Privacy Policy

Last updated 3 March 2026

Shine Lawyers NZ Limited (referred to in this policy as we, us or our) is bound by the Privacy Act 2020 (the Act) and the information privacy principles (IPPs) set out in the Act, as amended from time to time. 

In this Policy, “you” and “your” means the individual providing personal information to us or whose personal information has been collected by us; and “personal information” has the meaning given to it in the Act. Essentially, it is information relating to an individual or which can be used to identify that individual.

This Policy covers the basis on which we collect, store, use and disclose your personal information in order to provide legal services to you during the course of our professional relationship.

Application of this Policy

This Policy applies to your use of our website www.shinelawyers.co.nz, when you visit or interact with us on any social media platforms (such as Facebook, Instagram, TikTok, Twitter (X), Snapchat or YouTube) owned by, affiliated with or administered by us (Social Media Platforms) and also where we tell you or you are otherwise made aware that this Policy applies. By accessing our websites or Social Media Platforms or obtaining our services you agree to the terms of this Policy.

Your privacy

We are committed to protecting your privacy with your rights and needs in mind.

We take your privacy very seriously, not just because of the Act but because of the nature of our work and the relationship of trust between us and you.

The IPPs govern the way in which we must manage your personal information and this policy sets out how we collect, use, disclose and otherwise manage personal information about you.

Giving consent

You are not obliged to disclose personal information about yourself or your contact details when you visit our website.

By voluntarily providing us with any personal information or data (including when you register with us to indicate your interest in participating in any class action or other legal proceeding we may conduct, or propose to conduct), you consent to us collecting and using this information and data to assist you with your enquiry and to offer and/or provide any of our services that may be relevant to you. You also agree to provide such additional personal information or data as we may reasonably request to enable us to do so.

Who do we collect personal information about?

The personal information that we collect and hold about you, depends on the nature of your interaction with us.  The type of information we may collect and hold includes (but is not limited to) personal information about:

1. our clients and potential clients and their legal matters;
2. third party individuals and individuals at third party organisations that we engage with in connection with a client, the legal services we provide, or our business;
3. prospective employees; and
4. users of our website.

If you provide us with personal information relating to someone else you warrant that you are authorised to do so.  

Indirect collection of personal information

In some circumstances, we may collect personal information about you from a person or organisation other than you. This may include, for example, information obtained from medical providers, insurers, litigation funders, experts, courts, tribunals, regulators, other lawyers, or third parties involved in your claim or legal matter.

Where we collect your personal information from a source other than you, we will take reasonable steps to ensure that you are made aware of the collection, unless an exception under the Privacy Act 2020 applies. This includes informing you of:

1. the fact that your personal information has been collected;
2. the purpose for which the information has been collected;
3. the intended recipients of the information;
4. the name and contact details of the agency collecting and holding the information;
5. whether the collection is authorised or required by law, and the relevant law if applicable; and
6. your rights to access and request correction of your personal information.

We may not be required to notify you in circumstances permitted by the Privacy Act 2020, including where notification would prejudice the maintenance of the law, legal proceedings, or our ability to provide legal services, or where notification would otherwise be unreasonable or impracticable

What types of personal information do we collect?

In general, the type of personal information we collect and hold includes (but is not limited to): 

1. names, addresses, contact details, occupations, organisation details, and other information which assist us in conducting our business, providing and marketing our services and meeting our legal obligations;
2. personal information contained in the content of your communications with us or provided to us in the course of a meeting;
3. bank account details where you provide them to us so we can pay money we hold to you or if you pay your bill by direct credit; and
4. a range of other information where required as part of the services we are providing – this may include identity information (e.g. driver’s licence and passport details), medical information (e.g. information on claim-related injuries), and financial information (e.g. bank account statements).

For some transactions, we are required by the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and associated regulations (AML/CFT) and the procedures for electronic registration of land transactions to take a copy of documents verifying your identity, including in the case of an organisation, as to its ownership and control. If these documents are not provided we will not be able to undertake the transaction for you.  In addition, if information we require to meet our obligations under the AML/CFT regime is not provided we will not be able to act for you or your organisation.

