PulseHub – Privacy Policy

PulseHub, operated by Pulse Digital Ltd

Last updated: 29 June 2026

Pulse Digital Ltd (a company registered in New Zealand) trading as PulseHub (“PulseHub”, “Pulse

Digital”, “we”, “us” or “our”) is committed to providing quality services to you and to respecting your privacy.

This Privacy Policy sets out how we collect, use, process, store, share and disclose your Personal

Information from the operation of our website at pulsehub.nz and pulsedigital.nz (“Website”), our

product, being a managed CRM and marketing automation platform built on the GoHighLevel

infrastructure that helps businesses create, manage and automate their customer interactions

(“Platform”), and our services, including managed setup, ongoing management and done-for-you

services where we may act on your behalf to configure, implement or operate aspects of the

Platform (each of the Website, Platform and services, together the “Services”).

If you are a PulseHub customer, when you signed up for any of our Services you agreed to our

Terms of Service, which include the obligations in this Privacy Policy.

We are committed to protecting your privacy and upholding your rights under the Privacy Act 2020

(NZ) and the thirteen Information Privacy Principles (“IPPs”), and, where it applies, the General Data

Protection Regulation (EU 2016/679) (the “GDPR”) and the UK GDPR, together with any other

relevant privacy laws in jurisdictions where our Services are available (collectively, “Privacy Laws”).

Under the GDPR we are generally a data controller, but in some circumstances, for example where

we operate the Platform on behalf of a business client, we act as a data processor for that client. By

accessing and using our Services you consent to the collection, use, processing, storage and

disclosure of Personal Information by us as set out in this Privacy Policy.

1. Information we collect

Personal Information is any information relating, directly or indirectly, to an identified or identifiable

individual (“Personal Information”). The types of Personal Information we collect include, without

limitation:

• Identification and contact details: your full name, business name, postal address, email

address, telephone number(s), role and place of work.

• Billing information: payment card details (processed by our third-party payment provider

Stripe), billing address, GST number and transaction history. We do not store full card

numbers on our systems.

• Traffic and device information: device ID, device type, geo-location, browser and

connection information, screen resolution, site usage, session information, page views,

advertising identifiers, IP address and standard web log information.

• Product information: details of the Services we have provided to you or that you have

enquired about, including configuration details for your Platform account.

• Communications data: where you use the Platform, the content and metadata of SMS,

email, live chat, Instagram and Facebook direct messages, and call logs that pass through

the Platform, including the missed-call text-back feature.

• Contact and lead data you load into the Platform: as a customer you may upload, import

or capture Personal Information about your own contacts, leads and clients (“Contact Data”).

You are the controller of that Contact Data and we process it on your behalf as described in

section 6.

• Marketing and advertising data: information about how you interact with our and our

customers’ ads, emails, landing pages, forms and quizzes, including click, conversion and

attribution data collected through tracking technologies (see sections 11 and 12).

• User content: any information you publicly post to us or submit through interactive features,

including reviews, comments, messages and content shared via social media.

• Survey and feedback information: information you provide through customer surveys or

requests for feedback.

• Done-for-you services information: business or operational details, instructions, content,

login credentials and any other data required for us to deliver managed services on your

behalf.

• Other: any other Personal Information reasonably required to facilitate your dealings with us.

2. How we collect your Personal Information

We collect Personal Information only by lawful and fair means. Generally we collect it:

• directly from you, when you provide information to us, enquire about our Services or interact

with us;

• automatically in the course of your use of our Website and Platform, including through

cookies and similar technologies;

• from your end users and contacts, where you operate a Platform account and they interact

with your forms, calendars, messages or campaigns; and

• from third-party sources and integration partners, such as Meta, Google and our other

software providers, where you have connected those services.

If you do not provide the Personal Information we request, we may not be able to provide you with

some or all of our Services.

3. Sensitive information

We do not generally collect sensitive information (such as information about health, racial or ethnic

origin, political opinions, religious beliefs, sexual orientation, or biometric or genetic data). Please do

not send us sensitive information unless we have specifically requested it. If we do require it, we will

tell you why and ask for your express consent. You are responsible for ensuring that any Contact

Data you load into the Platform does not include sensitive information unless you have a lawful basis

and consent to do so.

4. Children

Our Services are not intended for, or directed at, individuals under the age of 18. We do not

knowingly collect Personal Information from anyone under 18. If we become aware that we have

collected Personal Information from a person under 18, we will remove it and deactivate any related

account as soon as reasonably practicable. We acknowledge the definition of a minor varies

between jurisdictions.

5. How we use your Personal Information

We use, process and disclose your Personal Information for the purposes for which it was collected,

or for directly related purposes, including:

• providing, administering, protecting, improving and optimising our Services;

• setting up, managing and supporting your Platform account, including done-for-you and

managed services;

• operating Platform features such as the unified inbox, automations, booking and calendar,

payments, reputation management and reporting;

• processing payments and managing billing, subscriptions and invoices;

• data analytics, research and creating de-identified industry reports to understand and

improve our Services;

• verifying your identity, preventing fraud and protecting the security and proper functioning of

our Services;

• responding to your enquiries, requests and support tickets;

• sending you service messages, product updates and, where permitted, marketing

communications about our Services and related offers (see section 10); and

• complying with our legal obligations and enforcing our Terms of Service.

6. When we act as a processor for our customers

When you use the Platform to manage your own contacts, leads and clients, you are the controller of

that Contact Data and we act as your processor. In that role we will:

• only process Contact Data in accordance with your instructions and our Terms of Service;

• apply appropriate technical and organisational security measures;

• require our sub-processors (including GoHighLevel and the providers listed in section 7) to

provide adequate protections; and

• assist you, so far as reasonably possible, to meet your own obligations under Privacy Laws,

including responding to individuals exercising their rights.

You are responsible for having a lawful basis and any required consents to collect, upload and

process Contact Data through the Platform, and for maintaining your own privacy notice to your

contacts.

7. Who we share your Personal Information with

We may disclose your Personal Information to the following categories of recipients:

• Platform provider: HighLevel, Inc. (GoHighLevel), which supplies the underlying CRM,

automation and communication infrastructure on which the Platform is built. HighLevel may

access or process Personal Information to operate and support the Platform in accordance

with its security, compliance and data processing terms.

• Payment provider: Stripe, which processes card payments and recurring billing. Stripe

handles your card data under its own terms and PCI-DSS obligations.

• Communications and messaging providers: the SMS, email and voice carriers and

gateways used to send and receive messages through the Platform.

• Integration partners: where you connect them, services such as Meta (Facebook and

Instagram), Google (Calendar, Gmail, Google Business Profile and Google Ads), Zapier and

Circle.

• Analytics and advertising providers: providers such as Google Analytics and Meta that

help us measure and improve our Services and run advertising (see sections 11 and 12).

• Service providers and contractors: trusted third parties who perform functions on our

behalf, such as hosting, IT support and professional advisers (lawyers, accountants, auditors

and insurers).

• Legal and regulatory: any person or body to whom we are required or authorised to

disclose Personal Information by law, or to protect the rights, property or safety of Pulse

Digital, you or others.

• Business transfers: a buyer or successor in the event of a sale, merger or reorganisation of

our business, subject to this Privacy Policy.

We require our service providers to handle Personal Information consistently with this Privacy Policy

and applicable Privacy Laws.

8. Storage, security and retention

We take reasonable steps to protect Personal Information from misuse, interference, loss and

unauthorised access, modification or disclosure, using a combination of physical, administrative and

technical measures. Much of the data within the Platform is hosted on infrastructure operated by

HighLevel, Inc. and its sub-processors.

No method of transmission or storage is completely secure, so we cannot guarantee absolute

security and you disclose information to us at your own risk. Because the Platform is operated on

infrastructure controlled by HighLevel, Inc. and its sub-processors, a security incident may originate

with a provider rather than with us. To the fullest extent permitted by law, we are not liable for any

unauthorised access to, or loss of, Personal Information that occurs despite our reasonable

safeguards, including where it is caused by a third-party provider.

Where a notifiable privacy breach occurs, we will notify affected individuals and the Office of the

Privacy Commissioner where required by the Privacy Act 2020, and will comply with the breach

notification obligations of any other applicable Privacy Law. Where a breach originates with a service

provider, we will rely on that provider for information about the incident and will pass on notifications

as required by law.

We retain Personal Information for as long as needed to provide the Services, meet our legal,

accounting and reporting obligations, and resolve disputes. When it is no longer required, we will

take reasonable steps to destroy or de-identify it.

9. Cross-border disclosure

Some of our service providers, including HighLevel, Inc., Stripe and our analytics and advertising

partners, are located outside New Zealand, including in the United States and the European Union.

This means your Personal Information may be stored or processed overseas. Where we transfer

Personal Information overseas, we take reasonable steps to ensure it is handled consistently with

New Zealand Privacy Law and, where the GDPR applies, on the basis of an appropriate transfer

mechanism such as the European Commission’s standard contractual clauses.

