Website Privacy Policy & Data Governance

Last Updated: September 2026

Website Privacy Policy & Data Governance establishes how the Trustee for The Invictus Strategies Trust ("we", "us", or "our") manages, collects, and secures personal information across our digital domain. Operating as a specialised strategic communications and crisis management practice based in New Zealand, we maintain rigorous data protection protocols that reflect the sensitive environment in which we operate. By accessing this platform, submitting enquiries, or engaging our consulting services, you acknowledge the terms set out in this document, our Website Terms of Use, and our cookie tracking disclosures.

I. Statutory Governance and Principles

We conduct all information handling practices in strict compliance with the Privacy Act 2020 (New Zealand). Our internal operations adhere to the 13 statutory Information Privacy Principles (IPPs) governing the lawful collection, purpose specification, retention, accuracy, and disclosure of personal data. Under Information Privacy Principle 3(4), full commercial registration details of the Corporate Trustee are withheld during initial digital intake to protect operator safety and preserve operational confidentiality in high-stakes crisis scenarios. Non-disclosure during this preliminary intake phase is strictly safety-driven; the underlying corporate entity is solvent, in good standing, and maintains verified New Zealand company registration. Full corporate identification is provided formally under preliminary confidentiality prior to commercial contracting. Any processing of personal data is limited strictly to legitimate operational needs, direct client correspondence, and fulfilment of advisory responsibilities.

II. Information Collection Framework

We collect personal details only when necessary for our advisory functions, separating information into two distinct categories: direct submissions and automated technical data.

2.1 Direct Information: Provided voluntarily when you request an initial consultation, complete our contact form, or correspond with our advisers via encrypted channels. This information includes your legal name, trading identity, email address, contact telephone number, and factual case summaries concerning reputation or crisis incidents. We ask that users avoid sending unrequested confidential passwords, financial keys, or restricted access credentials through initial web forms.

2.2 Automated Technical Information: Limited to standard network diagnostics generated during your visit. This includes IP addresses, request timestamps, referring URLs, browser software, and device operating system profiles. We do not correlate automated technical telemetry with individual user identities, preserving anonymous browsing across our informational pages.

III. Edge Infrastructure and Analytics

Our digital presence operates on Cloudflare edge infrastructure. We do not deploy third-party behavioural ad trackers, cross-site profiling tags, or invasive social media tracking pixels. Our platform performance metrics are monitored through cookieless edge analytics that function without client-side cookies, local storage tracking, or persistent individual profiling.

To maintain platform integrity and resist automated denial-of-service threats, our forms employ non-intrusive edge security challenges. These automated edge checks validate browser authenticity using transient cryptographic validations, avoiding tracking mechanisms while preventing spam submissions from malicious bots. Webmaster verification is maintained through static Google Search Console verification meta tags that gather no visitor personal data.

IV. Consultation Intake and Encrypted Data Transit

When you submit information through our confidential consultation form, your payload is processed via an encrypted web relay. Form fields are transmitted over transport layer encryption (TLS 1.3), converted into an encrypted message payload, and routed directly to our private intake mailbox.

Users must complete a mandatory consent checkbox on our consultation form confirming agreement to our data handling standards and the cross-border transit of their submission. Data submitted through this interface is not stored in a public-facing web database, sold to marketing brokers, or distributed to data aggregators. It exists solely as a secure transit mechanism to deliver your direct communication to our intake team. If an initial enquiry does not proceed to a formal advisory engagement, all transmitted intake records are permanently purged in accordance with our data disposal schedule. For immediate case assessments, review our practice capabilities list or initiate contact through our confidential intake desk.

V. Storage, Security, and Cross-Border Transfers

We employ technical defences to protect your personal information against unauthorised alteration, loss, interception, or misuse. All communications across this site use high-grade TLS encryption, enforcing HTTPS connections with strict security headers including Content-Security-Policy, Referrer-Policy, and X-Content-Type-Options.

Reflecting Principle 12 of the Privacy Act 2020, we do not transfer personal information to overseas third-party recipients unless we are satisfied that the foreign entity is subject to privacy laws providing comparable safeguards to New Zealand legislation, or the disclosure is made with your explicit informed consent to advance a crisis response mandate. Internal access to submitted case summaries is restricted strictly to authorised personnel bound by non-disclosure covenants.

VI. Retention and Disposal Schedules

We retain personal details only for the duration required to achieve the purpose for which the information was gathered, or as mandated by New Zealand statutory obligations. Unsolicited case notes, speculative submissions, or general enquiries that do not result in a commercial service agreement are permanently erased from our processing records within 90 days of receipt. Where a client enters a formal engagement, records are maintained during the active project lifecycle and archived securely for statutory accounting and legal defence windows before final sanitisation.

VII. Data Subject Rights and Corrections

Under Principles 6 and 7 of the Privacy Act 2020, you possess enforceable rights to request confirmation of whether we hold personal information concerning you, to obtain access to that information, and to request correction where records are inaccurate, out of date, or misleading.

If you wish to submit an access or correction request, please submit your enquiry in writing to our designated Privacy Officer. We will assess and respond to your request within 20 working days as stipulated by statutory deadlines. If we decline a requested correction, you retain the legal right to request that a statement of correction be attached to the relevant file. For independent advice on your rights, visit the Office of the Privacy Commissioner.

VIII. Cultural Heritage & Automated Extraction

The Invictus Strategies Trust respects indigenous cultural heritage and the principles of Indigenous Data Sovereignty under Te Tiriti o Waitangi. All cultural concepts, linguistic references, and visual emblems displayed across this domain are protected against unauthorised automated exploitation.

Automated scrapers, commercial language models, and machine learning systems are prohibited from harvesting, ingesting, or processing cultural expressions or traditional symbols displayed on this domain. We require automated user-agents to respect site directives and refrain from extracting published content for synthetic reproduction or commercial algorithmic training without explicit permission.

IX. Direct Communications and Spam Compliance

We adhere strictly to the Unsolicited Electronic Messages Act 2007. We never send commercial electronic messages without verifiable consent, whether express, inferred, or deemed. Any electronic updates, legal notices, or correspondence originating from our desk clearly identify our organisation, disclose direct contact information, and provide a functional unsubscribe facility. We do not use address-harvesting software or acquire compiled email lists under any operational circumstances.

X. Enquiries and Privacy Officer Contact

If you have questions regarding our privacy architecture, require assistance with a statutory information request, or wish to raise a compliance question, direct your correspondence to our Privacy Officer via email at: [email protected]. You may also return to the main operational portal to review our broader operational framework.