Política de privacidad

Summary: What You Need to Know

This summary gives you the key points. The full policy below has all the details.

1. About This Policy

This Privacy Policy explains how Kahu Group Limited (we, us, our, or Kahu) collects, uses, stores, discloses and protects personal information about you when you use the Kahu application for iOS and Android (the App), our website at kahu.dog (the Website), the services behind them, and when you otherwise interact with us.

We collect only the information we need to provide the App and the Website, we handle it responsibly, and we never sell it.

This policy applies to all users of the App and the Website, regardless of where they are located. It is intended to comply with the Privacy Act 2020 (New Zealand). If you are located outside New Zealand, additional rights may apply under the laws of your jurisdiction. Section 18 sets out further information for users in certain jurisdictions, but we do not represent that this policy complies with the laws of every jurisdiction.

Who we are: Kahu Group Limited is incorporated in New Zealand (NZBN 9429053567536) and our registered office is at 210 Oraha Road, RD 2, Kumeu 0892, New Zealand. We are the agency responsible for your personal information under the Privacy Act 2020. Our representative in the European Union and in the United Kingdom is Data Protection Representative Limited (trading as DataRep) (see section 18.2). We are not required to appoint a data protection officer; our privacy contact is privacy@kahu.dog.

Contact us: For any privacy-related questions or requests, email privacy@kahu.dog. We will respond as soon as reasonably practicable and within the timeframes required by applicable law.

1.1 What This Policy Does Not Cover

Third-party services. This policy does not apply to third-party websites, maps, app stores or payment providers that you access through the App or the Website. See section 15.

The Terms of Service. The Terms of Service govern your use of Kahu. This policy explains how we handle personal information. The Kahu pledge you make during onboarding is a welfare commitment and is not a consent to the handling of personal information.

1.2 Key Terms

2. What Personal Information We Collect

2.1 Personal Information You Give Us

We collect the following personal information directly from you. Where information is optional, you may choose not to provide it, but the related feature may not function.

• Account information: your name, email address and whether it has been verified, password (stored in hashed form), username, profile photo (optional), date of birth or age confirmation, and the date on which you accepted the Terms of Service and acknowledged this policy.
• Profile and preference information: timezone, language, country, currency, units and date formats, notification preferences, feature interests, onboarding answers, journey stage, and your mailing address and phone number if you choose to add them.
• Family information: the Family name, the people you invite, their roles, whether an invitee is aged 13 to 17, and your confirmation that you hold parental or guardian authority for that person.
• Pet profile information: your dog's name, species, breed or mix, birthday, sex, weight, photo, microchip number, travel passport number, temperament, conditions, allergies, diet and goals. Name and species are required; the rest is optional.
• Care record information: training sessions and progress, enrichment, walks and activities (see section 6 for GPS routes), daily check-ins, weekly checkups including body-area findings and a triage tier, weights, meals and meal plans, pantry items, grooming, vet visits, vaccinations and certificates, treatments, prescriptions, diagnoses, laboratory results, incidents, emergencies, behaviour flags, consent events, amendments and notes. The checkup triage tier is computed from the flags you select and is not a veterinary diagnosis.
• Photos and files: pet and profile photos, care photos, checkup finding photos, vaccination certificates and consent attachments you upload.
• Emergency contacts: the name, phone number, role and notes for the people you want contacted in an emergency.
• Saved places and providers: veterinary clinics and service providers you save as Regulars.
• Insurance information: policy details, premiums and claim amounts you enter. We do not connect to insurers.
• Advisor conversations: the messages you send, the responses, and a log of which parts of the care record the Advisor read to answer you.
• Breed favourites and quiz answers: breeds you favourite and your lifestyle quiz answers.
• Communications: Issue Reports you send from the App, emails you send to support@kahu.dog or privacy@kahu.dog, and feature suggestions you submit.
• Waitlist information (Website): your name, email address, closed test or public launch preference, test platform and, if you provide them, the Apple ID or Google account email we should invite.
• Journey questionnaire (Website): your answers to the questionnaire at kahu.dog/start, and the account information above if you create an account during that flow. Until you create an account, your answers are held only in your browser's local storage and are not sent to us; breed names you search for are sent to our servers to return matches but are not stored against you. When you create an account, the answers are saved to it. If you leave without creating an account, clearing your browser storage removes them.

