Standa
Standa is a marketing-standards platform operated by Workhouse Marketing Limited, trading as Mighty and Standa. This Privacy Policy explains what personal information Standa collects, how we use and disclose it, how we keep it safe, and the rights you have over it. It is written to meet our obligations under the New Zealand Privacy Act 2020 and, where it applies to individuals in Australia, the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Standa is owned and operated by Workhouse Marketing Limited, a company incorporated in New Zealand that trades as Mighty and Standa (“Standa”, “we”, “us” or “our”). In this policy, “Standa” means the platform and the websites at standa.io and its subdomains (including app.standa.io and each Network’s own network.standa.io address).
Our contact details for privacy matters are set out in section 18. We are the “agency” responsible for personal information under the New Zealand Privacy Act 2020, and an “APP entity” in respect of personal information about individuals in Australia, in the circumstances described in section 2.
| Operator | Workhouse Marketing Limited (trading as Mighty and Standa) |
|---|---|
| Address | 77 Grafton Road, Auckland, New Zealand |
| NZBN | 9429042204350 |
| Privacy contact | info@standa.io |
Standa is a multi-tenant platform. Depending on the information involved, we act in one of two roles:
Most of the information about member businesses and their people — business details, self-assessment responses, coaching notes, scores, and marketing data connected to the Network — is handled by us on behalf of, and on the instructions of, the Network that engaged us. For this information the relevant Network is the agency (in New Zealand) or APP entity (in Australia) responsible for deciding how the information is used, and Standa acts as its service provider. If you are a member of a Network and want to exercise your privacy rights over that information, you can contact us or the Network directly (see section 15), and we will assist the Network to respond.
We act as the responsible agency in our own right for information we collect to run Standa as a business — for example, account and login records for administrators and staff, security and audit logs, billing contacts, support correspondence, and information collected from visitors to our public websites.
This policy describes our practices in both roles. Where a Network has its own privacy policy, that policy governs the Network’s own decisions about its members’ information; ours governs how the Standa platform itself operates.
This policy applies to personal information collected through the Standa platform, our websites, our transactional and support emails, and our dealings with customers and prospective customers. It does not apply to third-party websites or services that we link to or that you connect to Standa (such as Google or Meta), which are governed by their own privacy policies.
We collect the following categories of personal information. Not all of it applies to every person — what we hold about you depends on your role.
We collect most information directly from you or from the Network that authorised your access. Some information — particularly connected marketing data — is collected from third-party platforms with authorisation, as described next. We generally do not collect sensitive information (as defined under the Australian Privacy Principles), and ask that you do not submit it through the platform.
A core feature of Standa is the ability to bring a member’s own marketing performance data into their scorecard. To do this, a Network or member authorises Standa — through the relevant platform’s standard, permission-based sign-in flow (OAuth) — to read data from accounts such as:
We request read-only access sufficient to retrieve performance metrics and the account/property information needed to match data to the correct member location. We do not post content, change settings, or make purchases through these connections. Authorisation is given voluntarily and can be withdrawn at any time by disconnecting the account in Standa or by revoking Standa’s access in the relevant platform’s security settings; once revoked, we stop retrieving new data from that account.
Where a Network chooses to connect through a single agency-held account rather than each member connecting their own, that access is restricted to authorised platform administrators and is used only to map and retrieve data for that Network’s members.
Standa’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, data obtained from Google accounts you connect is used only to provide and improve the reporting and scorecard features you have asked Standa to perform; is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; is not used for advertising; and is not read by humans unless you give explicit consent, it is necessary for security or to comply with law, or the data has been aggregated and de-identified.
We use personal information to:
We do not sell personal information, and we do not use it for third-party advertising or share one Network’s information with any other Network.
Under the New Zealand Privacy Act 2020 we collect personal information for lawful purposes connected with operating Standa, and only where collection is necessary for those purposes, consistent with Information Privacy Principles 1–4. For individuals in Australia, we handle personal information in accordance with the Australian Privacy Principles, collecting it by lawful and fair means and only where reasonably necessary for our functions and activities. Where we rely on your consent — for example, to connect a marketing account — you may withdraw it at any time as described in section 5.
We disclose personal information only as needed to run Standa and as permitted by law:
We rely on the following categories of providers to deliver Standa. This list may change from time to time; the current list reflects our providers as at the effective date above.
| Provider | Purpose | Where processed |
|---|---|---|
| Supabase | Managed database, authentication and file storage — the primary store of platform data | Overseas (see section 12) |
| Netlify | Application hosting and content delivery | Overseas |
| Windsor.ai | Connector layer that retrieves marketing performance data from connected accounts | Overseas |
| Transactional email provider | Delivery of invitations, sign-in links, and service notifications | Overseas |
| Google & Meta | Sources of connected marketing data you authorise (section 5) | Overseas |
A current list of sub-processors is available on request from info@standa.io.
Standa is a cloud service, and some of our providers (including those in section 11) store or process information on servers located outside New Zealand and Australia. Where we disclose personal information to an overseas provider, we take reasonable steps to ensure it is protected by comparable safeguards — through contractual commitments, the provider’s security standards, and, for information about individuals in Australia, in a manner consistent with Australian Privacy Principle 8. By using Standa you acknowledge that your information may be stored and processed overseas. If you would like to know the countries in which your information may be held, contact us at info@standa.io.
We take the security of personal information seriously and apply safeguards appropriate to its sensitivity, including:
No system can be guaranteed completely secure. If a privacy breach occurs that is likely to cause serious harm, we will notify affected people and the New Zealand Office of the Privacy Commissioner (and, where applicable, the Australian Office of the Australian Information Commissioner) as required by law, and we will support any Network in meeting its own notification obligations.
We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law or by our agreement with the relevant Network. When a Network’s use of Standa ends, we will, on request and in line with that agreement, return or securely delete the personal information we hold on its behalf, except where we are required to retain it (for example, for legal, tax or audit reasons) or where it has been aggregated and de-identified so that it no longer identifies anyone. Information we hold in our own right is retained for as long as reasonably necessary for the purpose it was collected.
You have rights over the personal information we hold about you:
To make a request, contact us at info@standa.io. If your request relates to information we hold on behalf of a Network, we will either help you directly or pass your request to the Network responsible for that information and assist them to respond. We will respond within the timeframes required by law (20 working days in New Zealand; a reasonable period, generally within 30 days, in Australia). We may need to verify your identity first, and in limited cases the law allows us to decline a request — if so, we will explain why.
Standa is a business tool intended for use by adults in a professional capacity. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this policy from time to time to reflect changes to the platform, our providers, or the law. When we do, we will change the “last updated” date above and, where the changes are significant, take reasonable steps to notify affected Networks or users. The version published at standa.io is the current version.
If you have a question, a request, or a concern about how we handle personal information, please contact our Privacy Officer:
| info@standa.io | |
| Post | Privacy Officer, Workhouse Marketing Limited, 77 Grafton Road, Auckland, New Zealand |
We take complaints seriously and will work with you to resolve them. If you are not satisfied with our response, you can complain to the relevant regulator: