By clicking "Accept", you agree to the storing of cookies on your device to enhance site navigation, analyse site usage, and assist in our marketing efforts. View our Cookie Policy for more info.
At JAVLN, we take your privacy seriously. We are committed to protecting your privacy and complying with our obligations in respect of personal information under the law of the country in which we provide our services (which we refer to in this policy as the applicable privacy laws). In Australia, these include the Privacy Act 1988 (Cth) and the Australian Privacy Principles. In New Zealand, these include the Privacy Act 2020 and the information privacy principles set out in section 22 of that Act.
We’ve created our privacy policy to ensure that we communicate to you how we collect, use, hold and disclose your personal information. We encourage you to read this policy carefully. It will help you make informed decisions about sharing your personal information with us.
This policy explains how personal information is collected, held, used and disclosed. Where the applicable privacy laws require consent for a particular collection or use, this policy explains who obtains it. Sometimes that is us. Sometimes it is the broker, agency or insurer you deal with. If you deal with us directly and do not agree with any aspect of this policy, please do not access or use our services.
As part of the services we provide to our customers, we handle personal information in two different ways, and which part of this policy applies depends on your situation.
Part A applies if you deal with JAVLN directly. That covers visitors to our website, contacts at organisations that use our services, people who contact our support team, people who attend our events or training, and job applicants. JAVLN decides what information is collected and why, and JAVLN is responsible for telling you about it and for obtaining any consent the law requires.
Part B applies if your broker, agency, advisor or insurer uses JAVLN. In this policy we call that organisation your provider. Your provider decides what information is collected about you and why, and your provider is responsible for telling you about it and for obtaining any consent required. We hold the information for your provider and act on its instructions.
Part C applies to everyone. It covers where information is held, the service providers we use, how we protect it, automated decisions, what happens if something goes wrong, how long we keep it, and how to contact us.
This policy applies to all products and services we provide, including the SaaS Services, Data Services and Maintenance and Support Services described in our Terms of Service, together with the websites we own and operate, our mobile applications, and any other facilities we offer such as events and training. For the purpose of this policy we call all of these our services.
When we say ‘personal information’ we mean identifiable information or an opinion about you, like your name, email, address, telephone number, bank account details, payment information, support queries, community comments and so on.
If you cannot be identified from information, this policy does not apply to it. Before treating information that way, we assess whether an individual could reasonably be re-identified from it, taking into account other information available to us or to the recipient.
This Part applies to visitors to our website, contacts at organisations that use our services, people who contact our support team, people who attend our events or training, and job applicants.
What we collect depends on how you interact with us. It includes:
Sensitive information. We do not generally seek sensitive information, such as health information, from people who deal with us directly. We may collect it where you choose to provide it to us, or where it is reasonably necessary, for example, a criminal history check as part of a job application. We only collect sensitive information with your consent, or where the law otherwise permits it.
We may collect personal information directly from you when you register to use our services, use our services, contact our support team, visit our website, apply for a job with us, participate in community forums, join us on social media, or take part in training or events.
We also collect information about your visits to our website and your use of our services, including through analytics tools such as Google Analytics.
We may collect information about you from third parties, including your employer, our affiliates or partner companies, and marketing or advertising companies. We use it to supplement and validate what we already hold and to improve our services. Where the applicable privacy laws require us to tell you that we collected your information from someone else, we take reasonable steps to do so.
You can choose not to provide your personal information, but we may then be unable to provide you with our services.
Where it is lawful and practicable, you can deal with us without identifying yourself or by using a pseudonym, for example when making a general enquiry. We will usually need your name and contact details to provide our services, respond to a support request or process a job application.
We use personal information collected under this Part to:
Where the applicable privacy laws require your consent for a particular collection or use, we seek that consent from you separately and specifically, rather than relying on your use of our services.
We do not sell, license, or rent your personal information to others. There will be times when we need to share it. We will only disclose your personal information to:
Some of the third-party tools we use to run our own business are located outside Australia and New Zealand. Our service providers, in Part C, explains which tools and countries are involved.
By subscribing to email or text communications, or otherwise providing your email address or mobile number, you consent to receiving emails, texts and other electronic messages which promote and market our services, or the products and services of others, from time to time.
You can unsubscribe at any time by following the “Unsubscribe” process within the communication. Once you have unsubscribed you will be removed from the corresponding marketing list as soon as is reasonably practicable.
In providing our services and operating our website, JAVLN uses cookies and similar tracking technologies. A cookie is a small text file stored on your device for record-keeping purposes. Cookies do not usually identify you by name, but they assign a unique identifier to your device. Information collected through cookies can be personal information when combined with other information we hold about you.
We may use a combination of persistent cookies, which remain on your device for a set period of time to remember your preferences and recognise you when you return, and session cookies, which expire automatically when you close your browser.
Cookies help us recognise you when you return and understand which areas of our website and services are of interest to you. You can set your browser to notify you when you receive a cookie so that you can accept or reject it. Refusing cookies may have a negative impact on the functionality and usability of the website.
