Privacy Policy

1. Controller

The controller within the meaning of the GDPR and the "agency" within the meaning of the New Zealand Privacy Act 2020 is:
HeptaMS Limited, 82 The Circle, Manly, Whangaparaoa, 0930 New Zealand.
Email: info@heptams.org

2. Applicable data protection law

The controller is based in New Zealand; the offering targets an international audience. As a general rule, the New Zealand Privacy Act 2020 applies, with its 13 Information Privacy Principles (IPPs). For visitors from the EU/EEA, the GDPR applies additionally (Art. 3(2) GDPR). Where protection levels differ, the stricter GDPR standard is applied to EU/EEA data subjects.

3. Hosting and technical service provider (OCENOX)

Hosting, platform and data processing are handled technically by our premium partner OCENOX LTD (82 The Circle, Manly, Whangaparaoa, 0930 New Zealand), acting as a processor under a data processing agreement (Art. 28 GDPR). The servers are located at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Finland (EU); hosting therefore takes place within the EEA.

4. Server log files

When the website is accessed, technically necessary data is automatically processed in server log files (IP address, date/time, requested resource, volume of data, referrer URL, user agent). The legal basis is the legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR; for NZ: IPP 1/3). Logs are deleted or anonymised after a short period.

5. Book waitlist

When you join the waitlist, we process your email address, optionally your name, and technical metadata. Purpose: to notify you once, by email, as soon as the book Hepta Management System is available. Legal basis: your consent (Art. 6(1)(a) GDPR). Your data is deleted once the purpose is fulfilled or you withdraw consent.

6. Email notifications (optional)

Using a separate checkbox, you may consent to receiving system notifications from us by email – for example about new trainings, events, newsfeed posts and replies. These emails are sent by HeptaMS Limited itself. We use the double opt-in procedure: after you enable notifications, we send a confirmation email with a confirmation link; we only send email notifications once you click this link. To evidence your consent, we log the time and IP address of the activation and of the confirmation. Legal bases: for New Zealand, the Unsolicited Electronic Messages Act 2007 (consent, sender identification, unsubscribe facility); for users in the EEA, additionally your consent (Art. 6(1)(a) GDPR). You control which notifications you receive at any time in your notification center; you can unsubscribe at any time via the unsubscribe link in every email or by contacting info@heptams.org.

7. International data transfers

As the controller and the technical partner OCENOX LTD are based in New Zealand, processing may take place in New Zealand. For New Zealand, an adequacy decision of the European Commission exists (2013/65/EU); a transfer is therefore permitted under Art. 45 GDPR. For visitors outside the EU, disclosure outside New Zealand is governed by IPP 12 of the NZ Privacy Act 2020.

8. Fonts, CDN and external content

This page loads fonts (Google Fonts) and frontend libraries (Bootstrap via the jsDelivr CDN) from external servers. Your IP address is transmitted to the respective provider. The legal basis is the legitimate interest in a performant presentation (Art. 6(1)(f) GDPR).

9. AI chat (ONOXIA)

heptams.org embeds ONOXIA, an AI-powered chat assistant by OCENOX LTD. The replies are generated by an AI system; you are not writing with a human being. The information given may be incomplete or inaccurate; the details on the offer pages, in the order process and in our Terms and Conditions prevail.

When the chat becomes active. ONOXIA only becomes active when you start the chat yourself. Nothing is transmitted to the chat service before your first message. By using the chat, you consent to the processing of your inputs.

What we transmit. Your messages in the chat window, a session identifier to associate the conversation, the language setting and the path of the page accessed. In the logged-in member area additionally your name and your membership status, so that the replies match. We do not transmit your email address or any account, payment or invoicing data. The purpose is to answer questions about the book, membership, courses and community; the legal basis is our legitimate interest in providing immediate information about our offering (Art. 6(1)(f) GDPR; for New Zealand IPP 1 and 3).

What ONOXIA does with it – storage, retention, recipients – is set out in the privacy policy of OCENOX LTD: onoxia.nz/en/datenschutz.

Chat in the training room. Course days take place in a video room that includes a chat. What is written there is stored with the course day in question and made available for reading to the participants of that course day, the trainer and the administration; it is deleted after one year. The purpose is running the course – questions should not be lost when the room closes (Art. 6(1)(b) GDPR; for New Zealand IPP 1 and 3).

Before the course day begins, ONOXIA answers questions about sound, picture and connection in the room and marks mentioned cities on a world map. For this we transmit the chat message concerned to OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which operates a language model on servers in the European Union as our processor. Only the text of the message is transmitted – no name, no email address, no identifier. This ends when the course day starts; nothing is transmitted from then on.

The chat sets no cookies. Using it is voluntary; without it all content remains available unchanged, and enquiries still reach us at info@heptams.org. Please do not enter sensitive data (such as passwords, health or financial data) or data about third parties in the chat. You may object to the processing of your chat data at any time (Art. 21(1) GDPR); your further rights are set out in sections 11 to 13.

10. Cookies

This website generally uses only technically necessary cookies or a session mechanism (including form abuse protection). No tracking or profiling for advertising purposes takes place.

11. Your rights under the GDPR (EU/EEA)

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object (Art. 21), and to withdraw consent (Art. 7(3)).

12. Your rights under the New Zealand Privacy Act 2020

Visitors outside the EU have, in particular, the right of access (IPP 6) and correction (IPP 7). Requests to info@heptams.org.

13. Right to complain

EU/EEA: complaint to a data protection supervisory authority (Art. 77 GDPR). New Zealand: Office of the Privacy Commissioner (privacy.org.nz).

Last updated: 11 June 2026. Further processing (user accounts, payments, member area) will be added once the corresponding features go live.