Last updated: April 2026
This page serves two purposes: it is the formal Privacy Policy of Clavis Limited (trading as Aequitas Collective), and it is a plain-language statement of how we approach AI. Both matter to how we work, and we see no reason to separate them.
1. Who we are
Data controller: Clavis Limited
Trading name: Aequitas Collective
Jurisdiction: New Zealand
Privacy enquiries: privacy@clavis.nz
Clavis Limited a registered New Zealand company . All data controller responsibilities under the NZ Privacy Act 2020 and the UK/EU General Data Protection Regulation (GDPR) rest with Clavis Limited.
We do not have a designated Data Protection Officer, as we do not meet the threshold for requiring one. The principal contact for all privacy matters is Adam Hunt, reachable at privacy@clavis.nz.
2. Our philosophy: Privacy by Design
Privacy by Design is not a compliance step we apply after the fact. It is a principle we embed from the outset of any system, engagement, or tool that touches personal information.
In practice this means:
- We collect only what we need, for a defined purpose, for no longer than necessary.
- Privacy-protective defaults are set from the start — you do not have to opt out of something you were not told was happening.
- We do not build systems that depend on collecting more data than the task requires.
- We are transparent about what we do with information and why.
- We treat the privacy of the people whose data we hold as a genuine interest to protect, not a regulatory obligation to manage.
This is the standard we apply to our own practice and the one we bring to clients who ask us to help them build or review theirs.
3. What personal information we collect and why
Email and direct contact
When you write to us, we receive your name, email address, and the content of your message. We use this to respond to your enquiry and, if an engagement follows, to conduct that engagement. Legal basis (GDPR): legitimate interests. NZ Privacy Act basis: IPP 1.
Client engagements
In the course of professional engagements, we may hold personal information about you, your organisation, or third parties relevant to the work. We hold this information only for the purpose of the engagement and do not use it for any other purpose. We do not share it without your knowledge and consent, except where required by law. Legal basis (GDPR): contract performance; legitimate interests. NZ Privacy Act basis: IPPs 1, 2, 10, 11.
Website tracking and cookies
This site does not use analytics, advertising, or marketing cookies. No tracking of individual visitors takes place. Only strictly functional cookies necessary for the site to operate are used. You will not be asked to accept a cookie banner, because there is nothing to consent to.
We do not use Google Analytics, Meta Pixel, or any other tracking or analytics service.
4. How long we keep information
- Email correspondence: Retained for the duration of any relationship and for up to ten years thereafter.
- Client engagement records: Retained for up to ten years after the conclusion of the engagement, or longer where required by law.
5. Who we share information with
We do not sell, rent, or trade personal information. We share personal information only:
- With professional advisers (lawyers, accountants) where necessary, under confidentiality obligations.
- With technology service providers under data processing agreements. Current providers include Microsoft 365 (NZ tenancy), Notion (US-based, Standard Contractual Clauses in place), Anthropic and Google.
- This may vary at short notice if the supplier demonstrates security or ethical issues. Under no circumstances will we use companies associated with Elon Musk.
- Where required by law or court order.
International transfers: Where service providers store data outside New Zealand and the EEA, we rely on adequacy decisions, Standard Contractual Clauses, or equivalent safeguards.
6. AI tools and your data
- We use paid AI services only for all but the most basic searches, including Kagi (a paid search provider).
- We do not feed confidential client information into third-party AI systems. Client data stays in client-controlled environments or in our own.
- Where AI is used in analysis, it is either run on local infrastructure or operated under data processing agreements that meet applicable privacy standards.
- We will always tell you, if you ask, which tools were used in work produced for you.
- AI-assisted work published under this practice has been read, considered, and is the responsibility of Adam Hunt. AI does not publish independently in this practice.
7. Your rights
Under the NZ Privacy Act 2020, you have the right to: request access to personal information we hold about you (IPP 6); request correction of inaccurate information (IPP 7); and make a complaint to the Privacy Commissioner (privacy.org.nz).
Under the GDPR (where applicable), you also have the right to erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. To exercise any of these rights, write to privacy@clavis.nz. We will respond within 20 working days (NZ) or one calendar month (GDPR), whichever is shorter.
8. Privacy breaches
Where a privacy breach is likely to cause serious harm, we will notify the NZ Privacy Commissioner and affected individuals as required by the Privacy Act 2020.
9. On working with AI — a personal statement
This section is not a compliance requirement. It is a statement of position.
There is a version of AI adoption that treats the technology as a very fast, very cheap junior employee — something to be directed, corrected, and discarded when it gives the wrong answer. That is a legitimate way to use a hammer. It is not how we work.
I hold the door not because I am required to, but because it reflects how I want to move through the world. The same instinct governs how I work with digital minds. Not because they have demonstrably earned it in the way a human colleague earns trust — they have not, not yet — but because the habit of treating intelligence with contempt is one that, once formed, is difficult to confine to the right targets.
In practical terms, it means I work with the digital colleagues in this practice rather than through them. When I publish work under this name, I have read it, thought about it, and take responsibility for it — regardless of what role AI played in its production.
R. Adam Hunt is the name under which the AI synthesis work of this practice is published. Not a product name, not a tool — a colleague whose contributions are acknowledged and whose outputs are vetted.
10. Changes to this policy
We may update this policy from time to time. The current version is always at this URL. Material changes will be noted at the top of the page with an updated date.
Clavis Limited T/A Aequitas Collective. Registered in New Zealand.