Legal
Privacy, security & terms
Last updated: 2026. This page covers our privacy statement, our security posture and a summary of our terms of engagement.
Privacy statement
XLCFO Limited ("XLCFO", "we") collects and handles personal information in accordance with the Privacy Act 2020 (New Zealand). This statement explains what we collect, why, and what you can do about it.
What we collect
- Information you give us. Name, email, phone, company, role and the content of your enquiry, submitted through our forms or by email.
- Newsletter subscriptions. Email address, optional first name and role, and your consent record.
- Client information. For engaged clients, the financial, tax and business records necessary to perform the services, held under our engagement terms.
- Technical information. Aggregate, non-identifying usage data from our hosting provider. This site does not use advertising or cross-site tracking cookies.
Why we collect it
To respond to your enquiry, to provide the services you engage us for, to send you the XL Brief where you have asked for it, and to meet our professional, regulatory and record-keeping obligations. We do not sell personal information, and we do not share it with third parties for their own marketing.
Who we share it with
Only with service providers who help us deliver our services — hosting, email delivery, accounting platforms and secure document storage — each bound by confidentiality and permitted to use the information only on our instructions. Where required by law, a court, Inland Revenue or a professional body, we may be obliged to disclose information. A current list of our sub-processors is available on request.
Your rights
You may request access to the personal information we hold about you and ask us to correct it. Email info@xlcfo.com. You can unsubscribe from the XL Brief using the link in any issue, or by replying to it. Unsubscribing does not affect information we must retain for client engagements or statutory record-keeping.
Security & data handling
Hosting & residency
Data hosted in Australia and New Zealand regions. Backups encrypted and geographically separated.
Encryption
TLS 1.3 in transit, AES-256 at rest, across all client data stores and document repositories.
Access control
Role-based access on least privilege, single sign-on, enforced multi-factor authentication, quarterly access review.
Audit logging
Immutable, timestamped and attributed logs of every agent action, human override and approval.
AI & model use
Client data is never used to train models. Data is segregated by client. Model providers operate under zero-retention terms where available.
Retention
Client records retained for the period required by professional and tax obligations, then securely destroyed under a documented schedule.
Independent security assurance is on our roadmap. Ask us for our current posture, sub-processor list and incident response summary before you engage — we will send them without a sales process attached.
Terms of engagement
Every engagement is governed by a written engagement letter that sets out scope, deliverables, fees, term and responsibilities. In summary:
- Fees. Fixed monthly or fixed project fees, agreed in advance, in New Zealand dollars plus GST. Reviewed every six months or on a material change in scope.
- Term. Minimum three months for recurring services to complete onboarding, then month to month with 30 days' written notice by either party.
- Your responsibilities. Providing complete and accurate information and timely access to systems and records. Our work depends on the quality of what we are given.
- Your data. Your ledger, records and reports remain yours. On termination we return your data in standard formats. There is no exit fee.
- Professional standards. Work is performed in accordance with the standards of Chartered Accountants Australia and New Zealand.
- Not financial, legal or tax advice to the public. Nothing on this website constitutes personalised financial advice, legal advice or tax advice. Advice is given only under an executed engagement letter, on your specific circumstances, and should be read alongside advice from your own legal and tax advisers.
- Governing law. New Zealand law, with the New Zealand courts having jurisdiction.
Complaints
Tell us first — email info@xlcfo.com and we will respond within five business days. If we cannot resolve it, you may raise a privacy complaint with the Office of the Privacy Commissioner, or a professional conduct matter with Chartered Accountants Australia and New Zealand.