Privacy Policy

Effective 10 September 2026

1. About this policy

Your privacy is important to us. This policy explains how we collect, use, hold, share and protect personal information. We comply with the Privacy Act 2020 and the information privacy principles it contains.

Personal information means information about an identifiable individual.

2. Who this policy covers

This policy applies to the following companies, together referred to as "WMC Group", "we", "us" or "our":

Wheeler Motor Company Limited (NZBN 9429035539285) — vehicle sales
WMC Automotive Limited (NZBN 9429050888009) — servicing, WOF and import compliance
WMC Autobody Limited (NZBN 9429049140590) — panel and paint
Loki Holdings Group Limited (NZBN 9429047973787) — property
WMC Car Rental Agency Limited (NZBN 9429052498893) — vehicle rental and leasing

Physical office: 40 Disraeli Street, Addington, Christchurch 8024

We may share personal information between WMC Group companies where reasonably necessary for the purposes described in this policy — for example, so that a customer who buys a vehicle from Wheeler Motor Company can be serviced by WMC Automotive without re-supplying their details. Where information is held by one company on behalf of another, the company you dealt with remains your first point of contact.

This policy covers customers, prospective customers, suppliers, commercial tenants, job applicants and employees. It applies to our premises, our website at wheelermotors.co.nz, our social media pages, and our phone, email and messaging channels.

3. What information we collect

All customers and enquirers

Name, contact details, address
Identification, including driver licence details
Vehicle details and history
Records of your enquiries, correspondence and communications with us, including recordings of telephone calls (see section 15)

Vehicle purchasers and finance or insurance applicants

Date of birth, gender, residency and citizenship status
Employment and income details
Bank transaction data, where you use a bank statement verification service to provide us or a lender with your banking information. This includes your account balances and a history of transactions on the accounts you select, which may reveal information about your spending beyond your income and regular expenses.
Information relevant to your creditworthiness, including your income, expenses and existing credit commitments
Billing and payment information
Where you pay by cryptocurrency, your wallet address and transaction identifiers
Trade-in vehicle details

Servicing, WOF and import compliance customers

Vehicle identification, registration, odometer and service history
Vehicle diagnostic and fault data read from the vehicle
Compliance and certification records
Courtesy or loan vehicle records, including driver licence details

Panel and paint customers

Insurance claim and policy details
The circumstances of the incident giving rise to the repair
Photographs of the vehicle and the damage
Details of other parties involved, including third-party claimants and their insurers
Assessor and estimating records

Rental customers and drivers

Driver licence details for the hirer and any additional or authorised drivers, and the results of licence verification
Passport, visa or overseas licence details where you are a visitor to New Zealand
Rental agreement details, hire period, and vehicle condition and damage records
Payment card details and security deposit or pre-authorisation records
Records of infringement notices, tolls, road user charges and traffic offences incurred during the hire
Accident and incident reports, and insurance and excess claim details
Age and, where relevant, information relating to eligibility to hire

No GPS or telematics devices are fitted to our rental fleet, so we do not collect location or driving data from rental vehicles.

Commercial tenants

Contact details for tenants, prospective tenants, their directors and their nominated representatives
Financial information supplied in support of a lease application or a personal guarantee
Details of personal guarantors, including their contact details and the guarantees they give
Records of rent, outgoings, arrears and correspondence relating to the tenancy

Website visitors

IP address, device and browser identifiers, approximate location
Pages viewed, vehicles viewed, time on site, referral source
Information you submit through enquiry, finance pre-approval, valuation and booking forms
Cookie and advertising identifiers (see section 9)

Job applicants and employees

CV, employment history, qualifications and referee details
Right to work and identification documents
Driver licence and driving record
Results of reference checks, and where relevant to the role, credit and criminal record checks carried out with your authorisation
Payroll, tax, KiwiSaver and bank account details
Employment records, performance and disciplinary records, leave and health and safety records

If you choose not to give us information we ask for, we may not be able to answer your enquiry, assess an application, or supply our products and services.

4. How we collect information directly from you

We collect information directly when you contact us by phone, email, text, social media or our website; when you visit our premises; when you complete a form or application; and when you buy, sell, service, hire or repair a vehicle.

At or before collection, where reasonable, we will tell you why we are collecting the information, who may receive it, which WMC Group company will hold it, whether providing it is voluntary or legally required, and the consequences if you choose not to provide it.

