ONIT — PRIVACY POLICY

Effective Date: 02-09-2026 Last Updated: 02-09-2026

Legal Entity: ONIT APP LIMITED Trading Name: OnIt NZBN: 9429053811592 Address: Fernhill, Queenstown, New Zealand Privacy Email: james@getonit-app.com Privacy Officer: James (Director) Website/App: www.getonit-app.com

1. ABOUT THIS PRIVACY POLICY

OnIt ("OnIt", "we", "us" or "our") respects your privacy.

This Privacy Policy explains how we collect, use, store, protect and disclose personal information when you use the OnIt platform.

It applies to:

our website;
mobile applications;
accounts;
profiles;
listings;
messaging;
reviews;
subscriptions;
promotional features; and
related services.

We aim to comply with the New Zealand Privacy Act 2020 and applicable privacy principles.

2. WHO HOLDS YOUR INFORMATION?

The organisation responsible for the personal information covered by this Privacy Policy is:

Legal Entity: ONIT APP LIMITED Trading Name: OnIt Address: Fernhill, Queenstown, New Zealand Privacy Officer: James (Director) Email: james@getonit-app.com

3. WHAT PERSONAL INFORMATION WE COLLECT

Depending on how you use OnIt, we may collect:

name;
email address;
phone number;
profile photograph;
account information;
business information;
Service Provider information;
qualifications;
licences;
registrations;
insurance information;
service descriptions;
service area;
location information;
messages;
reviews;
ratings;
photographs;
User Content;
information about services requested or provided;
OnIt purchase and subscription information;
device information;
IP address;
browser information;
operating system;
app version;
usage information;
technical logs;
complaint and report information;
fraud and security information; and
other information you voluntarily provide.

We aim to collect only information reasonably necessary for our functions and activities.

4. HOW WE COLLECT INFORMATION

We may collect information:

Directly from you

For example when you:

create an account;
complete a profile;
list a service;
request a service;
send a message;
submit a review;
purchase an OnIt service;
contact support;
submit a complaint; or
otherwise interact with OnIt.

Automatically

We may collect technical and usage information through cookies, logs, analytics tools and similar technologies.

From other people

We may receive information from:

Users;
Service Providers;
people making complaints or reports;
businesses;
verification providers;
security or fraud-prevention providers;
service providers;
publicly available sources; and
government or law-enforcement agencies where legally permitted or required.

5. INDIRECT COLLECTION — IPP 3A

OnIt may collect personal information about a person from someone other than that person.

Examples include:

a User providing information about a Service Provider;
a Service Provider providing information about a User;
a person submitting a complaint;
another person submitting a review;
a user making a safety report;
information supplied for verification; or
information obtained from another lawful source.

Where Information Privacy Principle 3A applies, OnIt will take reasonable steps to notify the relevant person of the collection and the matters required by the Privacy Act.

This may include notifying the person:

that we have collected their information;
why we collected it;
who may receive it;
who is collecting and holding it;
whether collection is required or authorised by law; and
of their rights to access and correct it.

The Privacy Act contains exceptions to the notification requirement. Where an exception applies, we may not provide separate notification.

IPP 3A applies to indirect collection from 1 May 2026.

6. INFORMATION FROM PUBLIC SOURCES

We may collect information from publicly available sources where reasonably necessary for legitimate OnIt purposes.

This may include:

public business websites;
business directories;
public registers;
professional profiles;
public reviews; and
other publicly available information.

We will handle such information in accordance with applicable privacy law.

7. WHY WE COLLECT INFORMATION

We may use personal information to:

Operate OnIt

create accounts;
provide platform functionality;
manage profiles;
display listings;
facilitate communication;
provide subscriptions;
provide promotional features;
provide customer support; and
maintain the platform.

Connect users

We may use information to help Users find relevant Service Providers and Service Providers find relevant opportunities.

Safety and trust

We may use information to:

verify information;
investigate reports;
detect fraud;
investigate suspicious activity;
prevent abuse;
protect users; and
maintain platform integrity.

Reviews and moderation

We may use information to:

publish reviews;
investigate complaints;
detect fake reviews;
moderate content; and
enforce our Terms.

Legal purposes

We may use information to:

comply with law;
respond to lawful requests;
establish or defend legal claims;
enforce our Terms;
protect our rights; and
protect users.

8. INFORMATION DISPLAYED TO OTHER USERS

Depending on your use of OnIt, information may be displayed to other users.

This may include:

name;
profile photograph;
business name;
service description;
service area;
general location;
qualifications;
licences;
insurance information where displayed;
reviews;
ratings;
photographs; and
other information you choose to publish.

