New Zealand Specific Additional Consumer Terms

1. Contracting Entity for New Zealand

2. Governing Law

These terms, and any agreement between you and Opefin in relation to the Service, are governed by the laws of New Zealand. Nothing in this NZ Addendum, Global Consumer Terms, or the GGT limits or removes rights you have under mandatory New Zealand laws that cannot be excluded by contract, including the Consumer Guarantees Act 1993, the Fair Trading Act 1986, the Privacy Act 2020, the Customer and Product Data Act 2025, and the Contract and Commercial Law Act 2017.

3. Courts

Any dispute not resolved through the processes in the GGT, Global Consumer Terms, or these terms, may be brought before the courts of New Zealand, which have non-exclusive jurisdiction. Consumer Users retain the right to bring proceedings in a New Zealand court regardless of any other provision.

4. Dispute Resolution Schemes

4.1 Financial Services Complaints Limited

Opefin will become a member of Financial Services Complaints Limited (FSCL), an approved dispute resolution scheme under the Financial Service Providers (Registration and Dispute Resolution) Act 2008. If you have a complaint that we have not resolved to your satisfaction through our internal complaints process, you may escalate it to FSCL.

4.2 Privacy Complaints

4.3 Disputes Tribunal and Courts

Consumer Users may bring small claims (up to NZD 30,000) to the Disputes Tribunal without legal representation. Claims above NZD 30,000 are subject to the District Court, High Court, or the dispute resolution process outlined in the applicable terms.

5. Privacy Act 2020 Compliance

5.1 Application

The Privacy Act 2020 applies to Opefin’s collection, use, storage, and disclosure of personal information about individuals in New Zealand. Opefin is the primary controller of Consumer Data collected through the Opefin Source consent process. The definition of Personal Data in the GGT encompasses personal information as defined in the Privacy Act.

5.2 Information Privacy Principles

5.3 Notifiable Privacy Breaches

Where Opefin experiences a privacy breach that is likely to cause serious harm to affected individuals, if allowed under law, Opefin will notify both the affected individuals and the Office of the Privacy Commissioner as required under Part 7 of the Privacy Act 2020. Opefin will notify the Reporting Entity within 72 hours of becoming aware of a breach involving Consumer Data related to their certificates. The Reporting Entity is responsible for assessing its own notification obligations in relation to the Certificate data it holds.

6. CDR Framework in New Zealand

6.1 The Regulatory Framework

The Customer and Product Data Act 2025 (CDR Act) and the Customer and Product Data (Banking and Other Deposit-Taking) Regulations 2025 establish New Zealand’s consumer data right regime. The CDR Act came into force for designated banking products in December 2025.

6.2 Akahu as Open Banking Provider

In New Zealand, Opefin accesses Consumer banking data through Akahu Limited (NZBN: 9429050222383), which holds intermediary accredited requestor status under the CDR Act. Consumers authenticate directly with their bank; the bank sends data to Akahu under the CDR framework; Akahu passes that data to Opefin. For identity verification, Opefin uses appointed IDV Providers for biometric capture, liveness detection, document verification, and government-source identity confirmation. IDV Providers process biometric data under their own privacy frameworks and data processing agreements with Opefin. The current IDV Providers for New Zealand are identified in the applicable Product Schedule and may be updated by Opefin on at least 30 days’ written notice to the Reporting Entity. Opefin is pursuing direct CDR accreditation from MBIE. When direct accreditation is obtained, this NZ Addendum will be updated.

6.3 Designated Banks

The following New Zealand banks are currently designated under the CDR Regulations: ANZ Bank New Zealand, ASB Bank, Bank of New Zealand (BNZ), Westpac New Zealand, and Kiwibank (designation takes effect end of 2026). Accounts at non-designated financial institutions may not be accessible through the CDR connection at this time.

6.4 Consumer CDR Rights in New Zealand

Under the CDR Act, New Zealand users have the following rights:

• The right to authorise and revoke data sharing with any accredited requestor at any time through their bank’s CDR consent management interface.
• The right to know which entities have requested access to their data and for what purpose.
• The right to complain to MBIE about breaches of the CDR Act: www.mbie.govt.nz
• The right to verify Akahu’s CDR accreditation status on the MBIE Register of Participants.

