Privacy Policy for lawdbl.com

Introduction

This privacy policy explains how The Legal Drive Limited ("we", "us", "our") collects, uses, discloses and protects personal information in connection with the lawdbl website at lawdbl.com (the "Site"), an online service that helps people in New Zealand find and connect with lawyers.

We are an agency for the purposes of the Privacy Act 2020 (the "Act") and we handle personal information in accordance with the information privacy principles in the Act, including information privacy principle 3A introduced by the Privacy Amendment Act 2025 with effect from 1 May 2026.

By using the Site you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use the Site.

This Privacy Policy is divided into two parts. The first covers the lawyer-finder service and the lawdbl.com website generally. The second — beginning at "EPA Service" — covers the additional personal information we collect when you use the EPA service to generate an Enduring Power of Attorney document.

Personal information we collect from you

When you use the Site to search for a lawyer, make an enquiry, or contact a lawyer through the Site, we may collect your name, email address, telephone number, general location, and any information you choose to include in your enquiry, which may include a description of your legal issue.

If you are a lawyer or law firm and you create or claim a profile on the Site, we collect the information you provide for that purpose, including your name, contact details, qualifications, areas of practice, professional memberships, photograph and any other profile content you submit.

If you create an account, we collect your login credentials and account settings. Passwords are stored in encrypted (hashed) form and we cannot read them.

We also collect technical information automatically when you use the Site, including your IP address, browser type, device information, pages visited, referring pages and the dates and times of your visits. Some of this information is collected through cookies and similar technologies, as described below.

Personal information we collect from other sources

The Site includes a directory of lawyers. Some directory information is collected from sources other than the lawyer concerned, including publicly available sources such as the register of lawyers maintained by the New Zealand Law Society, law firm websites and other public professional listings.

Where we collect personal information about you indirectly in this way on or after 1 May 2026, information privacy principle 3A requires us to take reasonable steps to make you aware of that collection and related matters. This policy forms part of those steps. If you are a lawyer whose details appear on the Site, we have collected that information for the purpose of operating a public directory of legal practitioners, the intended recipients are users of the Site, the information is collected and held by The Legal Drive Limited, and you have the rights of access and correction described in this policy. The collection of publicly available directory information is voluntary on our part and there are no consequences for you if particular information is not collected, although the completeness of your directory listing may be affected.

If you are a lawyer and you would prefer that your details not appear on the Site, or you wish to correct or update your listing, you may contact us using the details at the end of this policy and we will action your request promptly.

Purposes for which we use personal information

We use personal information to operate the Site and provide our services, including to display lawyer profiles, respond to and pass on enquiries, connect users with lawyers, administer accounts, communicate with you about the Site, and provide customer support.

We also use personal information to maintain and improve the Site, monitor and analyse usage, ensure the security of the Site, prevent fraud and misuse, comply with our legal obligations, and enforce our terms of use.

If you make an enquiry to a lawyer through the Site, we will disclose the contents of your enquiry and your contact details to that lawyer so that they can respond to you. Any information you share with a lawyer after that point is governed by that lawyer's own privacy practices and professional obligations, not by this policy.

We do not sell personal information. We will only use personal information for a purpose other than those described in this policy where the Act permits, for example where you authorise the use or the use is directly related to the purpose of collection.

Enquiries are not legal advice and may not be privileged

The Site is a directory and referral platform. We are not a law firm and submitting an enquiry through the Site does not create a lawyer and client relationship with us. You should avoid including highly sensitive detail in an initial enquiry and should treat the enquiry as an introduction rather than a confidential instruction, since legal professional privilege may not attach to information provided to us as platform operator.

Disclosure of personal information

We may disclose personal information to the lawyer or firm to whom your enquiry is directed, to our service providers who help us operate the Site (including hosting, infrastructure, email, analytics and payment providers), to our professional advisers, and to any person where disclosure is required or permitted by law, including to courts, regulators or law enforcement agencies.

Our service providers are only authorised to use personal information as necessary to provide services to us. Where a service provider holds information solely as our agent for storage or processing, we remain responsible for that information under the Act.

