MERCURY NZ LIMITED PRIVACY POLICY

Effective date 1 May 2026

1  INTRODUCTION

1.1  Mercury provides energy and telecommunication services to make your life easier, so you can focus on the things that matter most. This requires your trust in us. For us, being clear about how we handle your personal information is important.

1.2  This privacy policy sets out how Mercury collects, uses, stores, shares and discloses your personal information and how you can exercise your privacy rights. It also outlines what you can expect when we collect your personal information, including that we will take reasonable steps to ensure you are aware of:

• why we are collecting the information;
• how we will use it;
• who we may share it with;
• whether the collection of the information is authorised or required by law and whether providing the information is required or optional;
• the consequences if you choose not to provide us with information; and
• where applicable, that we may collect information about you from third parties, including the types of information we receive and the source of that information (unless an exception under the Privacy Act applies).

1.3  We use the following definitions in this policy: 

• “Mercury” which means Mercury NZ Limited;
• “we”, “us” and “our” are also references to Mercury;
• “Privacy Act” means the New Zealand Privacy Act 2020.
  
  

2  CHANGES TO THIS POLICY

2.1  This policy may change from time to time. We will notify you of any changes by posting an updated policy on our website. Changes will take effect from the date of publication.

2.2  If the change is material, then we’ll let you know via an appropriate channel (for example, via email, a post to our website, an in-app notification, by phone, text, or bill message).

3  PERSONAL INFORMATION WE COLLECT FROM YOU

3.1  When you sign up as a customer or change your services, we collect: 

• your name, contact information (phone number, email address and physical address) and date of birth;
• information about the property where services are provided (including whether you are moving to the property, whether you own or rent the property, whether the premises is your primary residence, whether there are potential barriers or risks to accessing the property such as dogs);
• the type of service(s) required (e.g., electricity, gas, broadband, mobile);
• device and product preferences (e.g., routers and appliances);
• expected usage information (e.g., standard, or low energy usage);
• identification information such as driver’s licence or passport details; information to confirm whether you or a member of your household qualify for medically dependent and/or vulnerable customer status;
• information necessary to validate whether you are eligible to receive certain offers (e.g. vehicle make and model for EV plans);
• payment preferences; and
• information you provide when interacting with us.      

3.2  Energy Management Services:

If you participate in an energy management service (for example, a service that manages when your hot-water cylinder operates), Mercury may collect the following information as reasonably necessary to provide that service under the applicable product or service terms:

• information about an Enrolled Device, including its type, model, configuration or capacity. For the purposes of energy management services, an “Enrolled Device” means any energy-related device at your property that you permit us to connect to and manage as part of our energy management services. This may include your hot‑water cylinder, or other fixed energy devices you choose to enrol in the future;
• telemetry Data about the Enrolled Device’s state and function (e.g., whether the Enrolled Device is operating, available for control, or responding to commands); “Telemetry Data” means information automatically generated by an Enrolled Device about its operating state, availability, performance, or response to control commands. It is limited to technical data needed to provide energy management services; and
• connectivity Information you provide to enable a Device to communicate with our systems. “Connectivity Information” means the information required to securely connect an Enrolled Device to Mercury’s energy management services. This may include a device identifier (such as a serial number) or a secure access token issued by the device manufacturer. It does not include your personal password, login details or Wi-Fi information.

3.3  As part of using our products and services:

• information about your usage (e.g., how much you use) and how you use our services (e.g., electric vehicle plans, solar plans, unlimited data plans).

3.4  When you contact us via email, chatbot, webform or post:

• we’ll typically collect contact information provided to us, the contents of your query, and any additional information that you provide to us.

3.5  When you contact us via telephone:

• we collect your contact information, and the contents of the conversation, which may be recorded for training and quality assurance purposes.

3.6  When you visit, search for, and browse our websites (including My Account) and use our app:

• we collect the internet protocol (IP) address used to connect your computer or device to the internet, your account login information, data about your device, on-screen activity, and device settings, such as the cursor movement and scrolling behaviour, web browser type and version, time zone settings, and operating system information.
• we also collect generic information about your use or visit, including statistical information about visits to pages on the site, what you looked at or searched for while on our site, page response times, how you navigated the site, and how you reached our site in the first place (e.g. via a Google search). This information on its own does not identify an individual but it does provide us with statistics that can be used to analyse and improve our website.