5. Information we collect from other sources

We sometimes collect personal information about you from someone other than you. Where we do, and unless an exception in the Privacy Act 2020 applies, we will take reasonable steps to make you aware, as soon as reasonably practicable, of the following. These disclosures, together with this policy, form our notice to you:

That we have collected the information, and the purpose for which we collected it
The name and address of the WMC Group company collecting the information, and of the company holding it
The intended recipients of the information
Whether the collection is authorised or required by law, and if so under which law
Your right to access the information and to request its correction

We collect information indirectly from:

Waka Kotahi NZ Transport Agency and the Motor Vehicle Register — see section 7
Insurers and their assessors — where a repair is referred to WMC Autobody, we receive your details and claim information from your insurer
Other parties to an incident and their insurers — where a repair involves a third-party claim
Third-party listing and lead platforms — including Trade Me and social media lead forms, when you submit an enquiry through them
Finance and insurance providers — including decisions, settlement figures and policy details
Publicly available sources
Referees, previous employers and background checking providers — for job applicants, with your authorisation
Vehicle vendors and wholesalers — including previous registered owner details on vehicles we acquire

The collecting and holding agency in each case is the WMC Group company named in section 2 that you are dealing with, at the address given in that section.

6. Bank statement verification

Where you apply for finance, you may be asked to provide bank statements to verify your income and expenses. We use BankStatements, a service provided by illion Open Data Solutions Pty Ltd, an Australian company.

The service is not provided or authorised by your bank. It works by asking you to enter your internet banking login details into illion’s secure portal, which then retrieves your statements on a read-only basis. illion states that your credentials are encrypted, are not stored, and are discarded as soon as the connection to your bank is made, and that no transactions can be made using the service.

Before you use the service, you should check your internet banking terms and conditions. illion advises that your rights in relation to unauthorised transactions may be limited if you provide your online banking credentials to a third party. Using the service is your choice — if you would prefer not to, you can provide bank statements to us directly instead.

Where we send you the link to the service, we are the agency collecting your information. Where your lender sends it, they are. In either case we receive a copy of the report and hold it as described in this policy.

illion’s servers are located in Australia, so your banking information is held outside New Zealand. illion has its own privacy policy governing its handling of your information. The statement information we receive is used only to assess your finance application, is shared with the lenders considering your application, and is retained as set out in section 13.

7. Waka Kotahi and the Motor Vehicle Register

From time to time we obtain the names and addresses of registered owners, together with vehicle information and history, from Waka Kotahi NZ Transport Agency and the Motor Vehicle Register.

We are authorised to obtain and use this information for the following purposes only:

To confirm that a vendor is the registered person of a motor vehicle we propose to purchase
To assist in verifying that a change of registered person has been completed correctly for a transaction in which we are the purchaser or seller
Where a vehicle is the subject of a safety recall listed in the safety recalls portal, to contact the registered person to advise them of required actions relating to the vehicle’s safe operation

Our authorisation is held as a member of the MTA under the standard terms and conditions for motor vehicle traders, Gazette notice 2022-au4073.

You can notify the Registrar if you do not wish to have your name and address made available under an authorisation, at:
https://transact.nzta.govt.nz/transactions/PersonalInfoAccess/entry

8. How we use your information

We use personal information to:

Supply our products and services, and complete transactions
Respond to your enquiries and communicate with you
Assess applications for finance and insurance, verify your identity, and assess your financial position
Arrange vehicle registration, compliance and certification
Manage repairs, including liaison with insurers, assessors and suppliers
Assess eligibility to hire a vehicle, verify driver licences, and manage rental agreements
Recover rental charges, tolls, road user charges, damage costs and insurance excesses
Identify the driver responsible for an infringement offence incurred during a hire, and transfer liability for that infringement to them
Assess lease applications and personal guarantees, and administer commercial tenancies
Send service, WOF and warranty reminders
Send you marketing communications where you have consented (see section 9)
Send post-sale surveys and newsletters
Confirm the registered owner of a vehicle we have bought or sold, and manage safety recalls
Train our staff and monitor the quality of our service, including through the review of recorded calls
Investigate incidents, complaints and disputes
Improve our products and services, and conduct market research and statistical analysis
Operate, secure and improve our website and online advertising
Assess job applications and manage employment
Protect the safety and security of our people, customers and property
Exercise our rights and meet our obligations under any agreement with you
Meet any purpose required or authorised by law, or any other purpose we tell you about at the time we collect the information

We may aggregate or anonymise information so it no longer identifies you, and use that for analysis and reporting. We do not sell your personal information.

9. Marketing, our website and online advertising

Email and text marketing. Where you have consented, we send you messages about our products and services, and those we think may interest you, by email and text. Every message identifies us as the sender and includes an unsubscribe option. You can opt out at any time using that option or by contacting our Privacy Officer. Service reminders and messages that relate to a transaction you have entered into with us are not marketing and will continue.

Cookies and similar technologies. Our website uses cookies and similar technologies. These fall into three groups: strictly necessary cookies that make the site work; analytics cookies that tell us how the site is used; and advertising cookies that support the advertising described below. You can control cookies through your browser settings and through the cookie banner on our site, though blocking some cookies may affect how the site works.

Analytics. We use Google Analytics to understand how visitors use our website. This collects your IP address, device and browser information, the pages and vehicles you view, and how you arrived at our site.

Online advertising and remarketing. We use Google Ads and the Meta advertising platforms (Facebook and Instagram). These use tracking technologies on our website to measure the performance of our advertising and to show you our advertising on other websites and platforms after you have visited ours. This is known as remarketing or retargeting.

Customer list matching. We may provide customer contact details — such as email addresses and phone numbers, in an encrypted or "hashed" form — to Google and Meta so that we can show advertising to existing customers, or to people with similar characteristics, and so that we can avoid showing advertising to people who have already purchased. These platforms are located overseas. You can control how these platforms use information about you through your Google Ads settings and Meta ad preferences, and you can ask us to exclude you from this activity by contacting our Privacy Officer.

Third-party listing platforms. We list vehicles on third-party platforms including Trade Me. When you submit an enquiry through one of these platforms, or through a lead form on social media, that platform passes your details to us. Those platforms handle your information in accordance with their own privacy policies and legal obligations.

Social media. When you interact with our social media pages, the platform collects information about that interaction under its own privacy policy. We use the information you send us to respond to you.

10. Who we share your information with

Besides our own staff and the WMC Group companies named in section 2, we share personal information with:

Waka Kotahi NZ Transport Agency and other regulatory agencies
Our franchise partners
Finance providers and insurers, where you are applying for or holding their product. Where you apply for finance through us, we may send your application to more than one lender. Each lender carries out its own assessment, which will usually include obtaining a credit report about you, and each has its own privacy policy. We do not obtain credit reports ourselves.
illion Open Data Solutions Pty Ltd, where you use the bank statement verification service described in section 6
Insurers, assessors and estimating platforms, in connection with repairs
Enforcement authorities, including the Police and local authorities, where we are required or permitted to identify the driver of a rental vehicle in relation to an infringement offence
Tolling and road user charge operators
Our marketing partners, including our advertising agency, email and text messaging platform, CRM provider and the advertising platforms described in section 9
Our IT and software providers, including our dealer management system, workshop management system, telephone system and accounting system
Our professional advisers, including lawyers, accountants and auditors
Debt collection agencies, where an account is overdue or rental charges, damage costs or infringements are unpaid
Police and other law enforcement agencies, and other parties where disclosure is required or authorised by law

Some third parties that receive personal information from us will handle that information in accordance with their own privacy policies and legal obligations.

11. Sending information outside New Zealand

Some of the service providers and platforms we use store or process personal information outside New Zealand, including in Australia, the United States and the European Union. This includes our cloud software providers, illion Open Data Solutions Pty Ltd, and the advertising platforms described in section 9.

Before disclosing personal information to an overseas recipient, we will ensure there is a lawful basis for the disclosure under the Privacy Act 2020, including where required that the recipient is subject to comparable privacy safeguards or has agreed to protect the information in a comparable way.

12. How we keep your information safe

We take reasonable steps to protect personal information against loss, unauthorised access, use, modification or disclosure. These include access controls and permissions in our systems, secure storage of physical records, restricted access to our premises, staff training, confidentiality obligations, and contractual requirements on our service providers.

We restrict access to finance application material, including bank statement verification reports, to staff who need it to assess or process your application.