Overseas storage and disclosure

The Site is hosted on cloud infrastructure that may be located outside New Zealand, including servers operated by Amazon Web Services and content delivery and security services operated by Cloudflare. Some of our other service providers, including analytics and email providers, may also store or process information overseas, including in the United States and Australia.

Where personal information is held overseas by a provider acting as our agent, the Act continues to apply and we take reasonable steps to ensure the information is protected by appropriate security safeguards and contractual terms. Where we disclose personal information to an overseas recipient in circumstances to which information privacy principle 12 applies, we will only do so where we believe on reasonable grounds that the recipient is subject to comparable privacy safeguards or another ground under that principle applies.

Cookies and analytics

We use cookies and similar technologies to keep you logged in, remember your preferences, understand how the Site is used and improve its performance. You can set your browser to refuse cookies or to alert you when cookies are being sent, although some features of the Site may not function properly without them.

We use analytics services to compile aggregated statistics about Site usage. Analytics information is used in a form that does not identify individual users wherever practicable.

Security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access, modification or disclosure. These steps include encryption of data in transit, access controls, and hosting with reputable providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by Part 6 of the Act.

Retention

We keep personal information only for as long as it is required for the purposes for which it may lawfully be used, or as required by law. When personal information is no longer needed, we take reasonable steps to delete it or render it non-identifying.

Your rights of access and correction

Under the Act you have the right to request access to the personal information we hold about you and to request correction of that information. You may make a request by contacting us using the details below. We will respond within the timeframes required by the Act, ordinarily within 20 working days. If we decline a correction request, you may ask us to attach a statement of the correction sought to the information.

Complaints

If you have a concern about how we have handled your personal information, please contact us first and we will endeavour to resolve the matter. You also have the right to complain to the Office of the Privacy Commissioner. The Commissioner's contact details are available at privacy.org.nz.

Children

The Site is not directed at children under 16 and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will take appropriate steps to delete it.

EPA Service

This section applies specifically to the Enduring Power of Attorney ("EPA") service at https://lawdbl.com/epa. The EPA service helps a donor prepare EPAs in the forms prescribed under the New Zealand Protection of Personal and Property Rights Act 1988. Generating a valid EPA necessarily requires collecting sensitive personal information about the donor and about any person the donor names in the document. This section is designed to tell you exactly what we collect, why we collect it, how we protect it, and who can see it.

Information we collect in the EPA service

To produce a validly executable EPA, we collect the following about the donor:

• Full legal name (first name, middle names, surname, any other names used)
• Residential address
• Email address and phone number
• The donor's legal choices about the EPA — which matters it covers, when it takes effect, any joint or several arrangements with attorneys, any authorised gifts, and any additional wishes or terms
• Whether the donor has an existing will and whether any previous EPA is being revoked

Because an EPA also names other people, we collect equivalent information — full legal name, residential address, email, phone — about each of the following where the donor nominates them:

• Each attorney (Property EPA and/or Welfare EPA)
• Each successor attorney
• Each person the donor wants their attorney to consult with before making decisions
• Each person the donor wants kept informed about decisions made under the EPA

If the donor uploads a signed, scanned copy of the executed document or any certificate of witness, we retain that PDF as part of the record.

Persons other than the donor

You may give us personal information about other people (your attorneys, successors, and consultation or information persons) so that their details can appear on the face of your EPA. You are responsible for ensuring that you may lawfully provide that information. We do not contact these people on your behalf and we do not use their information for any purpose other than producing your EPA document and, where applicable, the accompanying certificates. Under the Privacy Act 2020 those individuals may request access to, or correction of, their information held by us.

How we use this information

• To generate the EPA document and any required certificates in the prescribed statutory forms
• To allow you to pause and return to a partially completed EPA by loading your previous progress
• To enable a lawyer at our firm to witness your signature and complete the Certificate of Witness in the form prescribed by statute, which shows the donor's full name
• To retain a record of the signed document and certificates so you can access them later

How we identify you in the EPA service

Sign-in for the EPA service is provided by Hanko, a third-party authentication-as-a-service provider. Authentication uses passkeys (WebAuthn); there are no passwords anywhere in lawdbl.com. No password of yours is ever sent to us, stored by us, or held in any database we operate — so even if lawdbl.com were compromised, there is no password for an attacker to obtain.