You should not publish unnecessary sensitive personal information in your profile.

9. MESSAGES

OnIt may store messages sent through the platform.

Messages may be processed for:

providing communication functionality;
security;
fraud prevention;
investigating complaints;
enforcing our Terms;
responding to legal requirements; and
protecting users.

We do not guarantee that communications through OnIt are completely private or confidential.

10. LOCATION INFORMATION

Depending on the features you use, OnIt may collect or use:

approximate location;
service area;
location entered by you;
device location where you have granted permission; and
location information associated with technical or security data.

Location information may be used to:

provide nearby search results;
display relevant services;
improve functionality;
prevent fraud;
maintain security; and
improve the platform.

You can control device-level location permissions through your device settings.

11. DEVICE AND TECHNICAL INFORMATION

We may collect:

IP address;
device type;
operating system;
browser;
app version;
language;
time zone;
crash information;
technical logs;
pages/features accessed; and
dates and times of activity.

We use this information to operate, secure and improve OnIt.

12. COOKIES AND ANALYTICS

OnIt may use cookies and similar technologies.

These may be used to:

keep you signed in;
remember preferences;
understand usage;
measure performance;
diagnose problems;
prevent fraud;
maintain security; and
improve the platform.

We may use third-party analytics services.

You may control certain cookies through your browser or device settings.

13. SERVICE PROVIDER INFORMATION

Service Providers may provide:

business information;
service categories;
service areas;
qualifications;
licences;
registrations;
insurance;
photographs;
portfolio information;
availability;
reviews;
ratings; and
verification information.

Some information may be displayed publicly.

Service Providers are responsible for ensuring information they provide is accurate and current.

14. VERIFICATION INFORMATION

Where OnIt verifies information, we may collect information from:

the Service Provider;
government or professional registers;
verification providers;
other lawful sources; or
other people where permitted.

Verification information will be used for legitimate purposes such as:

confirming information;
protecting users;
preventing fraud;
maintaining platform integrity; and
complying with law.

Where required, we will provide appropriate privacy notifications for information collected indirectly.

15. REVIEWS AND RATINGS

Reviews and ratings may be associated with your account and displayed to other users.

We may retain reviews after account closure where reasonably necessary for:

platform integrity;
fraud prevention;
legal compliance;
dispute resolution; or
other legitimate purposes.

We may remove or restrict reviews in accordance with our Terms.

16. WHO WE SHARE INFORMATION WITH

We may disclose information where reasonably necessary to:

Other users

To provide marketplace functionality.

Service providers

Including providers of:

hosting;
cloud storage;
analytics;
email;
communications;
customer support;
security;
fraud prevention;
identity verification;
payment processing for OnIt fees; and
technical infrastructure.

Professional advisers

Including:

lawyers;
accountants;
insurers;
auditors; and
consultants.

Authorities

Where required or authorised by law, or reasonably necessary to protect people or our legal rights.

Business purchasers

If OnIt is involved in a merger, acquisition, sale or restructuring, information may be transferred as part of that transaction subject to applicable law.

17. OVERSEAS DISCLOSURES

Some service providers may store or process information outside New Zealand.

Where personal information is disclosed overseas, we will take reasonable steps required by New Zealand privacy law.

Depending on the circumstances, this may include:

ensuring the recipient is subject to comparable privacy safeguards;
contractual protections;
relying on a lawful statutory basis; or
obtaining consent where required.

18. PAYMENT INFORMATION

OnIt generally does not process payments for services arranged directly between Users and Service Providers.

However, OnIt may collect payment-related information when you purchase:

subscriptions;
promotional features;
profile boosts; or
other OnIt services.

OnIt uses Stripe as its payment provider. Payment-card information is handled directly by Stripe and is not stored by OnIt. Stripe's own privacy policy applies to information it processes.

19. MARKETING

Where required by law, OnIt will obtain consent before sending commercial electronic messages.

Commercial electronic messages may include:

email;
SMS;
instant messaging; and
other electronic messages covered by applicable law.

Where we send commercial electronic messages, we will:

identify ourselves accurately;
provide a clear unsubscribe facility;
honour unsubscribe requests within the timeframe required by law; and
maintain appropriate records of consent and withdrawal.

Marketing consent may be withdrawn at any time.

Withdrawal of marketing consent does not affect your ability to receive essential account, security, legal, transaction or service communications.

20. ANTI-SPAM COMPLIANCE

OnIt will comply with applicable requirements of the Unsolicited Electronic Messages Act 2007.

