Privacy Policy

01Who we are and what this covers

Project Five Ltd (“Project Five”, “we”, “us”) is a Cook Islands company based in Rarotonga. We build and operate Easy, Cook Islands accounting software.

This policy explains how we handle personal information when you:

• visit our website;
• create or use an Easy account; or
• contact us for support, sales or anything else.

It covers information about people — names, contact details, payroll details and similar. It does not change the fact that your business records belong to you.

02In short

• We collect what we need to run your account and provide the software. Nothing more.
• We do not sell your personal information, and we do not use your financial data to advertise to you.
• Your accounting records belong to you. We hold them to run the Service, back them up and support you.
• Our website uses privacy-focused, cookie-less analytics. No advertising trackers.
• You can ask to see, correct, export or delete your information.

03Personal information we collect

3.1 Information you give us

• Account and business details — your name, business or company name, work email address, phone number, country, and your password (stored in hashed form, never in plain text).
• Billing details — your plan, billing period and payment history. Card details are handled by our payment provider; we do not store full card numbers.
• Content you enter — your business and financial records, including invoices, bills, bank statement imports, documents and photographs you upload, and payroll information about your employees (names, contact details, tax and CINSF identifiers, pay, leave and timesheet data).
• Communications — support requests, emails, and anything you tell us when you contact us.

3.2 Information we collect automatically

• Technical data — IP address, browser and device type, operating system, and the features you use.
• Security and audit logs — sign-in events, and the audit trail of create, edit, post and delete actions in your Account, which records who did what and when.
• Website analytics — aggregate, cookie-less usage statistics for our marketing website. See section 11.

3.3 Information from third parties

• Identity providers — if you sign in with Google or Microsoft, we receive basic account information such as your name and email address from that provider.
• Your accountant or adviser — where you invite them, they may enter information into your Account.

04Why we use personal information

We use personal information to:

1. create and administer your Account, and provide the Service;
2. calculate the payroll, VAT and other figures you have asked the Service to calculate;
3. process payments and manage your subscription;
4. provide the support you request, including any temporary access you grant us;
5. keep the Service secure, detect and investigate misuse, and maintain audit trails;
6. send you service messages — security alerts, billing notices, and changes to these terms or to the Service;
7. send you information about Easy or other Project Five products, where you have agreed or where the law allows, with an easy way to opt out every time;
8. understand how the Service and our website are used, so that we can improve them; and
9. meet our own legal, accounting and tax obligations, and enforce our terms.

We do not use your financial data, your customers’ or suppliers’ details, or your employees’ payroll information for our own marketing or for any purpose of our own.

05The legal framework we work to

5.1 The Cook Islands does not currently have a general data protection statute that applies to private businesses. The principal privacy statute, the Official Information Act 2008, governs information held by government agencies.

5.2 Because the Cook Islands sits within New Zealand’s realm, and many of our customers trade with New Zealand and Australia, we have chosen to handle personal information in line with the principles of the New Zealand Privacy Act 2020 — the closest and most relevant regional standard. In practice that means we collect only what we need, tell you why, keep it accurate, protect it, keep it only as long as necessary, and give you access to it.

5.3 Where the law of another country applies to information we hold — for example because you or your employees are in New Zealand or Australia — we will comply with that law as it applies.

5.4 We do not claim compliance with the EU or UK General Data Protection Regulation, because we do not target or monitor individuals in those jurisdictions. If your business needs a data processing agreement, or specific assurances about where your data is held, contact us and we will work through what you need.

06Who we share it with

We do not sell personal information. We share it only as follows.

6.1 Service providers. We use trusted third parties to run the Service — for example cloud hosting and storage, email delivery, identity providers such as Google and Microsoft sign-in, and payment processing. They may use the information only to provide their service to us.

6.2 Your advisers and users. People you invite to your Account — your team, your accountant, your bookkeeper — can see the information their role allows.

6.3 Professional advisers. Our own lawyers, accountants and insurers, where needed.

6.4 Legal requirements. We may disclose information where required by law, by a court order, or by a regulator with lawful authority, or where disclosure is needed to protect someone’s safety or to establish or defend our legal rights.

