Who we are
This policy covers the CORE group of companies – CORE Supply, CORE Lumber and CORE Timber Services (“CORE”, “we”, “us”) – and explains how we collect, use, store and share personal information under the New Zealand Privacy Act 2020.
It applies to our website (wearecore.co.nz), our dealings with customers, suppliers and contractors, people who sign in at our sites, and our staff tools, including our internal assistant “Chopper”, which staff can message through Microsoft Teams and WhatsApp.
Contact us about privacy: Privacy Officer, CORE, 10 Margaret Williams Drive, Papakura, Auckland, New Zealand. Email privacy@wearecore.co.nz or phone +64 9 299 7720.
What we collect
We collect only what we need to run our business, mostly directly from you.
|
Who |
What we collect |
|---|---|
|
Website visitors |
What you enter in our contact form (name, company, email, phone, message). reCAPTCHA (Google) checks the form is used by a person. |
|
Customers and suppliers |
Contact names, roles, email addresses and phone numbers; order, shipping, invoice and payment details. |
|
Site visitors and contractors |
Name, company, who you are visiting, arrival and departure times, health and safety declarations and signature. |
|
Staff using our internal tools (including Chopper on Teams or WhatsApp) |
Your name, work account, and for WhatsApp your mobile number; the messages, photos and documents you send (for example despatch dockets, forms and receipts); and a record of the tasks done for you. |
We don’t knowingly collect sensitive information (such as health details) except site health and safety declarations. Please don’t send other people’s personal information through Chopper unless it is needed for the task.
How we use it
We use personal information to:
- answer enquiries and supply our products and services;
- process orders, shipments, export documents, invoices and payments;
- keep our sites safe and meet our health and safety duties;
- let staff ask Chopper to do work tasks for them – for example entering paperwork into our business systems, checking documents and drafting emails for a person to review;
- meet our legal, tax and customs obligations.
We don’t sell personal information or use it for advertising. Chopper only acts for CORE staff who have been set up to use it; messages from anyone else get a short automatic reply and are not acted on.
Who we share it with
We share personal information only where needed to run our business or where the law requires it – for example with freight and shipping partners, NZ Customs and MPI, banks, and our accountants and auditors.
We also use trusted service providers who store or process information for us:
|
Provider |
What for |
Where |
|---|---|---|
|
Microsoft (Microsoft 365, Azure) |
Email, documents, Teams and the systems that run Chopper |
Australia |
|
Anthropic (Claude) |
The AI service that reads and answers messages sent to Chopper |
United States |
|
Meta (WhatsApp Business) |
Delivering WhatsApp messages to and from Chopper |
Global |
|
Pronto Software (Pronto Xi) |
Our business and accounting system |
Australia |
|
Google (reCAPTCHA) |
Spam protection on our website forms |
Global |
Where information goes overseas, we use providers bound by contract to keep it secure and use it only to provide their service to us, and we take reasonable steps to make sure it is protected in a way comparable to the New Zealand Privacy Act.
Storage, security and how long we keep it
Our records are kept in Microsoft 365 and Microsoft Azure data centres in Australia. Access is limited to the staff who need it, protected by company sign-in with multi-factor authentication, and passwords and keys are held in secure key vaults. Chopper can only reach the shared mailboxes and SharePoint sites it has been given, and a person must approve any email before it is sent.
We keep business records (orders, invoices, export and despatch documents) for at least 7 years, as New Zealand tax law requires. Chopper conversation records are kept only as long as needed for the task and for checking what was done, then closed. Site sign-in records are kept for as long as health and safety rules require. When information is no longer needed, we delete it or make it anonymous.
Your rights
You can ask to see the personal information we hold about you, and ask us to correct it. Contact our Privacy Officer (details above). We will respond within 20 working days and may need to confirm who you are first.
If you have a concern about how we have handled your information, please tell us first so we can put it right. If you’re not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.
Changes to this policy
We may update this policy from time to time, for example when we add new tools or services. The latest version is always on this page.
Last updated: 19 October 2026.