3.7  When you use the meter reading or broadband troubleshooting service in our app, we may collect video and/or still images, subject to your authorisation.

3.8  For Android users, the app’s use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

3.9  When you respond to our surveys or enter into our competitions or challenges:

• we typically collect your name, contact information, account number, contact preferences, responses/entries (e.g., photographs, opinions) and evidence of your participation, including acceptance and completion times, and what you did (e.g., the number of steps you’ve taken in an app challenge).

3.10  When you visit our premises:

• we may collect Closed-Circuit Television (CCTV) footage. If you’re visiting our premises for the purpose of a meeting, we’ll collect your full name, contact number, details of who you are visiting, and the date and duration of your visit. If you are parking on site, we may also collect your vehicle registration number. You agree that any information you give Mercury will be accurate, correct and up to date. If any information becomes incorrect or changes, you need to let us know as soon as possible.

3.11  You agree that any information you give Mercury will be accurate, correct and up to date. If any information becomes incorrect or changes, you need to let us know as soon as possible.

3.12  If you provide us with personal information about another person, you confirm you have their permission to provide it to us and are responsible for making them aware of the information contained in this policy.

3.13  If you do not provide information that we reasonably require, we may not be able to provide you with some or all of our services, process your application, or respond to your request.

4  PERSONAL INFORMATION WE COLLECT FROM THIRD PARTIES

4.1  In some circumstances, we collect personal information about you from third parties rather than directly from you. We do this where it is reasonably necessary to provide our services, meet our legal obligations, or support our legitimate business operations. The types of information we collect, the sources we collect it from, and the purposes of collection include:

• consumption and usage information, account and connection details from your previous service providers (energy and telecommunications) for the purpose of ensuring continuity of services, billing accuracy, and account setup;
• property identifiers (such as ICPs), connection status and switching records, from industry systems and registries to enable customer switching, maintain accurate industry records and support the operation of energy market systems;
• property, connection, metering and consumption information, and operational and safety information, from electricity lines companies, gas network operators, and/or metering providers for the purposes of delivering energy and related services safely and reliably, responding to and managing faults, outages and emergencies, managing connectivity, planning and maintaining the network and equipment at your property, measuring usage to enable accurate billing, and complying with our contractual, legal and regulatory obligations (including to comply with our information sharing obligations under the Electricity Industry Participation Code 2010);
• information about known or potential safety risks, hazards, or access issues associated with a property (for example site access risks, equipment hazards or safety flags) from industry participants such as previous retailers, electricity lines companies, metering equipment providers, and other relevant parties, to help us identify, manage and respond to safety risks;
• health information about you from your general practitioner, a District Health Board that has provided health services to you, and the Ministry of Social Development (including Work and Income NZ) or Family and Community Services where they provide you with a benefit or support in relation to your needs, for the purposes of enabling us to confirm whether you (or any member of your household) are a vulnerable or medically dependent consumer and qualify for certain benefits or services, supporting your needs, and complying with our regulatory obligations. We may share limited information (such as your vulnerable or medically dependent status) with lines companies and other service providers where necessary to ensure you are treated appropriately, as well as where you have authorised us to do so or where required by law;
• credit information from credit reporting agencies (such as Centrix) for the purpose of undertaking a credit check on you when you apply for our services and during our relationship with you to assess your creditworthiness and ability to pay your bills and manage our internal credit risk;
• contact information and details about any complaint you have made about us or our services to Utilities Disputes Limited (UDL), the Telecommunications Dispute Resolution (TDR), the Electricity Authority or any other regulator, for the purpose of enabling us to respond to and help resolve the complaint and complying with our regulatory obligations;
• information from the NZ Police about investigations involving you or your property relating to fraud, equipment tampering, and/or power theft, for the purposes of enabling us to support the NZ Police with those investigations, comply with our legal obligations, and protect and enforce our rights;
• confirmation of identity, address verification data, and match results from trusted verification services to verify your identity, prevent fraud, comply with legal obligations, and ensure the accuracy of our records;
• information about your interactions with our advertisements, website activity and in some cases, matched or aggregated audience insights from advertising and analytics partners (such as digital platforms and data providers) to measure effectiveness of advertising, understand customer preferences, and improve our marketing services;
• information about your interactions with our digital platforms and data partners platforms and in some cases, matched or inferred information (such as indications you may be moving house) to better understand customer needs, support service continuity (for example, when customers move), and provide relevant communications and offers;
• contact details, service preference and information you provide when engaging with a third-party partner promoting our services (for example sales partners, agents and referral channels) for the purposes of responding to your enquiry, set up services, and manage our relationship with you;
• information about enrolled devices and their operation, including device status, performance data, connectivity information, and, in some cases, information provided by device manufacturers or platform providers to support the operation of the service, from energy management service providers and device partners, to enable, operate, and support energy management services, including monitoring device performance, troubleshooting issues, maintaining connectivity and improving service functionality; and
• contact details, account-related information, and any other information provided to us by a person authorised to act on your behalf (such as a joint account holder, authorised contact, support person, or a person acting under a power of attorney each an authorised person or authorised representative) to manage your account, provide services, respond to enquiries, support your needs (including where you require assistance), and communicate with persons you have authorised to act on your behalf.

