Last Updated: 12 October 2026
This policy explains how 360Surety Limited, trading as SeeEverything ("SeeEverything", "we", "us"), collects, uses, shares and protects personal information. 360Surety Limited is a company registered in New Zealand (company number 9429053283870).
SeeEverything provides an AI-enabled quality assurance, coaching and conduct assurance platform to regulated organisations, mainly financial institutions. Our customers are organisations, not individual consumers.
This policy applies when you:
We handle personal information in line with the New Zealand Privacy Act 2020. Where they apply to our activities, we also comply with other privacy laws. These may include the Australian Privacy Act 1988, the UK GDPR, the EU GDPR and US state privacy laws. Section 9 explains the rights these laws may give you.
This policy replaces our previous privacy policy dated 26 May 2023.
Who is responsible for your information depends on why we hold it.
Information we hold for our customers. For this information we act for the customer organisation. We are a "processor" under the GDPR and US state privacy laws, and we hold it on the customer's behalf under section 11 of the NZ Privacy Act. It includes:
Information we are responsible for. For this information we decide how it is used. We are a "controller" under the GDPR and US state privacy laws, and the agency responsible under the NZ Privacy Act. It includes:
When we act for a customer, the customer decides what information goes into the platform and how it is used. We process customer-controlled platform content only to provide the services, in accordance with our customer agreements and documented instructions. Where we process operational or security information for our own purposes, we do so as described in this policy.
If your organisation uses SeeEverything and you have a question or request about your information in the platform, please contact your organisation first. If you contact us instead, we will pass your request to them and help them respond.
The rest of this policy mainly describes the information we are responsible for. Where it describes platform content, it explains how we handle that content for our customers.
We collect only what we need for the purposes in section 4.
Information about people our customers serve. The platform is designed to minimise information about our customers' own customers. It typically holds reference details, such as case IDs and pass or fail results, rather than names or contact details. Combined with a customer's own records, these references can still identify someone, so we protect them as personal information.
Sensitive information. The platform is not intended for the routine collection or storage of sensitive personal information, such as health, ethnicity, religious or political information. However, customer-provided content may contain it, including in free-text fields or attachments. Customers are responsible for making sure the information they submit is permitted under their agreement with us and applicable law.
When we get your details from someone else. If we collect your contact details indirectly, for example from a partner, an event organiser or a public business source, we will tell you when we first contact you. We will explain who we are, why we have your details and how to opt out, unless a legal exception applies.
If you don't give us information. You don't have to give us your personal information. If you don't, we may not be able to provide our services, respond to your enquiry or give you access to the platform.
We use personal information for the purposes below. If you are in the UK or the European Economic Area (EEA), the right-hand column shows our lawful basis under the UK GDPR or EU GDPR for the activities we are responsible for. For platform content we process on a customer's behalf, the customer determines the lawful basis.
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for more detail.
Platform content. We use platform content only to provide the services to the customer that put it there, as their agreement with us allows.
AI features. Some platform features use artificial intelligence to assist with quality assurance, coaching and conduct assurance. These may include suggesting evaluation outcomes, identifying potential issues and summarising information.
These features are designed to support human reviewers. Our customers are responsible for deciding how AI-generated outputs are reviewed, verified and used in their decision-making. SeeEverything does not itself make employment, performance management or conduct decisions about the people whose information is processed through the platform.
We do not use customer platform content to train general-purpose AI models.
Marketing. You can opt out of marketing emails at any time using the unsubscribe link or by emailing us. You will still receive service and security messages if you use the platform.
We do not sell personal information. We do not use it for targeted (cross-context behavioural) advertising.
We share personal information only as described here, and only as much as each recipient needs.
Within your organisation. Platform content and account details are visible to other users in your organisation according to the permissions your administrator sets. Administrators can view, change, export and delete information in your organisation's account.
Our service providers (sub-processors). These providers process platform data for us under written contracts that require confidentiality and security at least as strong as ours.
We keep the current list in our Trust Centre. We tell customers before adding or replacing a sub-processor, as our data processing terms describe.