2.2 Personal Information Collected Automatically

We automatically collect the following personal information:

• Session and security information: IP address, device and browser type, App version, time of last activity and sign-in events, used to keep you signed in, detect misuse and protect accounts.
• Push notification token: the token your device provides so that we can deliver notifications you have enabled, together with device type and name. Signing out of the App on a device stops notifications to that device.
• Location information: precise location, only where you have granted permission on your device, for walk tracking (including in the background while a walk is being recorded, if you allow it), nearby searches and driving time to a saved clinic (see section 6). The Website reads the country of your connection to select a default language and currency and does not store it against you.
• Crash diagnostics: if the App crashes or hangs, our error tracking provider receives a crash report containing device and App metadata. Default collection of personal information by that provider is disabled. The App may also upload a first-party Issue Report, which may be anonymous. Crash diagnostics are not used for analytics or marketing.
• Synchronisation state: revision stamps that tell the App what has changed since it last checked.
• Website analytics: page analytics on the Website, only if you accept the cookie banner (see section 11).
• Website abuse limits: your IP address, held for up to one hour, to limit repeated form submissions.

We do not run a product analytics SDK in the App, we do not collect advertising identifiers, and we do not use session replay. Aggregate counts we use internally (for example, how many Families logged a checkup in a week) exclude demonstration accounts and are not shared.

2.3 Information From Third Parties

We also collect personal information from third parties where permitted by law. Where we do so, we will comply with our notification obligations under the Privacy Act 2020.

• Sign-in providers: if you sign in using Sign in with Apple or Google, we collect basic profile information from that service, such as your name and email address (or, for Apple, a private relay address), as permitted by your settings with that service. We do not receive your password from third-party sign-in providers.
• Your Family: information other Family members log about your shared Pets, and the invitation an Admin sends you, including the inviter's name and email address.
• People who add you: your details, where another user adds you as an emergency contact or co-carer (see section 2.4).

2.4 Information About Other People

Kahu is designed for households, so you may provide us with personal information about other people, for example when you invite a partner, flatmate or teenager to your Family, add an emergency contact, record a dog walker or vet, or enter a co-owner's name in an insurance record.

Where you provide us with personal information about another person, you confirm that you are authorised to do so for the purposes described in this policy, that you have told the person their information will be held by Kahu, and that you have referred them to this policy. If you are in New Zealand, you must comply with the Privacy Act 2020 to the extent it applies to you. We use that information only for the purpose for which you provided it, such as delivering an invitation, contacting the person in an emergency, or maintaining the record you asked for.

If another user has added your details to Kahu and you would like them removed, contact privacy@kahu.dog.

3. Why We Collect and How We Use Your Personal Information

We collect and use personal information only for lawful purposes connected with our functions and activities, and only to the extent reasonably necessary for those purposes. We will use your personal information for the purposes for which it was collected, or for related purposes that you would reasonably expect, unless otherwise permitted by law.

3.1 To Provide the App and Our Services

We collect your personal information primarily to provide the App, the Website and their features, including:

• creating and managing your account and your Family;
• maintaining your Pets' care records and allowing the members of your Family to share them;
• delivering training and wellness content, reminders and progress reports;
• operating the emergency flow and displaying your emergency contacts;
• synchronising the App between your devices;
• generating Advisor responses and structuring the notes you type (see section 5);
• managing your Family's Kahu Premium status; and
• sending you service-related communications, such as invitations, email verification and change-of-email confirmations, password resets, account deletion notices and billing notices.

