Data residency and sovereignty

Why this page exists

Public sector, health and education buyers in New Zealand and Australia are usually required to establish where information is held before they can approve a system. This page answers that in one place, so it does not have to be extracted through a questionnaire.

Where data is stored

Primary storageAustralia — AWS Sydney region (ap-southeast-2)

Cloud providerAmazon Web Services

IncludesDatabase, file attachments, photographs and audit logs

Notice of changeWe give reasonable prior notice of any material change to the hosting region.

Be aware if you are a NZ public sector buyer

Data is hosted in Australia, not New Zealand. For most NZ buyers this is acceptable and common — Australia is a comparable jurisdiction and AWS Sydney is the standard regional choice. If your procurement policy requires onshore New Zealand storage specifically, raise it early so we can address it directly rather than at contract stage.

Contracting entity and jurisdiction

New Zealand, Australia and the PacificTeammate App Limited (NZBN 9429050771240), Level 4, 110 Symonds Street, Grafton, Auckland, New Zealand. Fees in NZD plus GST where applicable.

ElsewhereTeammate App FZ-LLC, Building 5, Dubai Media City, Dubai, United Arab Emirates. Fees in USD.

Governing lawNew Zealand, with the exclusive jurisdiction of the New Zealand courts.

Your contracting entity is specified in your Order Form. Neither entity is responsible for the obligations of the other.

Who can access it, and from where

Your users, as configured by your administrators.
Our support and engineering staff, on a least-privilege basis, only where required to support you, with production access restricted and logged.
Sub-processors, limited to what their function requires.

Sub-processors and their locations

Hosting and infrastructureAmazon Web Services — Sydney, Australia

Email deliveryAmazon SES (Sydney, Australia) as primary, with Google Workspace as backup

Error and performance monitoringConfirm provider and region

Support deskHubSpot — support ticketing

AnalyticsConfirm provider and region

AI providers (where AI features are enabled)AI features are delivered through third-party providers engaged as sub-processors — confirm which, and their regions

Each sub-processor is bound by obligations no less protective of customer data than our Terms. A current list is maintained and provided on request, and we give notice of material changes to it.

Cross-border transfers

Where personal information is transferred outside New Zealand, we do so consistent with Information Privacy Principle 12 of the Privacy Act 2020 — meaning the receiving party is subject to comparable safeguards through contractual terms.

Lawful access requests

1.We will not disclose customer data in response to a request unless legally compelled.
2.Where we receive a request for customer data, we will direct the requester to the customer wherever we are permitted to do so.
3.Where we are compelled to disclose, we will notify the affected customer unless legally prohibited from doing so.

Deletion and return

Export windowOn request made within 30 days of expiry or termination, in a commonly used format.

DeletionDeleted or de-identified within 90 days after that window.

BackupsResidual copies in backups are deleted on our rolling backup cycle.

ExceptionsRetention where required by law.

ConfirmationWritten confirmation of deletion available on request.

What we will not publish

We will not publish specific server addresses, infrastructure diagrams or control detail that would weaken security. Those are available under NDA as part of the security pack.

Residency and sovereignty enquiries: support@teammateapp.com.

Data residency