If you receive email communications from us, we may use open and click tracking, including cookies, a single pixel image and link redirects, to understand which communications are of most interest to you. We may also use web beacons (electronic images also known as pixel tags or clear gifs) to recognise a cookie on your device when you view a web page, an advertisement we have placed, or an email we have sent.
We may also collect your operating system version, unique device identifiers and other information, to associate your device with you.
We take reasonable steps to keep the personal information we hold accurate, complete and up to date. Please tell us if your details change.
You may request access to the information we hold about you, or ask us to update or correct it, by writing to privacy@javln.com. We respond within 20 working days in New Zealand and within 30 days in Australia. If we cannot give you access to the information you have asked for, we will give you our reasons.
This Part applies if your insurance is arranged, advised on or administered by a broker, agency, advisor or insurer that uses our services. We call that organisation your provider.
We hold your personal information for your provider and handle it on your provider’s instructions.
Your provider decides what information is collected about you, why it is collected, who else sees it, and how long it is kept. We do not make those decisions and we do not use your information for our own purposes.
Under New Zealand law, your provider is the organisation responsible for your information. Australian law also places some obligations directly on us. Where it requires you to be told about the collection of your information, we rely on your provider to tell you, and our agreement with your provider requires it to do so.
We hold whatever information your provider provides to us through our services in order to arrange or administer your insurance. That includes your name and contact details, information about your policies, premiums and payments, correspondence between you and your provider, file notes, and claims information.
Sensitive information. The records we hold for your provider may include sensitive information, such as health information and government identifiers. This happens where health information is relevant to the cover your provider is arranging or advising on, or to a claim.
We do not seek that information from you. We receive it from your provider, hold it securely, and use it only to provide the services your provider has asked us for.
We do not collect your information from you. We receive it from your provider, or from someone acting for your provider.
Your provider has the relationship with you, so your provider tells you what information is collected, why, who it is shared with, and how you can access or correct it. You will normally find that in your provider’s own privacy or collection statement, given to you when you complete a proposal, application or claim form.
If you have not received it, please ask your provider for it.
We do not ask you for consent. We do not deal with you directly and in most cases hold no way of contacting you.
Where the applicable privacy laws require consent, including for sensitive information such as health information, your provider obtains it when the information is collected from you, normally as part of the proposal, application or claim process. Your provider’s collection statement should tell you that your information will be held and processed by a third-party service provider.
Our agreement with your provider requires your provider to warrant that it has obtained every consent needed for us to hold and process your information as described in this policy.
To withdraw a consent, or to ask about one you have given, contact your provider. We will assist your provider in responding to you.
We use the information we hold for your provider only to:
We do not:
Where we produce statistics about how our services are used, we do so only in aggregated, de-identified form that does not identify you, any other individual, or any of our customers, and only to the extent our agreement with your provider allows.
We disclose the information we hold for your provider only:
We do not disclose it for any other reason unless your provider instructs us to.
Our services include features that use a large language model to produce a short summary of recent activity on a client file, covering documents, file notes, correspondence, claims activity and tasks, for the broker, agency or insurer responsible for that file.
How it uses your information. Only the documents needed for the summary are processed, and only within the access controls your provider has configured. A summary is available only to users already permitted to see the underlying records. Where a client file contains health information or government identifiers, that information may form part of the records summarised, and it is handled under the same controls as everything else.
Where processing happens. The feature runs on Microsoft Azure AI Foundry inside JAVLN’s own private Azure tenancy, using a pre-trained foundation model provided through Azure AI Foundry. That environment has no access to the public internet, and it is hosted in the same region as the rest of our services, in Australia and New Zealand. Your information is not sent to any public AI service. Our current AI service provider is named on our service provider list at https://javln.com/legal/sub-processors.
Model training. We do not use the personal information we hold to train, retrain, fine-tune, validate or improve any artificial intelligence model. The model we use is pre-trained and static. Under our agreement with Microsoft, your information is not retained or reused by the model provider to train its own models.
Accuracy. A summary condenses existing records, so it may be incomplete. Every summary is marked as AI-generated. The source records remain available to your provider, who is responsible for reviewing the summary and for any decision it makes.
Automated decisions. The feature summarises text. It does not give advice, assess or decide anything, and it makes no recommendations about individuals. Decisions about your insurance are made by your provider. Our wider position on automated decisions is set out in Part C.
Your provider controls the information we hold about you, so the quickest way to access or correct it, or to make a complaint, is usually to contact your provider. We will assist your provider in responding to you.
You can also contact us directly at privacy@javln.com. If you do, we will deal with your request or complaint in accordance with the applicable privacy laws and within the timeframes set out in Part A, working with your provider where needed. Where New Zealand law treats your provider as the organisation that holds your information, we will transfer your request to your provider and tell you that we have done so.
Our services, and all personal information we hold within them, are hosted in Australia and New Zealand and processed in Australia, New Zealand and the Philippines. That includes all information we hold for providers under Part B, and the processing carried out by the AI feature described in Part B.
Information collected in one of those countries may be held or processed in the other. Where that happens, we take reasonable steps to satisfy ourselves that the information continues to be protected by comparable safeguards, and we impose contractual obligations on the recipient to that effect. We remain accountable to you for how the recipient handles your information.