3.2 To Keep Accounts and Systems Secure and to Fix Faults

We use session and security information, Issue Reports and crash diagnostics to detect and prevent misuse, enforce the Terms of Service, limit abuse of our forms, investigate problems and fix faults.

3.3 To Communicate With You

We send service communications, and care reminders you have enabled, as part of providing the App. Safety and emergency notifications may still be sent when other notification categories are turned off.

With your consent, we may also send you:

• product update and tip emails; and
• marketing push notifications about new features or Kahu Premium.

Both of these are turned off by default. You can turn them on or off at any time in the App under Profile, Privacy settings, or by using the unsubscribe link in any marketing email.

If you join the waitlist on the Website, we will use your details to confirm your place and to tell you about the closed test or public launch.

3.4 To Improve the App and the Website

We use aggregated information about how the App is used, with demonstration accounts excluded, to understand which features help people and to prioritise improvements. We do not use third-party analytics in the App. On the Website, we use analytics only if you accept analytics cookies (see section 11).

3.5 To Meet Legal Obligations and Protect Rights and Safety

We may use personal information to respond to rights requests, keep records the law requires us to keep, respond to lawful demands, establish or defend legal claims, and prevent serious harm to a person or an animal.

3.6 Summary of Purposes and Legal Bases

The table below summarises the purposes above, the categories of information used, and the legal basis we rely on where the UK GDPR or EU GDPR applies (see section 18). Users in New Zealand may disregard the legal basis column; under the Privacy Act 2020 the relevant disclosure is the purpose.

3.7 No Sale of Personal Information

We do not sell, rent or trade your personal information to any third party. We do not use your data for advertising purposes, we do not build advertising profiles, and we do not allow third-party advertisers to collect data through the App or the Website. We do not train artificial intelligence models on your content. We do not make decisions about you by solely automated means that have legal or similarly significant effects on you.

4. How We Share Your Information

We will only disclose your personal information for the purposes for which it was collected, or for related purposes that you would reasonably expect, unless otherwise permitted or required by law.

4.1 Within Your Family

Pets and their care records belong to the Family rather than to an individual. Admins and Members can see the whole care record and add to it. A Guest can see the care record while their access window is open and can edit only entries they created; when the window closes, their access ends. Certain medical-grade entries can be changed only by certain roles.

Everyone in a Family can see the display name of the person who logged each entry. If a Member leaves the Family or deletes their account, their first name may remain on the entries they logged so that the rest of the household can continue to read the Pet's history. Their email address, password and login identity are removed (see section 13).

Youth Members. A Youth Member can log training, practice and other non-medical care. By default, a Youth Member cannot create or change medical-grade entries or emergencies, cannot see or use the Advisor, cannot manage billing or insurance, cannot delete a Pet or the Family, and cannot be made an Admin while under 18. These limits are enforced on our servers.

Nothing is public. There is no public profile, no profile search and no public feed. Content does not leave your Family unless you take a specific action to share it.

4.2 Outside Your Family

The App does not share your Pet's records with anyone outside your Family. If we add a way to share records with a carer, a professional or a clinic, it will be a deliberate action you take, this policy will be updated first, and nothing you have already entered will be shared without that action.

4.3 Service Providers

We share personal information with trusted third-party service providers who help us operate the App and the Website. These providers are required to protect your personal information and may only use it for the services they provide to us. They include:

We intend to update this table as we add or change service providers. A current list is published at kahu.dog/privacy/subprocessors and is available on request. Replacing a provider with another performing the same function updates the list; adding a new kind of processing updates this policy.

4.4 Business Transfers

If Kahu is involved in a merger, acquisition or sale of all or part of its assets, your personal information may be transferred as part of that transaction. Where this occurs, we will take reasonable steps to ensure your personal information continues to be protected in a manner consistent with this Privacy Policy and applicable privacy law, and we will notify you before the transfer where reasonably practicable.

4.5 Legal Requirements

We may disclose your personal information if required to do so by law, including where a court or regulator compels disclosure, or where disclosure is necessary to protect the rights, property or safety of Kahu, our users, an animal in their care, or others. Our practice is to disclose the minimum necessary and, where the law allows, to notify you first.