Other service providers. We use other providers for our own business operations, such as email and productivity tools, customer relationship management, website hosting, and accounting.
Partners. We may share business contact details with resellers, implementation and referral partners who help us sell or deliver our services to your organisation.
Advisers and auditors. We share information with our lawyers, accountants, insurers and independent auditors, under confidentiality obligations.
Legal requirements. We may disclose information when the law requires it, to respond to a lawful request from a court, regulator or law enforcement agency, or to prevent a serious threat to someone's life or health. Where we receive a request for a customer's platform data, we will refer it to the customer unless the law prevents us.
Business changes. If we sell, merge or restructure all or part of our business, information may transfer to the new owner. They must handle it consistently with this policy.
With your consent. For example, we will publish your name with a testimonial only if you agree.
Platform data is hosted by Amazon Web Services in Australia. Hosting location is not the only place information is processed:
When personal information leaves the country where it was collected, we protect it as the law of that country requires.
You can ask us for more information about the safeguards we use, including a copy of the relevant contract clauses.
Our information security management system is certified to ISO/IEC 27001, and our controls for the SeeEverything platform are independently examined under SOC 2 Type 2. Our Trust Centre describes the scope of each.
Our safeguards include:
You can find more detail and request our audit reports through our Trust Centre.
No system is perfectly secure. If we suspect a privacy breach, we will contain it, assess it promptly and follow our incident response plan.
We keep personal information only as long as we need it for the purposes in section 4 or as the law requires. After that, we delete it or de-identify it.
If you unsubscribe from marketing, we keep a record of your email address so we don't contact you again.
Wherever you are, you can ask us to access or correct the personal information we hold about you. Depending on where you live, you may have further rights, shown below.
To make a request, email privacy@seeeverything.com. We will need to confirm your identity first. We don't charge for requests unless the law allows it and the request is clearly excessive. If your request is about platform content, we will refer it to your organisation (section 2).
New Zealand. You can access and correct your information under the Privacy Act 2020. We respond within 20 working days. The regulator is the Office of the Privacy Commissioner.
Australia. You can access and correct your information under the Australian Privacy Principles. We respond within a reasonable period, generally no more than 30 days. The regulator is the Office of the Australian Information Commissioner.
UK and EEA. You can ask for access, rectification, erasure, restriction or portability, object to processing (including an absolute right to object to direct marketing), and withdraw consent at any time. We respond within one month, extendable by two months for complex requests. The regulator is the Information Commissioner's Office in the UK, or the supervisory authority where you live or work, such as the Autoriteit Persoonsgegevens in the Netherlands.
United States. If your state's privacy law applies to you and to our processing, you can ask us to confirm whether we process your data, access, correct or delete it, receive a portable copy, and opt out of sale, targeted advertising and profiling. Rights differ between states, and many state laws do not cover information collected in a business or employment context. We respond within 45 days, extendable by 45 days, or sooner if your state requires. The regulator is your state Attorney General or privacy regulator, such as the California Privacy Protection Agency.
Complaints. You can raise a privacy concern or complaint by contacting our Privacy Officer at privacy@seeeverything.com. We will acknowledge your complaint within 30 days, investigate the circumstances, keep you informed and tell you the outcome. We will meet any shorter deadline the law sets. If you are not satisfied with our response, you can contact the regulator listed above.
Our websites and platform use cookies and similar technologies.
Appeals (United States). If we decline your request, you can appeal by replying to our decision. We will respond within the time your state's law requires, such as 60 days in Texas. If we deny your appeal, we will tell you how to contact your state Attorney General.
Our Cookie Policy lists the cookies we use and explains how to manage them.
We do not sell personal information or use it for targeted advertising. If that changes, we will honour browser opt-out signals such as Global Privacy Control where the law requires.
Children. Our services are for organisations and are not directed at anyone under 18. We do not knowingly collect children's personal information.
Changes to this policy. We will post any update on this page with a new "Last updated" date. If we make a significant change, we will tell our customers by email or in the platform before it takes effect.
Contact us. Our Privacy Officer is responsible for this policy and for privacy requests.
