COMS Detect Privacy Statement

1. SUMMARY

What this policy covers: COMS Detect uses facial recognition technology (FRT) and related personal information to help participating venues identify individuals on authorised exclusion, banning or harm-minimisation watchlists. FRT processes sensitive information, including facial images and biometric information generated for matching. COMS does not independently store biometric templates generated during cloud-based processing.

This statement explains what information is collected, how and why it is processed, who it may be disclosed to, how long it is retained, the safeguards applied, your rights and how to contact us.

For full details, please refer to the full version of the policy below.

2. FULL PRIVACY POLICY

2.1  SCOPE

This policy applies to:

• The mobile/web application, cameras, monitoring components and associated services that form COMS Detect (the “App”), provided by COMS Systems Limited (“we”,“us”,”our”), in association with participating client venues (our “Clients”).

• The processing of personal information collected or uploaded to the App, including facial images, biometric information and transient biometric templates generated during matching, identity-verification data, patron details, patron status (excluded, banned, at-risk), alerts and logs. COMS does not independently store biometric templates after cloud-based matching is completed.

• Use in New Zealand by the Client at their venues (including but not limited to licensed premises, hotels, clubs, casinos).

• All users of the App, including venue staff, security personnel, and all individuals whose images or data are processed, which may include patrons, excluded persons, banned persons, at-risk persons and other visitors.

2.2. WHAT KINDS OF PERSONAL INFORMATION WE COLLECT

• We collect, hold and use the following types of information:

• Facial images of individuals captured at identified venue access points or monitoring zones, including images of people who do not match a watchlist.

• Biometric information, including transient biometric templates generated from facial images for automated matching. COMS does not independently store these templates after processing.

• Identity-verification data such as name, date of birth or age, photograph, membership details or exclusions status.

• Patron-status information, including whether an individual is excluded, banned, subject to harm-minimisation measures or identified as at-risk. Depending on the information supplied by a Client, this may include health or welfare-related information.

• Timestamps, location of capture (venue identity/location), entry/exit logs.

• Device identifiers and audit logs of App usage by venue staff.

• Where relevant, incident/alert data (e.g., when a match is made, what action was taken) and disclosure logs.

• Where a Client chooses to add ancillary information, this may include notes, membership records, misconduct records or relevant CCTV references. The Client is responsible for ensuring that it has lawful authority to provide that information.

Facial images and biometric information used for automated identification are sensitive information under the Privacy Act 2020, even where a biometric template is generated only transiently and is not retained.

2.3. HOW WE COLLECT PERSONAL INFORMATION

We collect information in the following ways:

• Directly at the venue: cameras or the App capture facial images at identified access points or monitoring zones. An FRT-specific collection notice should be provided at or before the time of collection.

• From the Client’s watchlists: the Client supplies authorised exclusion, banning or at-risk lists and is responsible for the lawful authority, accuracy and currency of those records.

• From the App usage: the staff capture images using the App, which are uploaded to our system.

• Automatically: via the App or monitoring system, capturing still images, logging date and time, location, and device tag.

• From third parties, such as regulatory bodies, venue-management systems, membership systems or exclusion databases, where COMS and the Client have lawful authority to collect and use the information.

We only collect personal information that is reasonably necessary for the functions and activities described in section 2.4, and we collect it by lawful and fair means.

2.4  PURPOSE OF COLLECTION, USE AND DISCLOSURE 

We collect, use and disclose personal information only for the following authorised purposes:

• To enable venue staff to identify excluded, banned, or at-risk persons upon entry or within the venue.

• To support harm-minimisation efforts (identifying persons at risk of harm or whose behaviour is of concern).

• To log incidents, provide alerting and audit trails for compliance, regulatory or safety purposes.

• To enable reporting to clients on matched events, anonymous usage statistics, system performance, and compliance.

• To maintain and update patron-status records (excluded, banned, at-risk) and to manage access control effectively.

• To manage our system operations: security, auditing, analytics (non-identifying where possible), and improvement of the App.

We may disclose personal information:

• To the Client venue, when the system makes a match or alert regarding an individual.

• To contracted service providers acting on our behalf, such as cloud-hosting, face-matching and technical-support providers, where access is necessary and subject to contractual privacy, security, retention and confidentiality obligations.

• To regulatory, law enforcement or emergency authorities where the disclosure is required or authorised by law, or otherwise permitted in connection with a serious threat, unlawful activity or serious misconduct.