4.6 Aggregated Data

We may use and share aggregated, anonymised data about App usage for research, industry reporting or marketing purposes. This data cannot be used to identify you or your dog.

5. Artificial Intelligence Features

5.1 What Uses AI

• The Advisor: a chat feature in the App that answers care questions using the published breed encyclopedia, the selected Pet's Meal Plan when you ask about feeding that dog, and a limited, permission-filtered part of your Pet's care record.
• Structuring free text: when you type a note (for example, "gave Jett his flea tablet this morning"), a model converts it into a structured entry for you to confirm. The text you typed and your Pet's name and species are sent for this purpose.
• Content Studio (staff only): our editors use models to draft and illustrate the training and wellness library. Your personal information is not involved.

5.2 How Your Information Is Handled

• Your messages, the published encyclopedia text used for a breed answer, the Meal Plan read for a feeding question, and the part of the care record the Advisor retrieves, are sent through Vercel AI Gateway to a model provider (see section 4.3) to generate the response. We keep a log of which care record entries were read, and the Meal Plan read joins that same context-access log, so that you can see it and we can audit it.
• The provider may use your content only to generate the response. We do not train our own models on your content, and every request we send through the Gateway is restricted to providers that have agreed not to train on it. Providers may hold your content briefly for abuse monitoring and legal compliance under their own terms.
• Advisor use is metered per Family (5 messages per month on the free tier and 150 per month on Kahu Premium, as a fair use allowance). Metering is enforced on our servers.
• Youth Members cannot use the Advisor. The server refuses requests and the entry point is hidden.
• You can delete a conversation at any time from the Advisor history (press and hold it). Conversations are otherwise kept until your account is permanently deleted (see section 13).

5.3 What Our AI Does Not Do

• It does not diagnose, treat or prescribe. It is not a veterinarian and is not an emergency service. For urgent symptoms, use the emergency flow or contact a clinic.
• It does not make decisions about your account, your Family or your access.
• It does not read entries your role cannot see.
• It does not run in the background. Nothing is sent to a model unless you send a message or ask for a note to be structured.
• It does not compute the weekly checkup triage tier, which is determined by fixed rules applied to the flags you select.

Further information is published at kahu.dog/ai, and this section will be kept consistent with it.

6. Location Information

• Walk tracking: if you start a tracked walk or hike and allow location access, the App records the route as a series of GPS points, together with distance and time, and saves it to the activity in your care record. While that recording is in progress, the trail continues when the screen locks or you leave the App, and stops when you end the recording. A force-quit stops it. Kahu does not ask for location all the time. On Android, a persistent notification shows while recording continues in the background. Routes are visible to your Family only. If location access is off, distance is not updated and no route is stored. If the trail cannot continue after you leave, tracking pauses until you come back.
• Nearby vets and places: if you allow it, your device's location is used to search for clinics and places near you. The search location is not saved to your account.
• Driving time to a clinic: when a vet visit is coming up, the App may send your current location and the clinic's location through our servers to Google to estimate driving time. The estimate is cached on your device for a short period and is not saved to your account.
• Home address: if you enter a home address, the text you type is sent through our servers to Apple's address search service to suggest matching addresses. Only the address you choose is saved to your profile.
• Steps: if you allow motion access, step counts are read from your device's pedometer and are not shared beyond your Family.
• Website: our hosting provider reports the country of your connection so that we can select a default language and currency. We do not store it against your name or email address.

Permission for precise location is granted through your device's operating system prompt. You may withdraw it in your device settings at any time; the related features will stop working and nothing else changes.

7. Payments and Kahu Premium

Kahu offers a free tier and Kahu Premium, which applies to the whole Family.

During the beta period, every Family has Kahu Premium by default. No purchase is involved, no payment information is collected, and no subscription record is created. Before any payment is taken, this policy will be updated to describe the payment providers involved and what we receive from them, and we will notify you. A lapsed subscription will never lock or hide existing care data.