Separately, some of the third-party tools we use to run our own business store or process information about people who deal with us directly outside of our core locations. Our service providers, below, explains which tools and countries are involved.
If we begin hosting or processing information held within our services outside Australia, New Zealand or the Philippines, or begin using a business tool that processes information in a country not listed in our service providers, we will update this policy, and where relevant our service provider list, before we do so.
We use service providers to help us deliver our services and to run our own business. They fall into two groups.
Providers that support our services. These providers host, operate and support our services, including our artificial intelligence service provider. They process the personal information held within our services, including the information we hold for providers under Part B, only in Australia and New Zealand. A current list of them is available at https://javln.com/legal/sub-processors. We update that list before a new provider begins processing personal information within our services.
Providers of our own business tools. We also use third-party tools to run JAVLN’s own business, such as website analytics, customer relationship management, email and communication, marketing, recruitment, and finance and accounting systems. These tools hold information covered by Part A, such as the contact details of people at our customers, website usage information and marketing preferences. They are not used to host or process the records we hold for providers in our services. Some of these providers store or process information outside Australia and New Zealand, currently in the countries listed at https://javln.com/legal/sub-processors.
When we disclose personal information to any of our service providers, we take reasonable steps to ensure they handle it consistently with the applicable privacy laws, including through contractual obligations.
Security is a priority for us. We have appropriate technical and organisational measures in place to protect personal information from unauthorised or accidental access, disclosure, alteration, loss or destruction, and from anything that prevents us from accessing it on a temporary or permanent basis. We refer to any of those events as a Privacy Breach.
Personal information is stored on secure servers and encrypted in transit and at rest. Each customer’s environment is separated from every other customer’s environment. Our controls are independently audited each year against SOC 2 Type 2.
JAVLN does not use computer programs to make, or to do anything substantially and directly related to making, decisions about individuals that could reasonably be expected to significantly affect their rights or interests. This applies to all personal information covered by this policy, including information about people who deal with us directly under Part A and information we hold for providers under Part B.
If that changes, we will update this policy before the change takes effect, to describe the kinds of personal information used and the kinds of decisions involved.
If personal information is subject to a Privacy Breach that is likely to cause serious harm, we notify the people affected and the relevant regulator as soon as practicable and within the timeframes the law requires. In New Zealand that regulator is the Office of the Privacy Commissioner. In Australia it is the Office of the Australian Information Commissioner.
Where we hold personal information for one of our customers, we notify that customer without undue delay, so they can meet their own notification obligations and communicate with the people affected.
How long we keep personal information depends on why we hold it.
Information we hold for your provider. We hold it for as long as your provider remains a JAVLN customer, because your provider needs continuous access to its own records. While its agreement with us is active, your provider decides what is kept and what is deleted. When the agreement ends, we keep the information for a further three months, or as specifically agreed, so your provider can retrieve it and meet its own legal and regulatory obligations, and then delete it in accordance with our agreement.
Information we hold for ourselves. We keep it for as long as we have a relationship with you and for a period afterwards where we have an ongoing business need or requirement. We keep marketing contact records until you unsubscribe and for six months afterwards.
AI records. The instructions sent to our AI feature are not retained. Summaries it produces are stored with your provider’s other records and follow the same retention as those records.
After the relevant period we delete the information or de-identify it.
Our website may contain links to other websites that are not under our control. These websites may use cookies. It is the responsibility of those third parties to collect appropriate consents from you in order to permit their own cookies, to the extent required by law, and to inform you about the cookies they use. You should check and review the privacy policy on all third party websites to ensure you are comfortable with third party cookies. We have no responsibility for linked websites, and provide them solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or warranties about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk. Once you leave the JAVLN ecosystem, your personal information will be governed entirely by the privacy policies and practices of those third parties.
JAVLN has appointed a Privacy Officer. You can contact our Privacy Officer at privacy@javln.com or at PO Box 6300, Victoria Street West, Auckland 1142, New Zealand.
To complain about how we have handled personal information, contact us with full details of your complaint and any supporting documentation at privacy@javln.com. If your information is held under Part B, contact your provider first. They hold the relationship with you and can usually resolve the matter more quickly.
When we receive a complaint, we acknowledge it within five working days, look into it, and give you a written response setting out our findings and any action we will take, normally within 30 days. If the matter is complex and we need longer, we will tell you why and when to expect our response.
If you are not satisfied with how we handle your complaint, you may complain to the applicable regulator. In New Zealand this is the Office of the Privacy Commissioner. In Australia this is the Office of the Australian Information Commissioner. Both accept complaints through their websites.
If you would like a copy of this policy in another format, such as a printed copy, contact our Privacy Officer and we will provide it free of charge. We also welcome feedback on this policy and take it into account when we review it.
We may change this policy from time to time. Where a change materially affects how we handle personal information, we will give at least 30 days’ notice before it takes effect, by posting a notice on our website and, where you are a contact at one of our customers, by email. Other changes take effect when they are posted.
We recommend you review the policy from time to time. If you deal with us directly and do not agree with an updated policy, please contact us, or stop using our services and our website.
Last updated: October 2026
