org.nz
0800 803 909
PO Box 10094, Wellington 6143
You do not have to come to us first, but it is usually the quickest way to get the problem fixed.
We assign internal identifiers to accounts, jobs, vehicles and quotes so our systems can reference them reliably. These are our own identifiers and are not used for any purpose beyond operating the platform.
We do not collect or use government-issued unique identifiers — IRD numbers, NHI numbers, driver licence card numbers — as identifiers within LorryLink. Where we record a licence class or a Transport Service Licence, it is recorded as a compliance attribute, not used to identify you across systems.
We do not make decisions about people by automated means that produce legal effects or similarly significant effects. Specifically:
Where we suspend an account for suspected fraud or lapsed certification, a person makes that decision and you can ask us to review it.
LorryLink is a business platform intended for people aged 18 and over acting in a business capacity. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has an account, tell us.
LorryLink contains links to other websites, including vendor listings and external resources. We are not responsible for their privacy practices. Read their policies before giving them your information.
We may update this policy as the platform changes. The version number and effective date at the top of this page always show the current version.
For material changes — a new category of information, a new purpose, a new disclosure, a new country of storage — we will notify account holders at least 14 days before the change takes effect. We keep previous versions and will provide one on request.
For anything about this policy, your information, or a privacy concern:
Privacy Officer, LorryLink
Email: support@lorrylink.co.nz
You can also reach us through our contact page. Our terms of use govern the rest of your relationship with LorryLink.