8. International Data Transfers

Kahu is based in New Zealand. Our primary database and our crash diagnostics are hosted in the European Union (Frankfurt, Germany). Most of our other service providers, including our hosting, sign-in, email, push notification, maps and AI model providers, are located in the United States. Your personal information will therefore be held and processed outside New Zealand.

When we transfer personal information outside New Zealand, we do so in accordance with the Privacy Act 2020, including by taking reasonable steps to ensure that the recipient is bound by contract to protect the information in a way that, overall, provides comparable safeguards to the Privacy Act 2020, or that the recipient is in a country the Privacy Act 2020 recognises as providing comparable protection, or where another permitted basis for disclosure applies. Transfers from the United Kingdom and the European Economic Area are addressed in section 18.

You can contact us for more information about how we handle international disclosures at privacy@kahu.dog.

9. Data Retention

We retain your personal information only for as long as it is required for the purposes for which it may lawfully be used, including while your account is active and for a reasonable period afterwards to handle any outstanding requests, disputes or legal obligations. Specifically:

When we delete data, we take reasonable steps to ensure it is securely deleted or de-identified and require our service providers to do the same.

10. Security

We take the security of your personal information seriously. Our security measures include:

• encryption of data in transit using TLS (Transport Layer Security);
• encryption of data at rest, as a platform default of our database and file storage providers;
• storage of passwords in hashed form only;
• role-based access controls limiting which staff can access personal information, and role-gated administrative tools; and
• procedures for detecting and responding to security incidents.

No Kahu staff member accesses your care record or Advisor conversations except for limited purposes: to fix a fault you have reported, to investigate misuse or a safety risk, or where required by law. Where we need to open your record to help you, we will ask first unless it is an emergency.

No method of transmission over the internet or electronic storage is 100% secure. While we use reasonable measures to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact privacy@kahu.dog immediately.

In the event of a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and affected individuals in accordance with the Privacy Act 2020, and any other regulator as required by applicable law, unless an exception applies.

11. Cookies and Tracking

11.1 What We Use

The App does not use cookies. Your sign-in session is held in your device's secure credential store.

The Website uses the following cookies and similar technologies:

11.2 Managing Cookies

We ask before setting analytics cookies. Until you accept, Google Analytics runs in a cookieless mode that may count a visit without identifying you. Accepting allows analytics storage so that we can see which pages help people, including a waitlist sign-up. Rejecting keeps analytics off and removes any analytics cookies already set. You can change your choice at any time from Cookie settings in the Website footer. You can also configure your browser to block or delete cookies, but this may affect the functionality of the Website. We do not use advertising cookies.

If you are located outside New Zealand, additional requirements may apply to the use of cookies and similar technologies under the laws of your jurisdiction.

12. Children's Privacy

• A Family Admin must be 18 or over. We ask for a date of birth or age confirmation before a Family is created.
• People aged 13 to 17 may hold an account only as a Youth Member, and only when an Admin invites them and confirms that they hold parental or guardian authority for that young person. We record that confirmation. Youth Members have the limits described in section 4.1 and cannot use the Advisor.
• The App is not intended for use by children under 13, and we do not intend to collect personal information from children under 13. There is no invitation path that creates an account for a child under 13. A younger child may take part under a parent's supervision using the parent's device and account.
• If we become aware that we have collected personal information from a child under 13, or from a person aged 13 to 17 without the required confirmation, we will take reasonable steps to delete or de-identify that information, unless we are required to retain it by law.
• Household onboarding questions about children in the home describe the dog's environment and do not create child accounts.
• Where you live, the age at which a young person can agree to an online service on their own may be anywhere from 13 to 16. We do not rely on that: every Youth Member must be invited by an adult Admin and confirmed by a parent or guardian.

If you are a parent or guardian and wish to review or remove a Youth Member's information, you may do so as the Family Admin, or by contacting privacy@kahu.dog.

