This is the version of 3 October 2026. We keep it so you can see what applied if you ordered from 3 to 10 October 2026. Read the current version.

Revised, and going for legal review. We revised this page on 3 October 2026, and it is going to a New Zealand commercial lawyer for review. It describes how the website, the customer portal and our systems actually work. We revisit it whenever a supplier changes.

Version 2026-10-03

Who we are

Baseline Mapping Limited (NZBN 9429052484322, company number 9295753), of Palmerston North, New Zealand, is responsible for the personal information described on this page.

Our Privacy Officer handles privacy questions and requests. Contact the Privacy Officer at office@baselinemapping.co.nz or on 022 693 9101.

Information we hold for a customer

Some of what we hold about other people, such as staff or contacts on a customer's property, we hold on that customer's instructions to provide our service. We handle it under our agreement with the customer, and the customer's own privacy duties may also apply. If you ask us about information of that kind, we help direct your request, without limiting our own duties under the law.

What we collect

What you type into the enquiry form: your name, phone and email, the farm, course or club name, the property address, the titles you select, your package choice, your message and any files you attach
Which page you submitted from, and the campaign or referrer that brought you, so we know which advertising is working
For the customer portal: your name and email, the properties you can see and your role on each, who invited you and changes to your access, records of sign-ins, and the share links you make and when they are opened
The orders you accept and pay for, invoices and payment status. Card details go to our payment provider; we never see or store your full card number
What you tell us by email or phone while we quote, map and support you. For email we exchange with you, our customer records keep the subject, a short preview, the addresses and the date
Standard web server logs, including IP address, kept briefly for security and abuse prevention

A map or property record can be personal information when it identifies a person, for example a sole trader's farm.

Where it comes from, and your choices

Most of it comes from you. Some comes from someone at your organisation, or from a customer who invites you to see their property in the portal. We also use public records such as Land Information New Zealand title and address data.

Giving us your details is voluntary. The enquiry form marks the fields it needs. Without them we cannot quote, map a property or give you portal access.

Why we use it

To reply to enquiries, quote, agree and deliver mapping work, run portal access and permissions, support you, take payment for orders and Forever years, send the service emails that go with those, protect our systems from misuse, keep the records the law requires, and understand which advertising brings enquiries. We do not use it for anything else unless the law allows it. We do not sell personal information or give it to anyone for their own marketing.

Who sees it

The people at Baseline who need it to do the work. In the portal, the people your organisation has given access to a property, within their role. Anyone you send a share link to. And the suppliers below, each for its own job.

Cloudflare hosts this website and the customer portal. Website enquiries, the files you attach to them and the map files we publish to the portal are stored with Cloudflare, and every visit passes through its network. Its Turnstile check stops automated portal sign-in attempts.
Supabase runs our database and portal sign-in, in Sydney, Australia. It holds the customer, property, job, order and portal account records.
Microsoft provides our email and calendar, and OneDrive, where the files for each job are kept. Portal invitations and Forever emails are sent from our Microsoft mailboxes.
Resend sends portal sign-in links, and may send the acknowledgement when you make an enquiry on this website. It sends them through Amazon Web Services in Tokyo, Japan.
Stripe takes card payments. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy notice.
Xero is our accounting system, once a quote or invoice is raised.
Land Information New Zealand supplies the aerial imagery and title data on the title picker. See website connections, below.
Google serves the fonts this website uses. See website connections, below.

We may also disclose information where the law permits or requires it, including to our professional advisers, who keep it confidential.

The customer portal, and sharing

Portal sign-in uses a link we email you, so there is no password to keep. Each property has its own people. Its Manager, the customer's main contact, invites Editors and Viewers and can remove the people the customer side added. Everyone with access to a property sees its maps, downloads, orders and tax invoices. Our terms of trade set out each role.

We may offer read-only share links, so a Manager can show a map to someone without a portal account. Anyone who has the link can open it, including a person it is forwarded to, until it expires or is withdrawn. Each open records the time, whether a PDF was opened and the country the visit came from, and the property's Managers can see those opens. We do not keep the visitor's IP address, though Cloudflare's own request logs record the link's address. Withdrawing a link cannot recall copies already downloaded. Avoid sharing personal information through a link unless it is needed and you are entitled to share it.

If a customer invited you to the portal. They gave us your name and email address so we could invite you to see their property's maps. We use those details to manage the invitation and, if you accept, your access and account security. The customer's Managers can see them, and so can the suppliers on this page, including those overseas. You do not have to accept. You can ask our Privacy Officer to see or correct your details. If you were not expecting the invitation, tell us.

Information held overseas

Several of these suppliers store or process information outside New Zealand. Where a supplier handles it only on our behalf, such as for hosting, storage or sending email, we remain responsible for it under the Privacy Act 2020 and take reasonable steps to keep it safe. Where a supplier uses information for its own purposes, as Stripe does for fraud prevention, we disclose it only where principle 12 of the Act allows.

If you need your information kept in a particular place, tell us before you send it and we will explain what we can do.

Website connections and cookies

This website sets no cookies of its own, and runs no analytics or advertising tags. If we ever add them, we will update this page first and ask for your consent before they load.

The customer portal uses only the cookies it needs: ones that sign you in and keep you signed in, one that ties the portal's offline copy to your account, and, when you open a share link, a short-lived one that shows the open was recorded. It also keeps a copy of its own pages on your device so it loads quickly. It runs no analytics or advertising.

The website loads its fonts from Google, so your browser connects to Google's servers, which see your IP address. When you open the title picker, your browser loads aerial imagery directly from Land Information New Zealand's basemap service. Address suggestions and title lookups are made by our server, not your browser, and are not linked to you unless you submit the form.

To stop one address flooding the enquiry form, we hold the IP address of each submission for up to two days.

How long we keep it

We keep personal information only while we need it for a lawful purpose. Tax and accounting records are kept for seven years, as tax law requires. Delivered maps and portal files follow clause 8 of our terms of trade: they are archived, not deleted. Records we no longer need are deleted or de-identified. Not everything connected with a job is kept for seven years.

Keeping it safe

We take reasonable steps to protect personal information from loss, misuse and unauthorised access. Access is limited to the people who need it. In the portal, each person sees only the properties they have been given. Integration credentials are encrypted where we store them, and delivered files are backed up.

If a privacy breach has caused, or is likely to cause, serious harm, we notify the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires. Tell us promptly if you think something is wrong.

Your rights

You can ask for the personal information we hold about you, and ask us to correct it. We reply as soon as we reasonably can, and make our decision within 20 working days unless the law allows an extension, which we will explain. If we do not make a correction you ask for, you can ask us to attach your statement of the correction you wanted. We may check who you are before we release or change anything.

You can also ask us to delete information. We will consider it and tell you if there is a lawful reason we need to keep any of it. Email our Privacy Officer at office@baselinemapping.co.nz.

If you are not happy with our answer

Tell us first and we will try to put it right. If you are still not satisfied you can complain to the Office of the Privacy Commissioner, which is free and independent, at privacy.org.nz or on 0800 803 909.

Changes to this page

We date each version of this page. If we change how we handle personal information we update it, and we tell you directly if the change materially affects information we already hold about you. Updating this page does not by itself let us use or disclose information in a way the law does not allow.

Privacy