10. Direct marketing and electronic messages

Where we have your consent, a legitimate interest, or are otherwise permitted by Privacy Laws and

the Unsolicited Electronic Messages Act 2007 (NZ), we may send you marketing communications

about our Services and related offers. Every marketing email and SMS we send includes a way to

unsubscribe.

You can opt out at any time by using the unsubscribe link in the message or by contacting us at

[email protected]. Opting out of marketing will not stop service messages that we need to send

you about your account.

Important for customers: when you use the Platform to send SMS, email or other messages to

your own contacts, you are the sender for the purposes of the Unsolicited Electronic Messages Act

2007 and equivalent laws (such as the CAN-SPAM Act and TCPA in the United States). You are responsible

for obtaining the consent of your contacts, including a functional unsubscribe facility, and

for complying with all applicable anti-spam and telemarketing laws.

11. Cookies and tracking technologies

We use cookies, web beacons, pixels and similar technologies (collectively “Cookies”) on our

Website and within the Platform. By using our Website you agree that we can store and access

Cookies in accordance with this Privacy Policy and your cookie preferences. We use Cookies to:

• recognise you and keep you signed in;

• remember your preferences and settings;

• monitor and analyse use of our Website and Services;

• measure and improve the performance of forms, funnels and campaigns; and

• deliver and measure advertising (see section 12).

You can manage or refuse non-essential Cookies through our cookie banner where shown, or

through your browser settings. Disabling Cookies may affect the functionality of our Services.

12. Advertising and ads

We, and our customers using the Platform, use advertising and tracking technologies to plan, deliver

and measure marketing. This may include:

• Advertising pixels and tags: such as the Meta Pixel, Google Ads tags and conversion

tracking, which help us understand which ads and campaigns lead to enquiries, sign-ups and

sales.

• Retargeting and audiences: we may use information about your interaction with our

Website, ads and emails to show you relevant ads on third-party platforms such as

Facebook, Instagram and the Google Display Network, and to build similar or custom

audiences.

• Analytics for advertising: we use tools such as Google Analytics, including its advertising

and remarketing features, to measure traffic and audience interests. You can opt out of

Google’s advertising features using Google’s Ads Settings and the Google Analytics Opt-out

Browser Add-on.

Ads and promotional content within the Services: we reserve the right to display promotional

content, offers, sponsored content or third-party advertising within the Website, the Platform, our

emails, newsletters and other communications. Where we do, we will identify advertising as such

where required by law. We do not sell your Personal Information. If we ever introduce third-party

advertising that involves sharing Personal Information with advertisers, we will update this Privacy

Policy and, where required, obtain your consent.

When you run advertising campaigns through the Platform, you are responsible for the content and

targeting of those ads and for complying with the advertising policies of Meta, Google and other ad

networks, and with all applicable advertising and consumer laws.

13. Your privacy rights

Subject to some exceptions in the relevant Privacy Laws, you may:

• request access to the Personal Information we hold about you;

• ask us to correct Personal Information that is inaccurate, incomplete or out of date;

• ask us to delete Personal Information in certain circumstances;

• object to or restrict certain processing, or withdraw consent where we rely on it; and

• where the GDPR applies, request data portability and lodge a complaint with your local

supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within the

timeframe required by law. We may need to verify your identity, and in limited cases we may decline

a request where the law allows, in which case we will explain why. We do not charge a fee to correct

your information, and any fee for access will not be excessive.

If your request relates to Contact Data held in a customer’s Platform account, we will refer you to the

relevant customer, who is the controller of that data.

14. New Zealand and overseas individuals

New Zealand: you have the right to access and correct your Personal Information under the Privacy

Act 2020. If you are not satisfied with how we have handled your information or a complaint, you

may contact the Office of the Privacy Commissioner at privacy.org.nz.

European Economic Area and United Kingdom: where the GDPR or UK GDPR applies, we

process your Personal Information on the legal bases of performing our contract with you, our

legitimate interests in operating and improving the Services, your consent (which you may withdraw

at any time), and compliance with legal obligations.

15. Third-party sites and services

Our Services may link to, or integrate with, third-party websites and services, including social media

networks and the integration partners listed above. This Privacy Policy applies only to information

collected by us through our Services. We are not responsible for the privacy practices of third

parties, and we encourage you to review their privacy policies.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Non-material changes and clarifications take

effect immediately on posting. Material changes take effect 30 days after the updated Privacy Policy

is posted on our Website, unless the law requires otherwise. The “Last updated” date at the top

shows when it was last revised.

17. Contact us

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to make a

privacy complaint, please contact us:

Pulse Digital Ltd (trading as PulseHub)

Attention: Privacy Officer

Email: [email protected]

Website: pulsehub.nz