13. Account Deletion

You can request deletion of your account at any time in the App under Profile, Privacy settings, or by emailing privacy@kahu.dog. The process is as follows:

1. You confirm the request by typing DELETE.
2. If you are the only Admin of a Family with other members, you must transfer the Admin role to another member first. The App will tell you if this applies.
3. Your account enters a pending deletion period of 30 days. We sign you out of all devices. Signing in again does not cancel the deletion; you will see a countdown and a Cancel deletion and restore option. During this period your account can only be restored or have its status viewed.
4. We email you when deletion is requested (with the deletion date), before permanent deletion, if you restore your account, and when permanent deletion is complete.
5. After 30 days we permanently remove your login identity and personal contact details. If you were the only member of a Family, the Family and its Pets are deleted with your account.
6. If other members remain in your Family, the Pets' care records remain with them. Your first name may remain on entries you logged so that the household can continue to read the Pets' history. Your email address, password and login identity are removed.

Certain information may be retained after deletion where required or permitted by law, as described in section 9.

14. Your Rights (including Complaints)

You have rights over your personal information. These rights are primarily provided for by the Privacy Act 2020 and, in relation to electronic marketing communications, the Unsolicited Electronic Messages Act 2007. In general, you can:

To exercise any of these rights, use the in-App controls above or contact us at privacy@kahu.dog from the email address on your account. We will respond as soon as reasonably practicable and within the timeframes required by the Privacy Act 2020, and in any event within 20 working days unless we notify you that we need more time and why. We may need to verify your identity before processing your request. Requests from one Family member are treated as individual requests; we do not release another adult's account information to you. You may authorise an agent to act for you with written authority. We will not treat you differently for exercising your rights.

We will not charge you for making a request unless permitted by law, in which case we may charge a reasonable fee or decline the request. If we decline a request we will tell you why and how to challenge the decision.

If you are not satisfied with our response to your privacy concern, you may make a complaint to the Office of the Privacy Commissioner (privacy.org.nz or 0800 803 909).

14.1 Your Controls in the App

15. Third-Party Links and Services

The App and the Website may contain links to third-party websites, resources or services, including maps, app stores and payment providers. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party service you access through the App or the Website.

If we later integrate with veterinary practice software, service professionals or other pet care services, we will update this policy and, where required, notify you or seek your authorisation before sharing your personal information with them.

16. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our practices, the App's features or applicable law. When we make material changes, we will:

• notify you through the App before you continue, and by email where reasonably practicable, at least 30 days before a material change takes effect and at least 14 days before a minor one, unless a change is urgently required by law;
• update the Effective Date and Last reviewed dates at the top of this policy and record the change in the version history; and
• for significant changes, seek your authorisation where required by law.

New processing described in a change begins only after the notice period ends. If we wish to use personal information for a new purpose that is not directly related to the purposes in section 3, we will seek your authorisation before doing so, and personal information collected before the change will not be used for the new purpose without that authorisation. Choices you have made, such as opting out of marketing, retain their scope.

Previous versions of this policy are available at kahu.dog/privacy/versions, and a PDF of the current version, and of each earlier version, can be downloaded from kahu.dog/privacy/kahu-privacy-policy.pdf and from the version history page. Your continued use of the App after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the App and the Website, and you may request closure of your account.

17. How to Contact Us

For any questions, requests or concerns about this Privacy Policy or how we handle your personal information:

This Privacy Policy is governed by the laws of New Zealand.

18. Jurisdiction-Specific Rights and Information

If you are outside New Zealand, you may have additional rights and protections under the laws of another jurisdiction.

Kahu is incorporated in New Zealand and the Privacy Act 2020 (NZ) is our primary governing privacy legislation.

The information below is provided at a high level for convenience only. It does not constitute legal advice on the laws of those jurisdictions, and we do not represent that we are subject to, or fully comply with, those laws in all circumstances.