5  USE OF COOKIES

5.1  Mercury’s website uses both non-persistent and persistent cookies to manage your visit to our site. Non-persistent cookies are temporary and are deleted when a browser session is closed. Persistent cookies are used so that third parties, such as Google, can serve ads based on your prior visits to the Mercury website.

5.2  Other than as set out above, information about a visit to Mercury’s website is not permanently stored on a visitor or customer's personal computer.

5.3  While Mercury recommends that you enable cookies in order to enjoy all the features of Mercury’s website, this is entirely up to you. The management of cookies will be different depending on how you access our website - refer to your browser help menu for further information.

6  WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

6.1  We collect and use your personal information for a variety of purposes including:

• signing up, operating, and administering your account;
• confirming and verifying your identity, as well as the identity of those authorised on your account;
• providing credit information (as defined in the Credit Reporting Privacy Code 2020) about you to credit reporting agencies, so that we can participate in their credit monitoring service and receive updates on the information they hold about you or on any matters which may impact our ongoing relationship with you;
• supplying you with and improving our products and services, including electricity, gas, telecommunications, electricity management services, billing, meter reading, technical support, rewards, and app experiences;
• sending control commands to Enrolled Devices you permit us to connect to as part of providing energy management services, to adjust when the Enrolled Device uses energy while ensuring it continues to operate as expected (e.g. when it runs), to optimise energy use and reduce electricity costs, while maintaining functionality;
• sharing relevant data with trusted partners (e.g., Electricity Distribution Businesses and software providers) for safe and efficient energy supply;
• for our general business purposes, such as providing customer and complaint resolution services, training staff, performing troubleshooting and improving or personalising the products and services we provide to you;
• contacting you about products, services, surveys, competitions, offers and promotions (where we have your permission to do so);
• conducting market research and data analysis to obtain your views on products and services offered by us and to identify particular products and services that may be of interest to you;
• undertaking research to understand our customers, and making improvements to our products, services, purchasing and customer support processes;
• measuring or understanding the effectiveness of advertising we serve to you and others, and delivering relevant advertising to you;
• administering surveys, competitions, offers and promotions that you have entered;
• providing you with information about other goods and services that we, your electricity lines company, your gas network operator, your local fibre company, our broadband network provider, our partners and sponsors, or other persons may from time to time wish to offer you (unless you instruct us otherwise);
• verifying whether you, or a member of your household, qualify for vulnerable or medically dependent consumer status, and to assist us in carrying out our responsibilities under the Electricity Industry Participation Code 2010, Part 11A: Consumer Care, and the New Zealand Commerce Commission “Commission 111 Contact Code”;
• administering our websites for internal operations, including troubleshooting, data analysis, testing, research, security, statistical and survey purposes;
• maintaining and developing our business systems, processes, and infrastructure, including testing, and upgrading of these systems, product or service development, research, and quality control;
• keeping staff, visitors, and our assets safe while on our premises;
• debt collection and fraud detection;
• security monitoring of our communications, including our website, app, and My Account;
• monitoring (or enabling telecommunications network service providers to monitor) your usage of telecommunications services, including content made available to you via mobile services, for the purpose of maintaining the integrity of the network and services provided;
• managing and resolving any legal or commercial complaints and/or issues; and
• carrying out any activity in connection with a legal, governmental, regulatory requirement, or in connection with legal proceedings, crime or fraud prevention, detection, or prosecution.