No system is completely secure. Where a privacy breach is notifiable under the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable.

13. How long we keep your information

We keep personal information only as long as we need it for the purposes described in this policy, or as required by law. In practice:

Transaction, finance, accounting and tax records: generally up to at least 7 years, where required for tax, accounting, consumer finance, dispute resolution or other legal and business purposes
Bank statement verification reports: 90 days from the date of the finance decision, after which they are securely deleted. We retain a record that verification was completed and the figures relied on.
Service and repair records: retained for the life of our relationship with the vehicle and for warranty purposes
Rental agreements, driver identification, infringement and incident records: retained for the period reasonably required to administer the rental, deal with infringements, insurance, claims or disputes, and meet legal and accounting requirements
Commercial tenancy records, including guarantees: retained for the term of the lease and for the period afterwards reasonably required to deal with claims and meet legal and accounting requirements
Telephone call recordings: 12 months
CCTV footage: see section 14
Job applicant records: 12 months from the close of recruitment
Employee records: as required by the Employment Relations Act 2000, the Holidays Act 2003 and health and safety legislation

When we no longer need information, we securely destroy or de-identify it.

14. CCTV

We operate CCTV cameras at our premises to protect property, and to provide a safe and secure environment for employees, customers and visitors. Signage is displayed at our premises where CCTV is in operation. We do not use covert cameras.

Our cameras record images only. They do not record audio. We do not use facial recognition or other biometric technology.

Recorded images are held securely and are usually deleted after 28 days. Footage may be kept longer where it is being used to investigate an incident or a crime, or where it is required by law enforcement, regulatory bodies or our insurers.

Footage is only accessed or disclosed where reasonably necessary for the purposes for which it was collected, or where otherwise permitted or required by law. Disclosure is limited to:

Police and other law enforcement agencies, for the detection of crime, to identify and prosecute offenders, or to identify victims or witnesses
Prosecuting agencies such as the Crown Law Office
Legal representatives
Managers dealing with internal employment matters
Insurers and regulatory bodies such as WorkSafe
Individuals whose images have been recorded, unless disclosure would prejudice a criminal investigation or prosecution

15. Call recording

We record incoming and outgoing telephone calls on our business lines. Calls are recorded for training, quality assurance, and to keep an accurate record of what was discussed.

You are told at the start of the call that it is being recorded. If you would prefer not to be recorded, you can ask us to continue the discussion by email instead.

Recordings are held securely, access is restricted to staff who need it for the purposes above, and they are retained as set out in section 13.

16. Job applicants and employees

We collect and use information about job applicants to assess suitability for a role, and about employees to manage the employment relationship, meet our obligations as an employer, and comply with tax, payroll, health and safety and employment law.

Reference, credit and criminal record checks are carried out only with your authorisation, and only where relevant to the role. We share employee information with our payroll provider, KiwiSaver scheme providers, Inland Revenue, ACC, and our insurers. Unsuccessful applicants’ information is held for 12 months and then destroyed, unless you ask us to keep it on file.

Our premises are monitored by CCTV, and calls on our business lines are recorded, as described in sections 14 and 15. Employees are told which areas and lines are covered, and monitoring is used only for the purposes set out in this policy.

17. Accessing and correcting your information

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if you think it is wrong.

Contact our Privacy Officer using the details in section 20. We may need to verify your identity before releasing information. We will respond within 20 working days of receiving your request. In limited circumstances the Privacy Act allows us to withhold information or refuse a request; if we do, we will tell you why.

If we do not agree to correct information, you can ask us to attach a statement to our records recording that you sought a correction and it was not made.

18. Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint and aim to resolve it promptly.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:

Website: www.privacy.org.nz
Phone: 0800 803 909
Email: enquiries@privacy.org.nz
Post: PO Box 10094, Wellington 6143

19. Changes to this policy

We may update this policy from time to time. The current version is always available at www.wheelermotors.co.nz, and the effective date is shown at the top. Where changes are significant, we will take reasonable steps to bring them to your attention.

20. Contact us

Privacy Officer, WMC Group
Will Hayde — General Manager
privacy@wheelermotors.co.nz
03 366 6369
40 Disraeli Street, Addington, Christchurch 8024
PO Box 7536, Sydenham, Christchurch 8013