18.1 Australia (Privacy Act 1988 (Cth) and Australian Privacy Principles)

For users in Australia, we handle your personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) as a matter of practice, whether or not the Act binds us at a given time.

Australian Privacy Principles:

• We collect personal information only by lawful and fair means and only if it is reasonably necessary for our functions (APP 3).
• We tell you why we collect your information and how we will use and disclose it (APP 5).
• We use and disclose your information only for the primary purpose for which it was collected, or for a related secondary purpose you would reasonably expect (APP 6).
• We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access (APP 11).
• We will not disclose your personal information overseas unless the recipient is subject to comparable privacy protections or another permitted basis applies (APP 8). Section 4.3 lists where our service providers are located.

Access and correction: you have the right to access your personal information and to request correction of any inaccuracies. Contact privacy@kahu.dog to make a request.

Complaints: if you are not satisfied with our response to a privacy concern, you can make a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

18.2 United Kingdom and European Economic Area (UK GDPR, Data Protection Act 2018 and EU GDPR)

For users in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply. For users in the European Economic Area, the EU General Data Protection Regulation (EU GDPR) applies. Kahu Group Limited acts as the data controller for personal information collected from UK and EEA users.

Representatives: under Article 27 of the EU GDPR and Article 27 of the UK GDPR, our representative in the European Union and in the United Kingdom is Data Protection Representative Limited (trading as DataRep). The appointment covers Kahu Group Limited, trading as Kahu and Kahu Dog Care. You can contact DataRep about our processing of your personal data by email at datarequest@datarep.com, with Kahu / Kahu Dog Care in the subject line, or online at datarep.com/data-request. If you write by post, write DataRep as the addressee. DataRep's office in the United Kingdom is DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. DataRep's office in Ireland is DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland. DataRep has an office in each other country of the European Union and the European Economic Area, and will give you the address for your country. You can contact us directly at privacy@kahu.dog about any matter relating to our processing of your personal data. Questions about your account, the App or the Website come to us at that address.

Digital Services Act: Data Protection Representative Limited (trading as DataRep) is our legal representative in the European Union under Article 13 of the Digital Services Act (Regulation (EU) 2022/2065). To contact them about the service, or to report illegal content, email digitalrequest@datarep.com with Kahu / Kahu Dog Care in the subject line, write to DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland, with DataRep as the addressee, or call +353 1 919 8899.

Kahu Group Limited is registered with the UK Information Commissioner's Office, registration ZC268465.

Legal bases for processing: we process your personal information on the following legal bases: performance of our contract with you; our legitimate interests (such as securing the App, fixing faults, understanding usage in aggregate and defending legal claims); your consent (for marketing communications and non-essential cookies); compliance with legal obligations; and, where someone's safety is at risk, vital interests. Section 3.6 maps each purpose to its legal basis. Where we rely on legitimate interests, we have balanced them against your rights and keep that assessment on file.

Your rights under the UK GDPR and EU GDPR:

• Right of access: obtain a copy of your personal data. The data export in the App satisfies this.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data in certain circumstances (see section 13).
• Right to restriction: limit our processing in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, and to direct marketing at any time. Marketing is off by default and a single setting turns it off.
• Right to withdraw consent: at any time, without affecting processing carried out before withdrawal.
• Rights related to automated decision-making: we do not use solely automated decision-making that has legal or similarly significant effects on you.

International transfers: your personal data is transferred to New Zealand, which the European Commission and the United Kingdom recognise as providing adequate protection, and to our service providers in the United States. For those providers we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (or the UK International Data Transfer Agreement), or on the provider's certification under the EU-US Data Privacy Framework and its UK Extension where it holds one. The safeguard we rely on for each provider is recorded on the sub-processor list at kahu.dog/privacy/subprocessors. Copies of the relevant safeguards are available on request.

Children: see section 12. We rely on parental or guardian confirmation for every Youth Member regardless of the member state's digital consent age.

Complaints: you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113, or with the supervisory authority in the EU member state where you live or work.

