Privacy statement

Published: 19 October 2026

Who we are

BOSS Pay is provided by BOSS TECHNOLOGIES LIMITED (we, us, or our). Our registered office is KPMG Chartered Accountants, Level 2, 247 Cameron Road, Tauranga 3110, New Zealand.

Our Privacy Officer is Phillip John Van Syp. Privacy questions, access or correction requests, and complaints can be sent to phill@1cr.co.nz.

Information BOSS Pay processes

Depending on the services an employer uses, BOSS Pay may process:

• names, contact details, addresses, dates of birth and employee identifiers;
• IRD numbers, tax codes, tax rates, student-loan, child-support and KiwiSaver details;
• bank account and payment-reference information;
• employment, placement, hours, rates, leave and attendance information;
• earnings, allowances, reimbursements, deductions, PAYE, net pay and payslips;
• payroll approvals, filing and payment status; and
• account, tenant, role, session, audit, security and service-operation information.

We may receive this information directly from an individual, from their employer or authorised payroll representative, from an authorised connected payroll-source system, or—where approved and authorised—from Inland Revenue or another authorised service.

Where information is collected indirectly, BOSS and the employer ensure the individual receives the information required by the Privacy Act 2020 before, or as soon as reasonably practicable after, collection.

Why we use personal information

We use personal information where necessary to:

• calculate, review and approve payroll and provide payroll reports and payslips;
• prepare authorised bank-payment outputs and payroll communications;
• meet payroll, tax, employment, recordkeeping and payday-filing obligations;
• administer authorised users, tenants, support and customer instructions;
• secure the service, investigate incidents and maintain audit evidence;
• back up, restore, test and maintain service continuity; and
• comply with New Zealand law and lawful requests.

If required payroll information is not provided, the employer may be unable to calculate or pay wages correctly, issue payslips, meet statutory obligations, or use some BOSS Pay functions.

Who may receive information

We disclose personal information only where authorised or necessary, including to:

• the employer and its authorised payroll users;
• the individual the payroll information relates to;
• Inland Revenue or another authority where authorised or legally required;
• banks, payment-file recipients and payslip recipients instructed by the employer; and
• service providers supporting hosting, email delivery, monitoring, backup and support under appropriate controls.

We do not sell personal information. Microsoft SharePoint/Microsoft 365 holds an encrypted off-site recovery copy of payroll backups in the recorded Auckland, New Zealand region. The independent recovery backup is also held in New Zealand. Direct Inland Revenue Gateway filing remains disabled until IRD approval and credential onboarding are complete.

BOSS Pay does not use artificial intelligence to calculate payroll, make payroll or tax decisions, approve changes, process Gateway requests or submit returns. BOSS Pay does not send payroll records to an AI service.

Storage, security and retention

BOSS Pay's primary payroll storage and recorded recovery-backup locations are in New Zealand. We do not intentionally store production payroll records outside New Zealand.

We use safeguards appropriate to payroll and taxpayer information, including encrypted transport, multi-factor authentication, role and tenant controls, restricted administrative access, security logging, monitored encrypted backups, and tested recovery procedures.

We retain information only for lawful payroll, employment, tax, contractual, security and dispute-resolution purposes. Payroll, PAYE, filing, payslip, earnings, deduction, wage, time, holiday, leave and related audit records are generally retained for seven years. Short-lived operational records are kept only for their operational or security purpose. At the end of an applicable retention period, eligible active information is securely deleted or de-identified and backup copies expire through controlled rotation, unless a legal hold or another lawful requirement applies.

Access and correction

You may ask for access to personal information we hold about you and ask us to correct information you believe is wrong, incomplete or misleading. In many cases your employer controls the underlying employment information, so we may refer your request to the employer or work with it to respond. We may verify identity and authority before releasing or changing information.

Privacy incidents and complaints

Contact our Privacy Officer promptly if you believe personal information has been lost, accessed, changed, disclosed or sent without authority. We investigate and contain suspected incidents and make notifications where the law requires them.

You can also contact the New Zealand Office of the Privacy Commissioner.

Changes to this statement

We may update this statement when our service, processors or legal obligations change. The current version and publication date will remain available at this address.