New Zealand Privacy Notice

2.1 What Akahu does

In New Zealand, we use Akahu Limited as our open banking intermediary. Akahu is accredited under the Customer and Product Data Act 2025. When you connect your bank account through Opefin Source, you create a connection via Akahu. Akahu acts as a secure intermediary between your bank and Opefin. When you give your consent, Akahu retrieves your bank account and transaction data on our behalf and delivers it to us securely.

2.2 Scope of Akahu access

We use Akahu’s enduring consent service for account information only. We retrieve account balances and transactions only. We do not initiate payments or transfers via Akahu, and we do not use Akahu Apply, Akahu Genie, or any other Akahu product. For most Opefin Source requests, the consent is used once to generate the certificate and then the connection is complete (although ongoing consent may also be required).

2.3 Akahu’s own terms

2.4 What happens when you revoke the Akahu connection

If a certificate has already been generated using your data, that certificate and the underlying data incorporated into it must be retained for 5 years from the certificate date under section 49 of the AML/CFT Act 2009. Revoking the Akahu connection does not shorten this obligation. Raw bank data retrieved via Akahu but not incorporated into any certificate is deleted within 30 days of revocation. Data incorporated into a certificate or Compliance Network record is retained for the statutory period.

2.5 CPD Act and disclosed purpose of open banking consent

The Customer and Product Data Act 2025 requires that open banking data be used only for the purpose disclosed at the time of consent. The purpose disclosed in your Opefin consent flow includes: verifying your identity and generating your AML/CTF compliance certificate; creating and maintaining your verified compliance record in the Opefin Compliance Network; EDD screening (PEP, sanctions, and adverse media screening) where that module is activated; enabling accredited reporting entities to query your record for future transactions with notification to you; and improving Opefin products using derived and anonymised data. Raw open banking data is not used for purposes outside this disclosed scope.

2.6 Obligation to notify Akahu of changes

As part of Opefin’s Akahu accreditation, Opefin is required to notify Akahu at hello@akahu.nz if we make any changes to this Privacy Notice that affect how we use data exchanged via the Akahu connection.

The Privacy Act 2020 sets out 12 Information Privacy Principles (IPPs). The table below explains how Opefin meets each obligation in the Opefin Source and Compliance Network context.

The Opefin Compliance Network is a core feature of Opefin Source. It is not a secondary optional use. By accepting the Consumer Terms and this Privacy Notice, you agree to your certificate and associated verified data being part of the Network for the statutory retention period.

5.1 NZ legislative reliance and the Network

Section 33 of the AML/CFT Act allows a reporting entity to rely on another reporting entity’s CDD records under specified conditions. The Opefin Compliance Network supports and extends this model by enabling accredited reporting entities to access your verified compliance record for future transactions, with notification to you, without requiring you to repeat the full CDD process.

5.2 Notification for Network queries

When an accredited reporting entity queries your Network record, you will receive a notification. You do not need to give fresh consent for each query, but you are notified of each one. You may request removal from active Network queries at any time while acknowledging that the underlying certificate must be retained for the statutory period.

5.3 CPD Act and the Compliance Network

Access to your open banking data via Akahu is used to generate your certificate and Compliance Network record. The CPD Act requires that open banking data be used only for the purpose disclosed at consent. The disclosed purpose includes Compliance Network record creation and future re-query by accredited reporting entities. Raw open banking data is not shared through the Network; only the structured derived record is held and queried.

6.1 Access and correction requests

Under sections 44 and 71 of the Privacy Act 2020, you have the right to access the personal information we hold about you and to request correction of inaccurate information. Send your request to privacy@opefin.com. We will acknowledge within 5 working days and respond within 20 working days.

6.2 Complaints to Opefin

6.3 Complaints to the Office of the Privacy Commissioner

6.4 Complaints about your open banking connection (CPD Act)

7.1 Reporting Entities in New Zealand

Reporting entities using Opefin Source in New Zealand are supervised by the Department of Internal Affairs (DIA). They must hold a current AML/CFT Programme and comply with the AML/CFT Act 2009, the AML/CFT (Requirements and Compliance) Regulations 2011, and related guidelines.

7.2 Government identity verification

Where the IDV Module is configured to use government-source identity confirmation, Opefin Source connects to the applicable government identity service in New Zealand. This check is performed through our IDV provider under its own privacy framework. We send a verification request and receive a name and verification outcome only. We incorporate the outcome into your certificate and do not retain raw verification data after certificate generation.

7.3 No FSPR registration required

Opefin Limited is a technology company. We are not a financial service provider and are not registered on the Financial Service Providers Register (FSPR).

7.4 Consumer Guarantees Act 1993 and Fair Trading Act 1986

If you are an individual consumer, certain parts of the Consumer Guarantees Act 1993 and the Fair Trading Act 1986 apply to your use of Opefin Source. These Acts give you guaranteed rights that cannot be excluded by contract. Nothing in our Consumer Terms, this notice, or any other Opefin document removes those rights.