• To centralised exclusion system, another authorised Client venue or a related entity only where the Client has lawful authority, the disclosure is consistent with the notified purpose and appropriate security controls are applied.

• To overseas recipients? We do not routinely disclose personal information to overseas recipients, except as described below. Personal information collected in New Zealand is securely transmitted to and processed in Australia using cloud-based infrastructure. We take reasonable steps to ensure that any overseas processing provides comparable safeguards to those required under New Zealand privacy law. We do not transfer personal information beyond Australia unless required for specific operational purposes, in which case appropriate safeguards will be applied. If this changes, we will update the policy and advise affected individuals.

• We do not sell personal information to third parties for marketing purposes.

2.5. HOLDING AND SECURITY OF PERSONAL INFORMATION

• We protect personal information using encryption in transit and at rest on secure cloud infrastructure, together with access, monitoring and other technical and organisational safeguards.

• Access to facial images, watchlist information, alerts and related records is restricted to authorised personnel and is subject to role-based controls, logging and audit.

• Venue staff access via the App is role-based, with unique credentials, multi-factor authentication (where enabled) and periodic review of access rights.

• We maintain incident response procedures for data breaches and will comply with the obligations under the Privacy Act 2020, including notifying the Office of the Privacy Commissioner and affected individuals where a privacy breach is likely to cause serious harm.

• We maintain logs of who accessed, modified, or disclosed data, and conduct regular security risk assessments in accordance with applicable legal and regulatory requirements, including the Privacy Act 2020 and guidance issued by the Office of the Privacy Commissioner (OPC).

• We retain personal information only as long as reasonably necessary for the purpose for which it was collected, or as required or authorised by law. Section 5 describes the applicable retention and deletion approach.

2.6. ACCESS AND CORRECTION

• Individuals may request access to their personal information held within our system, or request correction of inaccurate or out-of-date information.

• To make such a request, please contact us (see section 2.9) and provide sufficient detail to identify yourself and the information sought.

• We will respond within a reasonable and practicable period, and no later than 20 working days (as required by the Privacy Act). If additional time is reasonably required, we will explain the reason and provide a revised timeframe.

• If we refuse access or correction, we will generally provide a written notice explaining the reasons and the available compliant mechanisms, except where it would be unreasonable or unlawful to do so.

• If you believe that our information about you is incorrect (for example, a “match” alert was incorrect), you may request correction, and we will take steps to verify and correct the record or mark it as disputed if necessary.

2.7  COMPLAINTS

• If you believe we have breached the Information Privacy Principles, this privacy policy, or your privacy rights, you may lodge a complaint with us.

• We will acknowledge and investigate privacy complaints promptly, keep you informed of progress and aim to provide a substantive response within 20 working days where practicable.

• If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner (OPC) at www.privacy.org.nz or by calling 0800 803 909.

2.8. OVERSEAS DISCLOSURE

As noted above, personal information collected in New Zealand is processed and stored in Australia. We take reasonable steps to ensure that comparable privacy protections apply to that information.

We do not transfer personal information beyond Australia unless necessary for the purpose described in this Privacy Statement, and appropriate safeguards will be applied.

2.9. CONTACT DETAILS

For any questions about this privacy policy, or to request access to or correction of your personal information, please contact:

COMS Systems Limited (www.coms.net.nz)
Email: privacy@coms.net.nz
Phone: 0800 266 797

For privacy complaints, please contact: complaints@coms.net.nz

We encourage individuals to contact us first so we can attempt to resolve any concerns.

2.10. CHANGES TO OUR POLICY

We may update this policy from time to time (e.g., when our App functionality changes). We will publish the revised version on our website and notify Clients. The latest version always applies.

3.  ADDITIONAL CUSTOMISED CLAUSES FOR FACIAL RECOGNITION / HARM-MINIMISATION

Because the App uses facial recognition technologies to perform automated facial identification, it processes sensitive information. The following provisions explain the additional safeguards and responsibilities that apply:

3.1. BIOMETRIC/FACE-RECOGNITION PROCESSING

• The App performs one-to-many facial identification against authorised watchlists supplied or approved by the Client. It is not intended for general identification of all patrons or for unrelated profiling.

• Facial recognition processing captures a facial image, extracts facial features into a transient biometric template and compares the resulting biometric information with facial images on an authorised watchlist. This is the collection and processing of sensitive information even where the template is rapidly discarded. COMS does not independently retain the transient biometric template after cloud-based matching is completed.