If you are applying for employment with us, then we collect information concerning your previous employment, your qualifications and other information to enable us to assess your suitability for the position for which you have applied.

In most cases, if personal information that we request is not provided, or it is incorrect, we may not be able to provide our services, respond to an enquiry, engage with you, or contact you.

How do we collect personal information?

We generally collect personal information directly from you. However, we have set out below the ways in which we may typically collect your personal information:

1. You provide us with your contact details when we open a file in relation to your matter, when registering to join a class action or other proceeding we propose to conduct or are conducting, and when providing us with your identification and relevant information in order for us to comply with our AML/CFT requirements.
2. When you use our website including the use of website query forms, subscription applications and event registrations, face-to-face meetings, interviews, business cards, telephone conversations, email communications, and when you interact with the marketing communications we send you or with our social media platforms.
3. From third parties:  In some instances, we may collect personal information about you from third parties where you authorise us to do so, or where the collection is otherwise permitted by the Privacy Act 2020. This may include receiving medical reports, expert reports, evidence, claim‑related information or other material relevant to your legal matter. Where personal information is collected from a third party rather than directly from you, we will comply with our notification obligations under the Privacy Act 2020, including Information Privacy Principle 3A, unless an exception applies. Notification may occur through direct communication with you, through information provided at the commencement of your engagement with us, or through other reasonable steps appropriate to the circumstances.

How do we use personal information?

If you provide us with personal information about yourself or others, or if others give us your personal information, we will only use that personal information for the specific reason for which it was provided to us, or as otherwise permitted by the Act. This includes for:

1. Providing legal services to you, or to someone who you are authorised to act for, i.e. where the personal information relates to a minor;
2. Assisting you with obtaining third-party litigation funding or insurance cover in relation to your proposed claim;
3. Providing you with information about services provided by our Service Partners as defined below (including the Shine Group of companies in Australia) and other services that we, our related entities and other organisations that we have affiliations with, offer that may be of interest to you;
4. Facilitating our internal business operations, including the fulfilment of any legal requirements; and
5. Analysing our services and customer needs with a view to developing new or improved services.

For the avoidance of doubt, disclosure of any client information is subject to our obligations under the Lawyers and Conveyancers Act 2006 and the Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008.

Pre-client

We may collect personal information about you during the pre-client stage (that is, before you sign a Legal Services Agreement with us) to determine if we are able to assist you with your legal matter. We may hold on to this information to ensure any future communications with you are relevant.

We may monitor and record telephone calls for training and security purposes. We will get your permission first.

Client

When you become a client of Shine Lawyers NZ Ltd, we will collect and hold all personal and case-related information necessary to process your legal matter. We are required by law to keep this information for seven years once your case is closed.

Website

We collect website and Social Media Platform activity statistics, such as the number of visitors, pages visited, time and date of each visit and where each visitor accessed our website or our Social Media Platforms from, so that we can make informed decisions relating to improving our website and Social Media Platforms and the services we deliver. This information is anonymous and doesn’t identify any particular visitor.

When you visit our website or our Social Media Platforms a cookie is placed on your computer which is later used to display advertising on other websites you may visit. The cookie does not contain personal information that can identify you, but may contain information about the page you visited on our website. If you do not wish for this to occur, you can remove cookies from your computer, by following the standard procedures for your internet browser to do so.

Marketing Communications

With your permission, we may send you information such as newsletters and promotional materials about us and our services where you have signed up to receive such communications. You may withdraw your consent at any time by contacting us on [email protected].

We may use third parties to assist us to send you our newsletters and other marketing communications.  We provide those third parties with your name and relevant contact information.

The relevant third-party (where applicable) will collect information about your interaction with the communication. The information collected includes whether you opened the email, the links you clicked on, the webpages viewed and the dates and times of such access and activity.  Information about the device used to access the marketing communication may also be collected.  The third-party provides or makes available this information to us for the various purposes outlined in this Policy. They may also hold this information on our behalf.

While these third parties are primarily collecting this information on our behalf, some of these third parties also use the information that we provide them and which is collected from your interaction with our marketing communications for their legitimate business interests, such as to provide, support and improve the services they provide and to undertake data analytics projects.  However, we do not permit them to use your personal information to market their or any other person’s services to you.

