Privacy Policy

1. Controller

The controller within the meaning of the GDPR and the "agency" within the meaning of the New Zealand Privacy Act 2020 is:
HeptaMS Limited, 82 The Circle, Manly, Whangaparaoa, 0930 New Zealand.
Email: kontakt@heptams.org

2. Applicable data protection law

The controller is based in New Zealand; the offering targets an international audience. As a general rule, the New Zealand Privacy Act 2020 applies, with its 13 Information Privacy Principles (IPPs). For visitors from the EU/EEA, the GDPR applies additionally (Art. 3(2) GDPR). Where protection levels differ, the stricter GDPR standard is applied to EU/EEA data subjects.

3. Hosting and technical service provider (OCENOX)

Hosting, platform and data processing are handled technically by our premium partner OCENOX LTD (82 The Circle, Manly, Whangaparaoa, 0930 New Zealand), acting as a processor under a data processing agreement (Art. 28 GDPR). The servers are located at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Finland (EU); hosting therefore takes place within the EEA.

4. Server log files

When the website is accessed, technically necessary data is automatically processed in server log files (IP address, date/time, requested resource, volume of data, referrer URL, user agent). The legal basis is the legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR; for NZ: IPP 1/3). Logs are deleted or anonymised after a short period.

5. Book waitlist

When you join the waitlist, we process your email address, optionally your name, and technical metadata. Purpose: to notify you once, by email, as soon as the book Hepta Management System is available. Legal basis: your consent (Art. 6(1)(a) GDPR). Your data is deleted once the purpose is fulfilled or you withdraw consent.

6. Email notifications (optional)

Using a separate checkbox, you may consent to receiving system notifications from us by email — for example about new trainings, events, newsfeed posts and replies. These emails are sent by HeptaMS Limited itself. We use the double opt-in procedure: after you enable notifications, we send a confirmation email with a confirmation link; we only send email notifications once you click this link. To evidence your consent, we log the time and IP address of the activation and of the confirmation. Legal bases: for New Zealand, the Unsolicited Electronic Messages Act 2007 (consent, sender identification, unsubscribe facility); for users in the EEA, additionally your consent (Art. 6(1)(a) GDPR). You control which notifications you receive at any time in your notification center; you can unsubscribe at any time via the unsubscribe link in every email or by contacting kontakt@heptams.org.

7. International data transfers

As the controller and the technical partner OCENOX LTD are based in New Zealand, processing may take place in New Zealand. For New Zealand, an adequacy decision of the European Commission exists (2013/65/EU); a transfer is therefore permitted under Art. 45 GDPR. For visitors outside the EU, disclosure outside New Zealand is governed by IPP 12 of the NZ Privacy Act 2020.

8. Fonts, CDN and external content

This page loads fonts (Google Fonts) and frontend libraries (Bootstrap via the jsDelivr CDN) from external servers. Your IP address is transmitted to the respective provider. The legal basis is the legitimate interest in a performant presentation (Art. 6(1)(f) GDPR).

9. Cookies

This website generally uses only technically necessary cookies or a session mechanism (including form abuse protection). No tracking or profiling for advertising purposes takes place.

10. Your rights under the GDPR (EU/EEA)

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object (Art. 21), and to withdraw consent (Art. 7(3)).

11. Your rights under the New Zealand Privacy Act 2020

Visitors outside the EU have, in particular, the right of access (IPP 6) and correction (IPP 7). Requests to kontakt@heptams.org.

12. Right to complain

EU/EEA: complaint to a data protection supervisory authority (Art. 77 GDPR). New Zealand: Office of the Privacy Commissioner (privacy.org.nz).

Last updated: 11 June 2026. Further processing (user accounts, payments, member area) will be added once the corresponding features go live.