Effective date: 1 November 2026
Last updated: 1 November 2026
Status: Operative.
This privacy notice explains how Rackteck (“we”, “us”, “our”) collects, uses, stores, and shares personal information when you use our websites, ERPNext hosting, and NextLedger NZ Localisation products and services — including via third party connectivity & hosting services under our direct control.
1. Who we are
| Legal entity | McNeill Computers Ltd |
| Trading brands | Rackteck |
| Product brand | NextLedger NZ (NZ localisation for ERPNext) |
| NZ company | 575839 |
| Physical address | 25a Bird Lane, Wakefield 7025, Tasman |
| Privacy contact | privacy@rackteck.co.nz |
| General contact | support@rackteck.co.nz or +64 21 721 015 |
We are an agency under New Zealand’s Privacy Act 2020. This notice is intended to meet Information Privacy Principles (IPPs) in plain language suitable for SME customers.
2. Scope
This notice covers:
- Visitors to our public marketing websites (Rackteck / NextLedger).
- Customers and authorised users of ERPNext sites we host or configure.
- Financial & personal account data obtained through third party services when you connect a data source to our software.
Additional product terms, hosting agreements, or customer contracts or obligations may apply for those services, in addition to this notice.
3. What personal information we collect
3.1 Information you give us
- Identity and contact details (name, email, phone, organisation).
- Account and billing details for our services.
- Content you enter into ERPNext / NextLedger (customers, suppliers, invoices, journals, etc.).
3.2 Information from connected accounts
When you authorise enduring access through a third party, we may receive:
| Category | Examples |
|---|---|
| Account metadata | Institution, account name/type, masked or formatted account numbers, connection status |
| Balances | Available and/or current balances as supplied by the institution |
| Transactions | Date, amount, description, type; NZ payment fields; Merchant data |
| Connection / consent metadata | Authorisation identifiers, scopes granted, timestamps, webhook events (e.g. token revoked, account inactive) |
Access is enduring (ongoing) for feeds used in accounting: we retrieve history, then fetch updates on a recurring schedule until or unless you revoke access.
We do not receive your bank login credentials. Authentication with your bank is handled by OAuth and API tokens.
3.3 Technical and usage data
- Server and application logs (IP address, user agent, timestamps, error diagnostics).
- Authentication events (login, MFA challenges) on hosted ERPNext sites.
- Minimal website analytics if enabled on the public site (see §11).
4. How we use personal information (purposes)
We use personal information to:
- Provide accounting and bank reconciliation — import balances and transactions into ERPNext Bank Transaction records for matching against invoices, payments, and journals in NextLedger NZ Localisation.
- Operate and support hosted ERPNext / NextLedger sites for you
- Maintain security — authenticate users, detect abuse, investigate incidents.
- Meet legal obligations — e.g. tax, dispute, or regulatory requirements where applicable.
- Improve the service — diagnose sync failures, improve mapping and reconciliation quality (aggregated or de-identified where practicable).
We do not sell personal information. We do not use internally or externally-sourced data for any advertising.
6. Legal basis and Privacy Act 2020
Under the Privacy Act 2020 we collect and use personal information only for lawful purposes connected with our functions, and only where that is necessary for those purposes (IPPs 1–4). In practice for NZ organisations:
| Situation | Typical basis |
|---|---|
| You connect an account and we sync feeds | Consent plus requirements necessary for the contracted service |
| Hosting, support, security, billing | Necessary to perform the contract / provide the service you requested |
| Legal, tax & dispute | Legal obligation or necessary for a lawful purpose where disclosure is required or authorised |
You may withdraw consent for connectivity at any time by revoking access (see §9). Withdrawal does not affect processing already lawfully completed.
7. Storage and security
We apply security measures appropriate to financial account data, including:
- Encryption in transit — TLS for all public HTTPS endpoints and API traffic.
- Encryption at rest — database and backup encryption on hosted infrastructure.
- Server-side secrets only — App Secret and User Access Tokens are stored as encrypted Password fields in ERPNext.
- Access control — role-based permissions in ERPNext; least-privilege for operators.
- MFA — multi-factor authentication is available and expected for users who administer connections on ERPNext Desk.
- Network — production sites are hosted on infrastructure sourced through Digital Ocean.
No security measure is perfect; threat actors have powerful tools, please use strong passwords, enable MFA, and tell us promptly of suspected unauthorised access.
8. Retention
We keep personal information only as long as reasonably required for the purposes above (Privacy Act retention principle), including:
- While you are a customer — transaction and account data needed for accounting history, audit, and reconciliation.
- After you revoke external access — we stop fetching new data; we delete or anonymise external data that is no longer reasonably required. Retained ledger artefacts that form part of your accounting records (e.g. posted Bank Transactions already used in books) may be kept under normal accounting retention for the company, or deleted if you close the site and request full erasure where that does not conflict with legal retention duties.
- After account closure — we revoke remaining external tokens and delete within a reasonable period, except where we must retain it for legal, tax, or dispute purposes.
Backups age out on a defined schedule; residual copies may persist until those backups expire.
9. Sharing and processors
We share personal information only as needed to run the service:
| Recipient | Why |
|---|---|
| Third parties | Consent, connection, and data exchange |
| Hosting / processors on terrace | Operate ERPNext databases, apps, backups, and monitoring |
| Your authorised users / advisors | Access you grant inside ERPNext |
| IRD, banks, courts, regulators | Only when required or authorised by law, or necessary to provide a feature you request (e.g. IRD filing integrations) |
We do not sell personal information to third parties for marketing.
10. Access, correction, and complaints
Under the Privacy Act 2020 you may request access to, or correction of, personal information we hold about you.
- Email: as above in contacts.
- We will respond within the timeframes required by the Act.
If you are not satisfied, you may complain to the Office of the Privacy Commissioner:
- https://www.privacy.org.nz/
- Phone: 0800 803 909
11. Overseas disclosure
Production ERPNext sites and primary databases for NextLedger / Rackteck customers are operated from New Zealand on infrastructure provided by Digital Ocean in San Francisco. DO only see encrypted data.
12. Cookies and analytics on our website
Our public website details our service offerings, and uses:
- Essential cookies for security and basic site function.
- We do not rely on advertising trackers.
13. Age
Our services are directed to businesses and commercial users. We do not knowingly collect personal information from or about persons under 18.
14. Changes
We may update this notice from time to time. The effective date at the top will change when we do. Material changes affecting external data exchange will be communicated to affected customers where practicable. Ongoing accreditation may require that we notify third parties of changes that affect compliance with their requirements.