Franchise Commander – Privacy Policy

1. Who this Policy applies to

The App is designed for use by staff employed by franchisees of the Roll'd NZ franchise system, and by personnel of those franchisees and of Roll'd NZ who manage or support those staff (collectively, Users).

You should be aware that the App involves a three-way relationship:

• Us (the App developer and operator), who provides the App and the underlying systems;
• Your employer (the franchisee that operates the store you work at), who has engaged the App to manage and support its operations and its staff; and
• HHD Limited (Trading as Roll'd), which may have access to certain information for the purposes of operating and supporting the franchise system.

Where personal information is collected through the App about an employee of a franchisee, the franchisee is generally responsible (as the employer) for how that information is used in the employment context. We act as the operator of the App and process information on behalf of the franchisee for that purpose.

2. What is personal information?

Personal information is information about an identifiable individual, as that term is defined in the Privacy Act. Anytime we use the term 'personal information' in this Policy, we are referring to that statutory definition.

3. Information we collect

Information you provide to us

When you create an account or use the App, we may collect:

• your name, email address and phone number;
• your employer (franchisee), store location and role;
• your username, password (stored in encrypted form) and other authentication details;
• profile information (such as a profile photo, if you choose to provide one);
• content you create or upload through the App, including task completions, checklist responses, audit submissions, incident reports, photos, comments and messages;
• training records and progress (such as modules completed and assessment results); and
• any other information you choose to provide to us in connection with your use of the App.

Information collected automatically

When you use the App, we automatically collect certain information about your device and your activity, including:

• device information (such as device type, operating system, App version, language settings and unique device identifiers);
• log data (such as IP address, access times, features used, pages viewed and actions taken within the App);
• crash and diagnostic data, used to identify and resolve technical issues;
• location information, where you have granted permission to the App to access location data on your device (for example, to support store check-in or geo-restricted features); and
• analytics data about how the App is used, in aggregated or de-identified form where possible.

Information from third parties

We may receive personal information about you from third parties, including:

• your employer (the franchisee), when they create an account for you or update your role, store assignment or employment status;
• Roll'd NZ, where it provides information relevant to system-wide training, communications or compliance; and
• service providers and integrations (for example, single sign-on providers such as Google or Microsoft, if you use them to sign in to the App).

4. How we use your personal information

We use the personal information we collect to:

• create and manage your User account, authenticate you and provide access to the App;
• enable your employer (the franchisee) to assign tasks, training, rosters, communications and other operational activities to you through the App;
• record and report on the completion of tasks, checklists, training and other activities by Users;
• communicate with you about the App, including service updates, security notices and changes to this Privacy Policy;
• provide customer support and respond to enquiries;
• monitor, maintain, improve and secure the App, including detecting and preventing fraud, misuse and security incidents;
• generate reports and analytics for your employer and (where relevant) Roll'd NZ, in either identifiable or de-identified form, to support operational decisions;
• comply with our legal and regulatory obligations.

We do not sell your personal information.

5. Who we share your personal information with

We may share your personal information with:

• Your employer (the franchisee), who has access to information about your use of the App in connection with your employment, including task and training completion, checklist and audit submissions, and other operational records;
• Roll'd NZ, where it requires access to information for the purposes of operating and supporting the franchise system (for example, to manage system-wide training, monitor compliance, or analyse operational performance across the network);
• Our service providers, including cloud hosting providers, authentication providers, analytics providers, customer support tools and other third parties that help us operate the App. These providers are only permitted to use your information to provide services to us and are contractually bound to provide the same or equal level of protection for your data as described in this Privacy Policy;
• Professional advisors, such as our accountants, lawyers and insurers, where reasonably necessary;
• Law enforcement or regulators, where we are required to do so by law, or where it is reasonably necessary to enforce or defend our legal rights, investigate suspected unlawful activity or misconduct, or protect the safety of Users or the public; and
• Other parties, where you have otherwise provided consent to the disclosure.

6. Storage and security

We store personal information on the Base44 platform (operated by Base44, Inc.), which provides the hosting, database and authentication infrastructure for the App. Base44's servers are currently located in the United States, which means personal information collected through the App is stored and processed in the US. Base44 is SOC 2 Type II compliant and uses industry-standard security controls, including encryption of data in transit (TLS) and at rest.

In addition to Base44's infrastructure controls, we use a combination of technical and administrative safeguards to protect personal information from loss, misuse, unauthorised access, modification or disclosure. These include access controls, authentication, audit logging and regular review of our security practices.

While we and Base44 take reasonable steps to protect personal information, no system is completely secure, and we cannot guarantee the security of information transmitted to or stored within the App.

Notifiable privacy breaches

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required under the Privacy Act.

7. Cross-border disclosure

Because the App is hosted on Base44's platform, personal information collected through the App is stored and processed in the United States. Other service providers we use (for example, analytics or support tools) may also store or process personal information outside New Zealand, including in Australia, the United States and other jurisdictions.

Where personal information is disclosed overseas, we will take reasonable steps to ensure that the recipient is required to protect that information in a way that, overall, provides comparable safeguards to those in the Privacy Act — for example, because the recipient is subject to comparable privacy laws or self-certified frameworks (such as the EU–US Data Privacy Framework), because the recipient is bound by Standard Contractual Clauses, or because the recipient has agreed in writing to protect the information in accordance with the Privacy Act.

By using the App, you acknowledge that your personal information will be transferred to, and processed in, the United States and may also be transferred to other countries outside New Zealand.

8. Retention

We retain personal information for as long as it is reasonably necessary for the purposes set out in this Privacy Policy, or as required by law. When your User account is deactivated (for example, because you have ceased employment with the franchisee), we will retain certain information for a reasonable period to support legal, audit, and operational requirements, after which it will be securely deleted or de-identified. If you delete your account, your personal information is deleted immediately and any records we are legally required to retain are anonymised — see section 11 (Account deactivation and deletion) below.

9. Children

The App is intended for use by staff employed in the Roll'd NZ franchise system and is not directed at children under 16. We do not knowingly collect personal information from children under 16 except where they are lawfully employed and an account has been created for them by their employer.

10. Your rights

Under the Privacy Act, you have the right to:

• request access to the personal information we hold about you;
• request correction of personal information that is inaccurate, incomplete or out of date; and
• make a complaint about how we have handled your personal information.

You can make a request by contacting us using the details in section 13. We may need to verify your identity before processing your request, and in some cases we may refuse a request where permitted under the Privacy Act. If we do refuse, we will provide reasons.

You may also be able to view and update some of your personal information directly through the App's settings.

Information held by your employer

Where personal information is held by your employer (the franchisee) through the App in connection with your employment, requests for access or correction in relation to that employment information should generally be made to your employer in the first instance.

11. Account deactivation and deletion

You may request that your account be deactivated at any time by contacting us or your employer. Your employer may also deactivate your account, for example when your employment ends. Deactivation ends your access to the App but does not by itself delete information associated with your use of the App.

Deleting your account

Separately from deactivation, you may delete your account at any time. To do so, sign in and use Delete account on your Profile page. If you can no longer sign in, you may request deletion by emailing us using the details in section 13, from the email address your account was registered under; we will verify your identity and complete the deletion within 30 days. Full details are set out at www.franchisecommander.com/delete-account.

When you delete your account, we permanently delete your user account and login, your name, email address, phone number, position, assigned locations and notification preferences, and your training points, badges and leaderboard history. If you applied to become a franchisee, your application record and the documents you uploaded with it are deleted in full.

We do retain records that the business is required to keep by law — including Food Control Plan records, temperature logs, cleaning and opening checklists, inspections, hazard and incident reports, risk assessments, health and safety induction records, and records of training you completed. These records are retained in anonymised form: your name and email address are removed and replaced with a placeholder, so the record can no longer be attributed to you. See section 8 (Retention) above.

12. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. Where changes are material, we will provide notice through the App or by email. The current version of this Privacy Policy is always available within the App and at www.franchisecommander.com.

Your continued use of the App after a change takes effect constitutes your acceptance of the updated Privacy Policy.

13. Contact us

If you have any questions about this Privacy Policy, the personal information we collect or hold, wish to exercise your privacy rights, or would like to raise a concern about our privacy practices, you can contact us at:

We will acknowledge your query or request within 20 working days and let you know the next steps.

If you are not satisfied with our response, or if you wish to lodge a complaint, you may refer the matter to the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.