We will not knowingly use harvested electronic addresses for unsolicited commercial electronic messaging.

Where commercial electronic messaging is sent, OnIt will maintain appropriate records of:

the recipient;
the basis for consent where applicable;
the message type;
the date sent; and
unsubscribe requests.

Unsubscribe requests will be actioned within the period required by law.

21. ADVERTISING

OnIt may display advertising or promotional content.

Where appropriate, advertising may be based on information such as:

general location;
service category;
device information;
platform activity; and
general interests.

We will not use personal information for advertising in a way that is inconsistent with applicable privacy law.

22. CHILDREN

OnIt is intended primarily for adults.

We do not knowingly collect children's personal information where doing so is inappropriate or unlawful.

If we become aware that we have collected information in circumstances where it should not have been collected, we will take reasonable steps to address the situation.

23. SECURITY

We take reasonable security safeguards to protect personal information against:

loss;
unauthorised access;
disclosure;
misuse;
alteration; and
destruction.

Measures may include:

access controls;
authentication;
encryption where appropriate;
monitoring;
secure hosting;
staff access restrictions; and
security procedures.

No online system can be guaranteed to be completely secure.

24. PRIVACY BREACHES

If OnIt becomes aware of a privacy breach, we will take reasonable steps to:

contain the breach;
assess the risk;
investigate the cause;
reduce potential harm;
remediate the issue; and
prevent recurrence where reasonably possible.

Where a breach is a notifiable privacy breach under the Privacy Act, we will notify the Privacy Commissioner and affected individuals as required by law.

25. RETENTION

We will retain personal information only for as long as reasonably necessary for lawful purposes.

Retention periods may depend on:

the nature of the information;
why it was collected;
whether your account remains active;
legal obligations;
tax and accounting requirements;
fraud prevention;
security;
disputes; and
legal claims.

When information is no longer required, we will take reasonable steps to securely delete, destroy or de-identify it where appropriate.

Closing an account does not necessarily result in immediate deletion of all information.

26. ACCESS TO PERSONAL INFORMATION

You may request access to personal information we hold about you.

Requests should be sent to:

Privacy Email: james@getonit-app.com

We may need to verify your identity.

We will respond within the timeframe required by the Privacy Act unless an applicable extension or exception applies.

27. CORRECTION OF PERSONAL INFORMATION

You may ask us to correct personal information that you believe is inaccurate.

Where available, you may also update information through your account.

If we do not agree to make a requested correction, we will comply with our obligations under the Privacy Act, which may include attaching a statement of correction to the relevant information where appropriate.

28. PRIVACY COMPLAINTS

If you believe OnIt has mishandled your personal information, please contact us first.

Privacy Officer: James (Director) Email: james@getonit-app.com

We will investigate and attempt to resolve the complaint.

You may also complain to the Office of the Privacy Commissioner:

Website: https://www.privacy.org.nz/

29. PRIVACY REQUEST IDENTITY VERIFICATION

To protect personal information, we may request reasonable evidence of identity before processing an access, correction or other privacy request.

We will only request information reasonably necessary for this purpose.

30. THIRD-PARTY WEBSITES

OnIt may contain links to third-party websites or services.

Those third parties may have their own privacy policies.

We are not responsible for the privacy practices of independent third parties.

31. BUSINESS TRANSACTIONS

If OnIt is sold, merged, restructured or otherwise transferred, personal information may be transferred as part of the transaction where legally permitted.

Any recipient will be expected to handle personal information in accordance with applicable privacy obligations.

32. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

We may update it because of:

changes to OnIt;
new features;
changes to information practices;
technology changes;
legal requirements; or
improvements to our privacy practices.

For material changes, we will take reasonable steps to notify users.

The updated policy will show the new effective date.

33. YOUR RESPONSIBILITIES

You should ensure information you provide to OnIt is accurate.

You should also take care when publishing information in:

profiles;
listings;
reviews;
messages; and
photographs.

Do not provide another person's personal information unless you have a lawful basis or appropriate authority.

34. PRIVACY AND THE ONIT TERMS

The OnIt Terms and Conditions govern use of the platform.

This Privacy Policy explains how OnIt handles personal information.

If there is a conflict between this Privacy Policy and a mandatory requirement of privacy law, the law prevails.

35. CONTACT

OnIt Legal Entity: ONIT APP LIMITED NZBN: 9429053811592 Address: Fernhill, Queenstown, New Zealand Privacy Officer: James (Director) Privacy Email: james@getonit-app.com Website: www.getonit-app.com

36. EFFECTIVE DATE

Effective Date: 02-09-2026 Last Updated: 02-09-2026