Privacy notice
This portal is run by Kokako Property Investments Ltd (contact: [email protected]). Each company that uses it decides what it records about its directors, shareholders and other people, and is responsible for that information as its controller; we process it for them.
What we hold and why
| Activity | Information | Lawful basis | How long |
|---|---|---|---|
| Portal accounts and sign-in Authenticate users and protect accounts | Name, email, password hash, 2FA factors, IP address, browser, sign-in history | Contract; legitimate interests (security) | Life of the account; failed sign-in attempts 7 days |
| Statutory registers Keep the registers company law requires | Names, addresses, dates of birth (month/year), nationality, residence, shareholdings, interests | Legal obligation | As required by law (generally permanently while the company exists, and 10 years after ceasing for UK PSCs) |
| Board meetings and resolutions Prepare, hold and minute meetings | Names, attendance, votes, declared interests, comments, notes | Legal obligation; legitimate interests | Minutes at least 10 years (UK CA 2006 s248); private notes until deleted |
| Electronic signatures Execute documents | Name, email, signature image, IP address, browser, timestamps, witness address and occupation | Contract; legal obligation (evidence) | As long as the signed document is kept |
| Management accounts Financial reporting and audit | Names, amounts, descriptions, receipts | Legal obligation; legitimate interests | Accounting records 6-7 years (UK 6, NZ 7, AU 5+) |
| Audit trail Accountability and security investigations | Actions, timestamps, IP addresses | Legal obligation; legitimate interests | Kept for the life of the company records (tamper-evident chain) |
Who else processes it
- Amazon Web Services — Hosting, document storage and backups (S3, KMS) (Region chosen per organisation)
- Resend — Transactional email (sign-in codes, notices, signing links) (United States)
- Stripe — Subscription billing (organisation admins only; no card data on this platform) (United States / EU)
- Sentry — Error monitoring (no document content; personal data scrubbed) (United States / EU)
- Xero — Accounting import, only for organisations that connect it (Per Xero)
- Identity provider (Microsoft, Google, other OIDC) — Single sign-on, only where configured (Per provider)
International transfers use the safeguards the law requires (for example the UK International Data Transfer Addendum or EU Standard Contractual Clauses). Organisations can choose the region where their documents are stored.
Your rights
You can ask for a copy of your information, for it to be corrected, or for it to be deleted (GDPR and UK GDPR articles 15–17; New Zealand Privacy Act 2020 principles 6 and 7; Australian Privacy Principles 12 and 13). If you have an account you can download your data and make requests under your name → Privacy and my data. Some records — minutes, signed documents, statutory registers and the audit trail — must be kept by the company by law, so we may keep your name where it forms part of them.
You can complain to the UK Information Commissioner (ico.org.uk), the New Zealand Privacy Commissioner (privacy.org.nz), the Office of the Australian Information Commissioner (oaic.gov.au) or your local supervisory authority.
Security
Two-factor sign-in, encryption in transit and at rest, a tamper-evident audit log, malware scanning of uploads, and backups kept in a separate location. We will tell you and the relevant regulator about a breach that is likely to affect you, as the law requires (within 72 hours to the regulator under GDPR).
Cookies: one strictly necessary session cookie keeps you signed in. There are no analytics or advertising cookies.