7  PERSONAL INFORMATION COLLECTED BY THIRD PARTIES

 7.1  Some third parties may collect personal information about you independently of Mercury when you interact with our website, app, or services, or when you engage with third-party platforms. These third parties collect and use your information independently of Mercury in accordance with their own privacy policy, examples include:

• analytics providers (such as Google Analytics) may collect information about how you use our website, app, and other online services, including through cookies and similar technologies. Mercury does not control how those cookies are issued, or the data that they store. Please refer to the Google Analytics Privacy Policy for more information; and
• third-party platforms (such as social media or advertising platforms) may collect information about your interactions with our content or services when you are logged into those platforms.

We may include hypertext links to third-party websites for your convenience. We do not control those websites and are not responsible for their content or how they collect, use, or handle your personal information. We recommend that you review the privacy policies of any third-party sites you visit.

8  DISCLOSURE OF YOUR PERSONAL INFORMATION

8.1  We may share your personal information with third parties where necessary for our business activities, to provide services to you, or to comply with our legal and regulatory obligations. This includes where we engage third parties to undertake services for us or on our behalf, as well as disclosures to regulators and other organisations. We will only share information to the extent necessary for the relevant purposes. Examples include (but are not limited to):

• service providers such as local fibre companies, web hosting providers, IT systems administrators, software providers, mailing houses, couriers, payment processors, electronic network administrators, debt collectors, and professional advisers such as accountants, solicitors, business advisors, auditors, and consultants;
• lines companies who are provided with access to your account and contact details, ICP number, ICP electricity consumption data, and (if applicable) your vulnerable or medically dependent status for the purposes of enabling them to operate, maintain, and plan the electricity network, communicate and manage planned or unplanned outages, calculate network charges, and meet their regulatory and reporting obligations;
• metering companies who are provided with access to your contact details and information about property risks and hazards to enable them to arrange and carry out site visits and equipment installation associated with your ICP. For more information about how the metering companies handle the personal information we provide to them please visit Intellihub’s privacy policy at https://www.intellihub.com.au/ and/or Bluecurrent’s privacy policy as https://bluecurrent.co.nz/;
• Electricity Distribution Businesses (EDBs), software providers supporting the energy management platform, device manufacturers or OEMs, where connectivity or authorisation is required for energy management services;
• suppliers, business partners or joint venture entities or partners who we engage or partner with to perform certain services or functions on our behalf; sponsors, or promoters of any competition that you have entered into that we conduct or promote;
• specific third parties authorised by you to receive or otherwise have access to information held by us, including authorised contacts and alternate persons;
• persons who wish to pass on rebates or discounts to you, or where you are a beneficiary of that person, and they wish to communicate with you, or it is required to maintain trust or cooperative electoral rolls;
• adjudicators and third-party dispute resolution providers, such as Utilities Disputes and the Telecommunications Dispute Resolution (TDR) to assist them in resolving a complaint that you make about us;
• law enforcement, regulatory bodies, legal advisors, or similar third parties where we are under a legal duty to disclose or share personal information in order to comply with a legal obligation;
• the Electricity Authority, where we may provide your personal information, including your contact details, electricity connection information, and information about your service history and engagement with us, for the purposes of assisting in resolving complaints, supporting its statutory functions, and maintaining the Electricity Registry under the Electricity Industry Participation Code 2010. Information disclosed to the Electricity Authority will be collected and held in accordance with its privacy notice, available at https://www.ea.govt.nz/privacy-notice/
• the prospective seller or buyer in the event that we buy, sell, reorganise, merge or dissolve businesses or assets;
• third parties (including legal advisors), for enforcement, dispute resolution, fraud prevention, and credit risk reduction purposes; and
• selected third parties, such as Meta, Google, and Trade Desk, who we engage to securely match user activity on the Mercury website with their Meta, Google, or Trade Desk profiles for advertising attribution, and to measure the effectiveness of advertising campaigns by tracking specific conversion actions and user engagement.

