Privacy Policy

1. Responsible organisation and scope

BLAQSTONE BEGIN is a proposed engineering information platform for civil contractors, testing laboratories, suppliers and authorised project stakeholders. The legal operating entity and physical or postal address are to be inserted following owner confirmation. This notice covers the public website and intended member services, including documents and supplier collaboration.

Customer organisations control the project information they submit through authorised customer services. Separately, BLAQSTONE may use an internal RAMM workbook tool only for its own authorised projects; that tool is not offered to customer accounts or subscriptions. Private road asset workbooks may contain spreadsheet macros, contact details and embedded metadata, which require security scanning, restricted storage and protected audit history before use. Depending on the data and contract, BLAQSTONE may act as an independent agency for account operations or as a service provider processing information on a customer's instructions. Those responsibilities must be confirmed in customer terms and data-processing agreements.

2. Information we may collect

Public enquiries may include name, business contact information, organisation, service interests, enquiry text and limited anti-abuse information. Members may additionally provide identity and authentication records, role permissions, invoicing references, subscription status and activity logs.

If enabled and expressly authorised, customers may upload tenders, project specifications, laboratory certificates, drawings, ITPs, health and safety records, subcontractor information and supplier requests. Documents may include personal information about workers or third parties. Only information necessary for the contracted function should be provided.

Payment card details should be entered only into an approved payment provider's hosted interface, not BEGIN contact forms or project documents.

3. How information is used

Intended purposes include responding to enquiries, provisioning and securing accounts, confirming subscription entitlements, providing selected engineering software services, keeping an auditable record of document versions and user actions, handling support and privacy requests, investigating misuse and complying with applicable laws.

Marketing communications are a separate choice, not a condition of making an enquiry. Communications about a requested service, account security or billing are not treated as promotional consent.

4. Engineering data, laboratories and evidence

Original laboratory reports are to be stored unchanged, including their issuer details, branding, report numbers, issue dates, signatures and file checksums. Data extracted for assessment will be stored separately and linked to the source. A contractor chooses which laboratory and supplier receives each authorised request. The platform must not distribute confidential customer documents to other customers or suppliers without authorisation.

Access to standards and specification references is restricted according to the applicable contracts and copyright licences. Customer access to an assessment is not an entitlement to download protected standards.

5. Who may receive information

Information may be shared with contracted hosting, identity, payment, email delivery, OCR, AI processing, security and support service providers strictly as required for approved purposes, and with laboratories, suppliers, clients or engineers only when the customer authorises that specific participation. Disclosures may also occur where law requires or permits them.

Provider names, processing countries, contractual roles and subprocessors will be published or made available before production operation. We do not propose selling customer engineering documents or contact details to advertisers.

6. AI use and engineering decisions

AI-assisted document classification, text extraction, requirement discovery and explanatory drafting are planned. Exact engineering acceptance decisions must use separately reviewed and versioned rules. AI output may contain errors or uncertain extractions and must not be regarded as engineering certification, contractual approval or a substitute for competent engineering review.

Before processing personal or confidential project data with any model provider, BLAQSTONE must verify contractual confidentiality, training-use restrictions, appropriate retention, access controls and cross-border safeguards. Customer documents will not be intentionally used to train public foundation models without an expressly authorised arrangement. This statement is an intended operational control, subject to provider verification.

7. Overseas storage and processing

Cloud hosting, payment, email, OCR or AI providers may operate outside New Zealand. The applicable hosting regions and cross-border transfers will be recorded for each approved provider. BLAQSTONE must apply Privacy Act 2020 information privacy principle 12 where disclosure to a foreign recipient is involved, including comparable safeguards or valid authorisation where necessary. This site does not claim NZ-only hosting.

8. Security and access

Planned controls include MFA, unique organisational identities, least-privilege role permissions, tenant separation, encrypted connections and stored data, private original-file access, upload scanning, integrity checks, audit logs, monitoring, backups, secure deletion and incident response. No claim is made that an external security certification or penetration test has yet been completed.

9. Retention and deletion

Information should be kept only as long as necessary for the relevant service, contract, legitimate recordkeeping and applicable legal obligations, then securely removed or de-identified. Enquiries that do not lead to membership, identity records, customer project evidence, immutable audit records and financial records may require different retention periods. Binding durations, archive controls, customer export rights and legal holds will be established in the approved retention schedule before launch. Deletion of project evidence must respect contractual and legal requirements and must not silently alter laboratory originals.

10. Access and correction

Individuals may ask for access to or correction of their personal information under the New Zealand Privacy Act 2020. We will verify identity before releasing or changing information. Corrections to extracted records must not change an original third-party certificate. Requests about project records may require coordination with the customer organisation that controls them.

11. Information collected indirectly: IPP 3A

Project documents may identify people who did not supply information directly to BLAQSTONE, such as testing staff, subcontractors and authorised signatories. Where information is collected indirectly, BLAQSTONE will evaluate its obligations under Information Privacy Principles 2 and 3A, effective 1 May 2026, and take reasonable notification steps unless an exception applies. Customer contracts must identify responsibilities for notifications, relevant purposes, recipients and access/correction rights.

12. Privacy incidents and serious breaches

If a breach creates or is likely to create serious harm, the responsible organisation must notify the Office of the Privacy Commissioner and affected people as soon as practicable, subject to applicable statutory exceptions. The Commissioner's guidance expects notification ideally within 72 hours of awareness. Investigation, containment, records and escalation arrangements must be established before live customer processing.

13. Technical logs, cookies and analytics

Essential cookies or tokens may be required for sign-in, account sessions, load balancing and security. Limited server-side logs may record technical details necessary to detect abuse. Non-essential analytics or advertising tracking must be separately disclosed and governed appropriately before being enabled. This protected development site is not intended for behavioural advertising.

Member feature-demand measurement (planned): When active paying members view an optional HSQE tool card or select “I'm interested”, the platform will record the feature name, the event type, its time and their verified account and organisation identifiers. No email address, personal name, document text or IP address is included in this analytics event table. Only authorised BLAQSTONE staff will access member or organisation identifiers for research and follow-up; aggregate reports count unique organisations and members to avoid overstating interest through repeat clicks. These first-party events are for product planning, not an order, marketing consent or proof that a service is active. Raw event retention and account deletion procedures require approval before customer activation. Members will be informed when this feature starts and may request access or correction under the Privacy Act 2020.

14. Privacy enquiries, complaints and policy updates

A privacy-specific category is included in the Contact workflow. The final privacy officer contact details and operating entity address will be confirmed before the form is opened to customers. People can also contact the Office of the Privacy Commissioner where appropriate. Material changes to this policy will be versioned and notified as required.