Privacy Policy

Last updated: August 2026

StudentPay is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how StudentPay collects, holds, uses and discloses personal information when you use our services, interact with our websites and portals, establish or manage a payment plan, make a payment, or otherwise deal with us.

We handle personal information in accordance with the Privacy Act 2020 (New Zealand) and the Information Privacy Principles contained in that Act.

In this Privacy Policy, StudentPay, we, us and our refer to StudentPay NZ Limited, the StudentPay entity providing StudentPay services in New Zealand.

1. What is personal information?

Personal information is information about an identifiable individual.

Depending on how you interact with StudentPay, this may include information such as:

• your name, date of birth and contact details;
• residential and postal addresses;
• information about your education provider, course or enrolment;
• your StudentPay plan number and payment plan details;
• amounts payable, payment schedules and payment history;
• bank account, direct debit and other payment information;
• information about missed, failed or overdue payments;
• communications between you and StudentPay;
• information you provide when contacting our support or collections teams;
• identity information where reasonably required to provide our services, prevent fraud or verify your identity;
• technical information associated with your use of our websites and portals, such as IP address, browser, device and usage information; and
• other information you choose to provide to us.

We aim to collect only the personal information reasonably necessary for our lawful business activities and the services we provide.

2. How we collect personal information

We may collect personal information directly from you when you:

• enrol or establish a payment plan;
• use a StudentPay enrolment or payment experience;
• create or use a StudentPay account or portal;
• make or arrange a payment;
• set up a direct debit or other payment method;
• contact us by phone, email, online form or another communication channel;
• request support or assistance;
• respond to a survey or provide feedback;
• use our websites, portals or other digital services; or
• otherwise provide information to us.

Information provided by your education provider

StudentPay works with education providers to establish and manage student payment arrangements.

Your education provider may therefore provide personal information to us, including your identity and contact details, course and enrolment information, fees payable and information required to establish or administer your payment arrangement.

Where we collect personal information about you from an education provider or another third party, we will handle that information in accordance with the Privacy Act 2020, including the requirements applying to indirect collection of personal information.

Where required, we will take reasonable steps to ensure you are aware that we have collected the information, why it was collected, who may receive it, who holds it, and your rights to access and request correction of it.

We may also obtain information from payment processors, financial institutions, identity or fraud-prevention providers, service providers and other parties where permitted by law and reasonably necessary to provide our services.

3. Why we collect and use personal information

We may use personal information to:

• establish, administer and manage StudentPay payment plans;
• facilitate enrolment and payment arrangements with education providers;
• process, reconcile and record payments;
• establish and administer direct debit authorities and other payment methods;
• provide students and education providers with account, payment and plan information;
• operate our student and provider portals;
• identify and authenticate users;
• communicate with you about your enrolment, payment plan or account;
• send payment reminders and other service communications;
• assist where payments are missed, unsuccessful or overdue;
• manage arrears and collections activity;
• respond to enquiries, complaints and support requests;
• generate agreements, statements, receipts and other records;
• provide reporting and account information to the relevant education provider;
• prevent or investigate fraud, misuse or security incidents;
• maintain and improve our websites, portals, products and services;
• perform internal administration, analytics, auditing and record keeping;
• comply with legal and regulatory requirements;
• establish, exercise or defend legal rights; and
• carry out other purposes that are directly related to the reason the information was collected or that are otherwise permitted by law.

If we need personal information for a purpose materially different from the purpose for which it was collected, we will obtain your authorisation where required by law.

4. Working with education providers

StudentPay provides payment and related technology services to education providers.

To provide those services, information may need to move between StudentPay and the education provider with which you are enrolled or seeking to enrol.

For example, we may provide your education provider with information about:

• establishment of your payment plan;
• your agreed payment schedule;
• payments received;
• failed or missed payments;
• the status of your payment arrangement;
• amounts outstanding or overdue;
• agreements and authorities completed through StudentPay; and
• other information reasonably necessary to administer your enrolment or payment arrangement.

We only use or disclose personal information for purposes permitted under the Privacy Act 2020 and other applicable laws.

Your education provider is independently responsible for its own handling of personal information and may have its own privacy policy.

5. Who we may share personal information with

Where reasonably necessary to provide our services or otherwise permitted by law, we may disclose personal information to:

• the education provider associated with your enrolment or payment plan;
• banks, payment processors and direct debit providers;
• technology, cloud hosting, communications and software providers;
• identity verification, security and fraud-prevention providers;
• professional advisers, auditors and insurers;
• debt collection or recovery providers where payments are overdue;
• government agencies, regulators, courts or law enforcement authorities where required or authorised by law;
• a purchaser, investor or adviser in connection with a proposed or completed sale, merger, restructure or transfer of all or part of our business; and
• another person or organisation where you have authorised us to do so.

We do not sell personal information to advertisers or data brokers.

Where we engage service providers, we take reasonable steps appropriate to the circumstances to protect personal information from unauthorised use or disclosure.