8.2  We may also disclose your personal information:

• to our group companies who may use and disclose your information for the same purposes as us;
• to manufacturers or suppliers of products or services for product warranty or guarantee fulfilment purposes;
• to credit reporting agencies (such as Centrix), where we may provide your personal information (including credit information). Centrix will collect this information and may use and disclose it, in accordance with its rights and obligations under the Credit Reporting Privacy Code 2020, for the purposes of providing credit reporting services to us and other subscribers, including sharing your information with other organisations and maintaining credit reporting information about you. For further information about how Centrix collects, uses and discloses your personal information, or to find out how to access or correct information that Centrix holds about you, you can visit https://www.centrix.co.nz/privacy-statement;
• to manufacturers or suppliers to facilitate repair of a product, or where the manufacturer or supplier has advised that they need to contact you for any issues related to the quality or safety of the product or service you have purchased; and
• to telecommunications and wholesale network service providers to the extent necessary to enable the relevant network service provider to provide services to us that enable us to supply you with the services, including to enable such network service providers to communicate with you in connection with the services. Network service providers will hold, use and disclose such information in accordance with their privacy policy. Mobile telecommunications services are delivered by the Spark Mobile Network.

8.3  If you make public comments or statements about the products or services we provide you, or the relationship we have with you, we reserve the right to make such public comments as may be necessary to respond or correct any misconceptions or errors of fact. If you make any public comments about your account, then you agree to us replying as we think appropriate using the information that we have about your account.

9  DISCLOSURE OF PERSONAL INFORMATION OUTSIDE OF NEW ZEALAND

9.1  We may disclose personal information to service providers located outside of New Zealand, including in countries such as Australia. Where we do so, we ensure that those providers are subject to privacy laws that are comparable to the New Zealand Privacy Act or otherwise provide comparable safeguards.

10  HOW WE PROTECT YOUR PERSONAL INFORMATION

10.1  We take reasonable steps to protect the personal information that we hold from misuse, loss, or unauthorised access or modification.

10.2  Mercury will ensure that your personal information is protected when logging onto our website, app, or when using My Account but while we take steps to ensure your privacy, no transmission over the internet can be completely secure.

10.3  If you suspect any misuse or loss of, or unauthorised access to, your personal information (including passwords used to access your Mercury accounts), please let us know immediately.

11  RETENTION OF PERSONAL INFORMATION

11.1  We retain your personal information and any related non-personal information, for as long as we need it to provide efficient services or meet legal obligations.

11.2  For electricity management services, where an Enrolled Device (including a hot-water cylinder) remains connected to a property after you leave, we may retain non-personal, property-level configuration information about that Enrolled Device, as part of the property’s configuration to support future service continuity.

12  ACCESSING AND CORRECTING YOUR PERSONAL INFORMATION

12.1  You may request access to any personal information we hold about you at any time by contacting us at privacy@mercury.co.nz. Your request will be processed in accordance with the Privacy Act.

12.2  If you make an access request, we’ll ask you to verify your identity. There may be instances where we cannot grant you access to the personal information we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others. If that happens, we will give you written reasons for any refusal.

12.3  We may charge a reasonable fee for making your personal information available to you or providing you with copies of it.

12.4  If you believe that personal information, we hold about you is incorrect, incomplete, or inaccurate, then you may ask us to amend it. We will then consider if the information requires amendment.

13  COMPLAINTS

13.1  If you have a privacy-related complaint, you can let us know about it through our complaints process, or via post:

Mercury
Private Bag 12023
Tauranga Mail Centre
Tauranga 3143
Attn: Privacy Officer

13.2  If you believe that your privacy concerns have not been resolved by us, or you wish to obtain more information, you can contact the New Zealand Office of the Privacy Commissioner via their website www.privacy.org.nz or free phone at 0800 803 909. Further information about how to submit a complaint is available on the Privacy Commissioner's website.