6.5 Business changes. If Project Five is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction. We would require the recipient to honour this policy, and we would tell you.

6.6 At your direction. Where you ask us to share information with someone else.

07Where your information is held

7.1 Easy is operated from Rarotonga. Our systems, and those of our service providers, run on cloud infrastructure, which means personal information may be stored or processed outside the Cook Islands.

7.2 Where information is held or processed outside the Cook Islands, we remain responsible for it, and we take reasonable steps to ensure it is protected to a standard consistent with this policy — including contractual protections with our providers.

7.3 If you need to know more about where particular information is held, ask us.

08How we protect it

8.1 We protect personal information with measures including:

• encryption in transit (HTTPS/TLS);
• passwords stored in hashed form;
• two-factor authentication available on every account, enforceable across all users;
• role-based access controls, so users see only what their role allows;
• a complete audit trail of create, edit, post and delete actions;
• support access that you grant, monitor and can end; and
• routine backups and access logging.

8.2 No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur. If a security incident affects your information and creates a risk of harm, we will tell you and any relevant regulator without undue delay, and tell you what we know and what we are doing about it.

8.3 You have a part to play too: use a strong, unique password, turn on two-factor authentication, and manage the access of the people you invite.

09How long we keep it

9.1 We keep personal information for as long as your Account is active, and for as long afterwards as we need it for the purposes in section 4.

9.2 Typical periods:

• Account and billing records — for the life of the account, then for at least 5 years, which is the record-keeping period the Cook Islands Income Tax Act 1997 requires.
• Customer Data (your records) — while your Account is active, then a short period after cancellation to let you export it, and then deleted or de-identified, except where we must keep it by law.
• Website analytics — aggregate only. No personal profiles are retained.
• Security and audit logs — retained for a limited period for security and audit purposes.

9.3 Backups. Deleted information may remain in routine backups until those backups are overwritten on their normal cycle.

10Your rights

Subject to applicable law, you can ask us to:

• give you access — tell you what personal information we hold about you, and give you a copy;
• correct it — fix information that is wrong, out of date or incomplete;
• port it — give you your information in a portable format. Your ledger, reports and documents can be exported from the app at any time;
• delete it — remove your information, where we are not required to keep it;
• stop marketing — stop sending you marketing communications; and
• raise a concern — discuss how we have handled your information.

To make a request, email support@projectfive.co.ck. We will respond within a reasonable time, and will tell you if we need more information to find what you are asking for. There is no charge for a reasonable request.

If you are not satisfied with our response, tell us again at a senior level. You can also contact the Office of the Ombudsman in the Cook Islands, or the privacy regulator in your own country where its law applies to you.

11Cookies and analytics

11.1 Our marketing website does not use advertising cookies or third-party advertising trackers.

11.2 We use a privacy-focused, cookie-less analytics tool to understand how many people visit our site and which pages are useful. It records aggregate information such as page views and the referring site. It does not build a profile of you and does not follow you across other websites. Because it stores no cookies or identifiers on your device, no cookie banner is required.

11.3 The Easy application itself uses cookies and local storage that are strictly necessary to keep you signed in and to keep the application working. These are essential to the Service and are not used for advertising.

12Other people’s information in your account

12.1 When you enter information about other people into Easy — your employees’ payroll details, or your customers’ and suppliers’ contact details — that information is your responsibility. You decide what is collected, why, and how long it is kept.

12.2 We hold and process that information on your behalf, as a service provider, so that we can run the Service for you. We do not use it for our own purposes.

12.3 You must make sure you have the right to give us that information, and that the people concerned have been told what they need to know.

13Children

Easy is a business tool and is not intended for children. We do not knowingly collect personal information from children. If you believe a child has given information to us, contact us and we will delete it.

14Changes to this policy

If we make a material change, we will notify you by email or in-product notice before it takes effect, and update the effective date at the top of this page. The current version is always published at this address.

15Contact

Privacy questions, access requests and complaints all go to the same place. We are a local team and we will answer you directly.

Project Five Ltd

Rarotonga, Cook Islands

Privacy contact

support@projectfive.co.ck

Website

www.projectfive.co.ck