6.5 Disclosed purpose of open banking consent

The CDR Act requires that open banking data be used only for the purpose disclosed at consent. The purpose disclosed in Opefin’s consent flow includes: verifying your identity and generating your AML/CTF compliance certificate; creating and maintaining your Compliance Network Record; enabling accredited Reporting Entities to query your record for future transactions with notification to you; EDD screening where the EDD Module is activated; and improving Opefin products using derived and anonymised data. Raw open banking data is not used for purposes outside this disclosed scope.

7. Privacy Rights for New Zealand Users

7.1 Right to Access

You may request access to the personal information Opefin holds about you under section 44 of the Privacy Act 2020 by contacting privacy@opefin.com. Opefin will respond within 20 working days. Opefin may extend this by a further 20 working days in complex cases by notifying you within the initial 20-day period.

7.2 Right to Correction

You may request correction of personal information under section 55 of the Privacy Act 2020 by contacting privacy@opefin.com. Where Opefin declines to make a correction, you may request that a notation be attached to the information.

7.3 Right to remove from Compliance Network queries

You may request removal of your Compliance Network Record from active queries at any time by contacting privacy@opefin.com. This means no future Reporting Entity can query your record going forward. The underlying Certificate must still be retained for the 5-year statutory period.

7.4 Human Rights Review Tribunal

If the OPC investigates your complaint and does not resolve it, the matter may be referred to the Human Rights Review Tribunal, which has the power to award remedies including damages.

8. Consumer Guarantees Act 1993

Certain parts of the Consumer Guarantees Act 1993 (CGA) apply to services supplied to Consumer Users in trade in New Zealand. When you use Opefin services as a consumer (as defined in the CGA), you have guaranteed rights including that the service will be carried out with reasonable care and skill, will be fit for purpose, and will be completed within a reasonable time. These guarantees cannot be excluded, restricted, or modified in a contract with a Consumer User.

9. Fair Trading Act 1986

The Fair Trading Act 1986 prohibits misleading and deceptive conduct in trade and incorporates Unfair Contract Terms provisions (Part 2A) which apply to consumer contracts and small trade contracts. Opefin does not rely on any term it considers potentially unfair under this standard.

10. Retention Periods in New Zealand

11. Cross-Border Transfers from New Zealand

Where Opefin transfers personal information about New Zealand individuals to a third country, Opefin will ensure the recipient country has comparable protections under section 212(b) of the Privacy Act 2020, the transfer is authorised under section 212, or appropriate contractual safeguards are in place. Opefin’s primary infrastructure is located in New Zealand and Australia. Cloud infrastructure providers in Australia and the United States are bound by data processing agreements containing standard contractual clauses.

12. Government and Regulatory Requests

Where Opefin receives a request from a New Zealand regulatory authority, law enforcement agency, or court for personal information or records, Opefin will assess its legal basis, respond in accordance with its legal obligations, notify the affected Consumer User where lawfully permitted before complying, and provide only the minimum information necessary to satisfy the lawful request.

13. Opefin Source in New Zealand

13.1 Compliance Network in New Zealand

The Opefin Compliance Network is a current core feature of Opefin Source, not a future product. When a Consumer’s certificate is generated, a Compliance Network Record is created. Accredited Reporting Entities involved in future transactions with that Consumer may query the Network with Consumer notification. This supports the reliance model under section 33 of the AML/CFT Act and eliminates repeated verification friction for Consumers across transactions.

13.2 Certificate Legal Standing

An Opefin Source certificate is designed to constitute a CDD record for the source of funds/wealth component under section 60 of the AML/CFT Act. Opefin is not a legal adviser and cannot confirm that any specific certificate will be accepted by the DIA as sufficient CDD evidence in a specific case. Reporting Entities should ensure their use of Opefin Source is consistent with DIA sector guidance and their own legal advice.

13.3 Government Identity Verification

Where the IDV Module is configured to use a government-source identity confirmation service, Opefin Source connects to the applicable service in New Zealand. This government-source or database identity check is performed through Opefin’s IDV provider under its own privacy framework. The Consumer’s consent to the government identity check is captured in the Consumer Consent Disclosure Notice. The specific government identity confirmation service used is identified in the applicable Product Schedule.

14. Complaints About Opefin Source

Complaints about Opefin Source in New Zealand should follow the process in the Opefin Complaints Policy, by emailing complaints@opefin.com. The applicable external dispute resolution scheme will be FSCL (clause 4.1). Privacy complaints may be directed to the OPC (clause 4.2). CDR complaints may be directed to MBIE (clause 6.4).