18.3 United States (CCPA/CPRA (California) and applicable state laws)

For users in the United States, the following additional rights may apply depending on your state of residence. We address California specifically as it has the most comprehensive privacy law in the US. This section also serves as our California notice at collection.

California: CCPA and CPRA. If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you the following rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, and how we use and share it.
• Right to delete: request deletion of your personal information, subject to certain exceptions.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioural advertising, and have not done so in the preceding 12 months. You do not need to opt out, and a Global Privacy Control signal does not change how our services operate. We do not knowingly sell or share the personal information of anyone under 16.
• Right to limit use of sensitive personal information: our only sensitive personal information is your account credentials and, where you grant permission, precise geolocation. We use these only to provide the features you have requested and not to infer characteristics about you. There is no secondary use to limit.
• Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.

CCPA categories of personal information collected: in the preceding 12 months, we have collected the following categories of personal information: identifiers (name, email address, username, IP address, device identifiers for push notifications); customer records (address and phone number if you add them); internet or network activity (App sessions, Website analytics with consent); geolocation data (precise, with your device permission, for walk tracking, including in the background while a walk is being recorded, nearby search and driving time to a clinic); audio, electronic, visual or similar information (photos you upload); inferences (none for advertising; the checkup triage tier is derived from flags you select); and sensitive personal information (account credentials and precise geolocation). We do not collect biometric information or financial account information beyond that handled by our payment providers. Sources and purposes are described in sections 2 and 3, and retention in section 9.

Consumer health data: we hold information about your dog's health, not yours, and we do not use anything you tell us to identify your own health status.

Submitting a CCPA request: to submit a request, email privacy@kahu.dog with 'CCPA Request' in the subject line, or use the data export and deletion controls in the App. We will verify your identity and respond within 45 days (extendable by a further 45 days with notice). To appeal a decision, reply to our response and it will be reviewed by a different person.

Authorised agents: California residents may designate an authorised agent to submit requests on their behalf. We may require written proof of the agent's authority and verify your identity directly.

Shine the Light: we do not disclose personal information to third parties for their direct marketing purposes.

Other US states: users in Virginia, Colorado, Connecticut, Texas and other states with comprehensive privacy laws have similar rights under those laws. We will honour equivalent rights requests from residents of any US state with applicable privacy legislation. Contact privacy@kahu.dog to submit a request.

18.4 Canada (PIPEDA and provincial privacy laws)

For users in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) may apply to our collection, use and disclosure of your personal information in the course of commercial activities. In provinces with substantially similar provincial legislation (Alberta, British Columbia and Quebec), the applicable provincial law may also apply.

Key PIPEDA principles we follow:

• Accountability: we are responsible for personal information under our control. Our privacy contact is privacy@kahu.dog.
• Identifying purposes: we identify the purposes for collecting personal information before or at the time of collection (section 3).
• Consent: we obtain your knowledge and consent for the collection, use or disclosure of personal information, except where inappropriate.
• Limiting collection, use, disclosure and retention: we collect only the information necessary for the identified purposes and use, disclose and retain it only for those purposes (sections 2, 4 and 9).
• Accuracy and safeguards: we keep personal information as accurate, complete and up to date as necessary, and protect it with appropriate security measures (section 10).
• Openness and individual access: this policy describes our practices, and you may access your personal information through the data export or on request.
• Challenging compliance: you can address a challenge concerning compliance with these principles to privacy@kahu.dog.

Quebec (Law 25): users in Quebec have additional rights under Quebec's Act respecting the protection of personal information in the private sector, including the right to data portability and enhanced consent requirements. The person in charge of the protection of personal information at Kahu Group Limited is our director, who can be reached at privacy@kahu.dog. Contact that address for Law 25-specific requests.

Complaints: if you are not satisfied with our response to a privacy concern, you can make a complaint to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the relevant provincial commissioner in Alberta, British Columbia or Quebec.

19. Version History

This Privacy Policy is published at kahu.dog/privacy and is available in the App under Profile, Privacy settings.