Third-party disclosure within New Zealand

We may disclose your personal information to third parties when obtaining litigation funding and insurance in respect of your claims or legal proceedings, when retaining barristers, experts, and consultants to assist in your case, when outsourcing services, such as data storage, debt collection, bulk distribution and mailing, direct marketing, technology support services and when obtaining expert help from consultants in relation to your legal matter or to improve our services.

If the services that we are providing to you or your organisation involve dealing with third parties (e.g. courts, tribunals, regulatory authorities, specialist consultants, barristers, trustees, financial institutions, insurers, brokers, real estate agents, translation agencies and other members of a group of companies to which your organisation is a member), we may disclose your personal information to those third parties on your behalf where you instruct us to do so, or otherwise where it is required as a part of the process of providing our services to you or your organisation. The personal information provided would only be what is required by those third parties or what you have instructed us to provide to them.

Disclosure of personal information to overseas entities

There may be situations where we may transfer your personal information to, or share it with, entities based overseas in order to assist us in providing our services to you or to conduct our business.  These entities may include our Service Partners in the Shine Group in Australia and the United States (including Shine Lawyers Pty Ltd, Shine Justice Ltd, Shine NZ Services Pty Ltd, and Shine Lawyers US, LLC).   

We may also store your personal information in Australia with our Service Partners referred to above or may provide your personal information to vendors who have been contracted to provide customer support and technological solutions, or where we consult overseas-based experts regarding your legal matter, or if your matter is funded by an overseas-based litigation funder or insurer. If these situations apply to you, we will be required to disclose your personal information to recipients outside New Zealand. To the best of our knowledge at this time, any such recipients would likely be located in Australia, the United States, or the United Kingdom.

By registering your interest in participating in any class action or other legal proceedings conducted or to be conducted by Shine or in seeking our advice or assistance in relation to any legal matter, you acknowledge that you thereby provide your consent for disclosure of your personal information to an overseas organisation. In some instances, that organisation may not be required to protect your personal information in a way that, overall, provides comparable safeguards to those set out in the Act.

We have contractual agreements with our Service Partners and other recipients of your personal information to protect the security and confidentiality of your personal information to the same standards as if we stored the information ourselves, to prevent them using the information we provide for any purposes than those we have specified, and to ensure compliance with the Act and our professional legal obligations.

Required by law

There are times when we will be required by law to disclose any personal information we have about you, such as in the instance of an investigation into bankruptcy, our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, fraud, taxation, etc.  These obligations are mandatory.

Your information

We will take all reasonable steps to ensure that personal information we collect, use or disclose is accurate, complete and up-to-date. You can request changes to or access your contact details or personal information by contacting our Privacy Officer as set out below.

You can request access or correction to your personal information held by Shine, or if you wish to make a complaint,by making a written request by post to the Privacy Officer, Shne Lawyers NZ Limited, PO Box 273, Auckland 1140 or email to our Privacy Officer on [email protected]  

In some circumstances, we are permitted to deny your request for access, or limit the access we provide. A reasonable fee may be charged for providing access to your personal information. We will advise you of the likely cost in advance.

In terms of the Act, we are required to report a “notifiable privacy breach” to the “affected individuals” (as defined in the Act) and the Privacy Commissioner, unless the Act provides otherwise.

Privacy Breaches

What is a privacy breach?

We strive to protect your personal information from misuse, loss and unauthorised access; however we cannot guarantee absolute security. 

Under the Act, a “privacy breach” is any unauthorised or accidental access to or disclosure, alteration, loss or destruction of personal information or an action that prevents us from accessing the information on either a temporary or permanent basis.

Under the Act, a “privacy breach” is any unauthorised or accidental access to or disclosure, alteration, loss or destruction of personal information or an action that prevents us from accessing the information on either a temporary or permanent basis.

However, we will promptly notify you in the event of any data breach involving your personal information, whether the breach occurs while we are holding your information or it is held by our Service Partners or other third parties.

Failure to provide information

If the personal information you provide to us is incomplete or inaccurate, we may be unable to provide our services to you, or to the person on whose behalf you are authorised to act.