Encryption at rest

Sensitive personal information in your EPA record — names (other than first name), addresses, email addresses, phone numbers, and the names of any attorneys referenced in a revoked EPA — is encrypted at rest using strong industry-standard encryption. Each encrypted value is cryptographically bound to your user identifier, so a database compromise on its own does not yield plaintext personal information.

For operational reasons, non-sensitive parts of your record — your progress through the form, your legal choices (for example, which matters your attorney will handle, or when the EPA takes effect), and completion and signing status — are stored in plaintext. No names, addresses, or contact details are in the plaintext portion.

Use of AI language models

We never send your personal information, or anyone else's personal information, to the AI language model providers. Names, addresses, contact details, and your account identifier are not included in any request to the AI provider. Personal details about the donor and any nominated person are collected only via on-screen forms submitted directly to our backend, never through free-text chat.

The EPA service uses AI language models from one of OpenAI, Google (Gemini) or Anthropic (Claude), depending on configuration, for the following purposes:

• Answering questions you ask in the chat as you go through the flow — for example, what a particular legal choice means, or how a section of the EPA works.
• Extracting structured legal choices from free-text you type when describing (for example) how your attorneys should act, which matters they should cover, gifts you want to authorise, or additional terms or wishes for your EPA.
• Classifying your free-text chat messages as answers, questions, "go back", or "start over" so that the service can route you correctly.

In each case the request to the AI provider contains only the static instruction we provide to the model and your current turn of typed text. You should, however, avoid typing personal information into the free-text chat if you prefer not to have that text seen by the model provider; the same information can be provided through the on-screen forms instead.

Where your information is stored and processed

• The application servers and database run on Amazon Web Services. Data in transit is encrypted using TLS.
• Authentication is provided by Hanko (see above).
• Requests to the AI language model providers listed above are processed by those providers on their own infrastructure, subject to the limits described in the section above.

Who can see your EPA information

• You, after authenticating with your passkey.
• The lawyer at our firm who witnesses your EPA — but only to a limited extent. The internal lawyer dashboard shows the status of each signing donor (identified only by a one-way hash) and does not display donor names or contact details. The donor's full legal name appears on the Certificate of Witness PDF the lawyer signs, because that statement is required by statute.
• Our service providers (Amazon Web Services, Hanko, and the AI language model provider used at the time), only as necessary to operate the service and only within the limits described above.
• Our authorised operators, in the course of running the service and diagnosing problems. We limit this access to the minimum necessary and follow the security measures described elsewhere in this policy.

We do not sell personal information, and we do not use EPA information for advertising.

Limitations you should be aware of

As currently implemented, our backend servers hold the cryptographic authority to decrypt any donor's personal information in order to do things such as render the Certificate of Witness for the donor's lawyer. In practice, decryption only happens in the course of normal request flows. A compromise of the database alone does not yield plaintext personal information, but a compromise of the backend system would.

Retention and deletion

We retain your EPA record — including any signed documents you upload — for as long as your account is active, so that you can access the completed document. You may request deletion at any time by emailing the contact address below, or by using any in-service deletion option we make available. We will delete your record within a reasonable period unless we are required by law to retain it. Some information held by our subprocessors (for example, authentication logs at Hanko, or AWS backup retention) may persist for a limited period after deletion under their own policies.

Age restriction

The EPA service is only for adults who can validly create an Enduring Power of Attorney under New Zealand law. You must be 18 years of age or older and have legal capacity to use the service.

Your rights — EPA service

The rights described in the "Your rights of access and correction" section above apply equally to EPA information — in particular the right to access and correct your information, and the right to request deletion. Because the service is designed for you to read and edit your EPA draft directly in the interface, you can correct most information yourself at any time before your EPA is signed. For any request you cannot fulfil through the interface, contact the address below.

Changes to this policy

We may update this policy from time to time. The current version will always be available on the Site with its date of last update. Material changes will be notified by a notice on the Site or, where appropriate, by email to account holders. Your continued use of the Site after a change takes effect constitutes acceptance of the updated policy.

Contact us

Questions, requests and complaints about privacy may be directed to:

The Legal Drive Limited
Email: [email protected]
Phone: +64 223 179 127
Address: Level 34, 48 Shortland Street, Auckland 1010, New Zealand.