6. Overseas service providers

Some of the technology and service providers StudentPay uses may process, access or store personal information outside New Zealand.

This may include cloud infrastructure, software, communications, authentication, support or other technology services located in Australia, the United States or other jurisdictions.

Where personal information is disclosed to a person or organisation outside New Zealand, we will comply with the requirements of the Privacy Act 2020 relating to overseas disclosures, including Information Privacy Principle 12.

Where required, we will take reasonable steps to ensure that an overseas recipient is subject to the Privacy Act 2020 or is otherwise required to provide safeguards comparable to those under New Zealand privacy law.

Where comparable safeguards do not apply and we rely on your authorisation, we will inform you that the overseas recipient may not be required to protect the information in a way that provides comparable safeguards to the Privacy Act 2020 before seeking that authorisation.

7. Payment information

StudentPay works with payment service providers to process payments and establish payment methods.

Depending on the payment method used, your payment information may be provided directly to a payment processor or banking provider and may be subject to that provider's privacy and security practices.

We take reasonable steps to minimise the payment information we hold ourselves and to use established payment providers and appropriate security controls for payment processing.

8. Security

We take reasonable steps to protect personal information against loss, unauthorised access, use, modification, disclosure and other misuse.

These measures may include appropriate technical, organisational and procedural safeguards such as access controls, authentication, encryption, secure infrastructure, monitoring and restrictions on access to personal information.

No online service or information system can be guaranteed to be completely secure. We therefore regularly review our systems and controls and respond to identified security risks.

9. Privacy breaches

If StudentPay becomes aware of a privacy breach, we will assess and respond to it in accordance with the Privacy Act 2020.

Where a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, unless an exception under the Privacy Act applies.

We will also take reasonable steps to contain the breach, minimise potential harm and reduce the risk of a similar incident occurring again.

10. Retention of personal information

We retain personal information only for as long as we have a lawful purpose for retaining it.

How long information is retained will depend on the type of information, the services provided, our contractual and legal obligations, the need to maintain appropriate financial and transaction records, and whether the information may reasonably be required to resolve a dispute or enforce an agreement.

When personal information is no longer required for a lawful purpose, we will take reasonable steps to securely delete, destroy or de-identify it.

11. Accuracy of information

We take reasonable steps to ensure that personal information we use is accurate, up to date, complete, relevant and not misleading.

You can help us by keeping your contact and other account information current.

If you believe information we hold about you is incorrect, you can ask us to correct it.

12. Accessing and correcting your information

You have rights under the Privacy Act 2020 to request access to personal information we hold about you and to request correction of that information.

We will respond to requests within the timeframes required by the Privacy Act 2020.

If we do not make a correction you request, you may ask us to attach a statement of the correction sought to the relevant information.

We may need to verify your identity before providing access to personal information.

In some circumstances the Privacy Act allows or requires us to withhold information. If this applies, we will explain our decision where required by law.

13. Website information and cookies

When you use a StudentPay website or portal, we or our service providers may automatically collect technical information such as:

• your IP address;
• browser and device information;
• pages viewed;
• date, time and duration of visits;
• referring pages or websites; and
• information about how our digital services are used.

We may use cookies and similar technologies to operate our websites and portals, maintain sessions, provide security, remember preferences, understand how our services are used and improve their performance.

You can control cookies through your browser settings, although disabling some cookies may affect the operation of our websites or portals.

14. Communications and marketing

We may send communications that are necessary to administer your StudentPay services, including information about your account, payment plan, payments, agreements, security or support matters.

These service communications are separate from marketing communications.

Where we send commercial electronic messages, we will comply with the Unsolicited Electronic Messages Act 2007, including applicable consent, sender identification and unsubscribe requirements.

You can unsubscribe from marketing communications using the unsubscribe facility provided in the communication or by contacting us.

Unsubscribing from marketing does not prevent us from sending communications reasonably necessary to administer a service, payment plan or agreement you have with us.

15. Children and young people

Some students using StudentPay services may be under 18.

We recognise that personal information relating to children and young people requires particular care. We will collect and use that information only where reasonably necessary for our services and in accordance with applicable law.

Where appropriate, we may require the involvement or authorisation of a parent or legal guardian.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices or legal obligations.

The current version will be published on our website together with the date it was last updated.

Where a change materially affects how we handle personal information, we will take reasonable steps to communicate the change where appropriate.

17. Contacting our Privacy Officer

StudentPay has a Privacy Officer responsible for privacy matters.

You can contact our Privacy Officer if you:

• have a question about this Privacy Policy;
• want to request access to or correction of your personal information;
• believe your personal information has been mishandled;
• have a privacy complaint; or
• believe a privacy or security incident may have affected your information.

We may ask for information necessary to confirm your identity and investigate or respond to your request.

18. Complaints

If you have a concern about how StudentPay has handled your personal information, please contact our Privacy Officer first so that we can investigate and attempt to resolve the issue.

You also have the right to make a complaint to the Office of the Privacy Commissioner | Te Mana Mātāpono Matatapu in New Zealand.