• Lawful basis: Each venue deployment must have a documented basis for collecting and using biometric information that complies with the Privacy Act 2020 and the Biometric Processing Privacy Code 2025. The venue must be able to demonstrate that the collection is necessary for a lawful purpose connected with its functions or activities, and that the purpose cannot reasonably be achieved in a less privacy-intrusive manner. Where consent is relied upon, it should be informed, voluntary and meaningful. Signage or entry to a venue does not, by itself, constitute consent. Any venue-specific justification for the collection and use of facial recognition technology must be assessed and documented.

• Collection notice: The Client must provide clear, prominent and facial recognition technology (FRT)-specific notice at or before the time of collection. The notice should explain that:

  • Facial recognition technology is operating

  • The purpose for which biometric information is collected and used

  • The categories of information processed, any usual disclosures, any consequences of not providing the information where applicable, and how individuals can obtain this Privacy Statement or contact the venue and COMS.

  • A general CCTV notice is not sufficient.

• Accuracy and human oversight: COMS Detect provides a similarity alert only. Trained venue personnel must independently verify a potential match and make the final operational decision. No adverse action should be taken solely because the system generated an alert.

• Data minimisation and purpose limitation: We collect and retain only the images, identifiers and records reasonably necessary for authorised matching, verification, incident management, security and audit. The system is not used for general profiling, marketing or unrelated secondary purposes.

• Images are limited to cropped facial images (headshots) rather than full-frame imagery wherever the system configuration permits. Full-frame imagery is not retained by COMS Detect.

• Facial recognition processing is performed using cloud-based services that analyse images to identify similarities. Transient biometric templates generated for matching are not independently stored by COMS; facial images and permitted event records are handled in accordance with section 5.

• Retention and deletion: Retention depends on whether there is a match or a defined incident or lawful request. No-match information is retained only for the limited periods described in section 5, and matched-event records are retained only for documented operational, legal and audit purposes. Information is securely deleted or irreversibly de-identified when it is no longer required.

• Privacy risk management: We undertake and periodically review privacy impact and proportionality assessments for biometric processing, including lawful basis, necessity, transparency, accuracy, bias, retention, third-party, security and human-oversight risks.

• Biometric processing assessment: A summary of our assessment is available on request – please contact privacy@coms.net.nz to request a copy.

• Vulnerable persons: Where at-risk persons (e.g., persons with impaired decision-making capacity) are involved, venue staff must follow additional harm-minimisation protocols, ensure safe-space response and liaise with appropriate welfare services as required.

• Training and audit: Venue staff using the system must be trained in responsible use and privacy obligations (including not misusing matches), and we conduct periodic audits of system usage for compliance and proper use.

3.2.  MEMBERSHIP/EXCLUDED/BANNED PERSONS LIST MANAGEMENT

• The Client is responsible for the lawful authority, accuracy, currency and appropriate review of each membership, exclusion, banning or at-risk watchlist entry, and for complying with relevant legislation, licensing conditions and venue policies.

• We process the list strictly for the approved purpose of match-detection at venue access. The list is securely transmitted and stored in an encrypted form.

• When the system identifies a potential similarity, an alert is generated for trained venue personnel to review. The Client is responsible for independently verifying the match and making any decision about entry, exclusion, removal or welfare support. The system does not make the final decision.

• We log match events, including date, time, venue, staff user, confidence information and follow-up action where recorded. Those logs are made available to authorised Client personnel for audit, complaint handling and compliance purposes.

3.3  AT-RISK PERSONS/HARM-MINIMISATION

• The system may be used to identify individuals placed by the Client on an authorised at-risk or harm-minimisation watchlist, for example because of documented welfare, intoxication or behavioural concerns.

• Match to at-risk persons triggers alerts to venue staff and may prompt tailored responses (e.g., welfare check, escort, referral to support). The processing of at-risk person data is subject to heightened sensitivity.

• The Client must identify and document the lawful basis for collecting and using at-risk information and provide the required collection notice. Consent must be obtained where required by law; notice or entry to the venue should not be described as consent unless the consent is valid, voluntary, informed, current and specific.

• The system compares faces captured in the defined monitoring zone only for the authorised watchlist purpose. It is not used to identify or profile non-watchlist patrons for marketing, behavioural analysis or unrelated purposes.

3.4. DISCLOSURE TO THIRD PARTIES

• Third-party service providers and sub-processors, including cloud-hosting, face-matching and support providers, must be subject to appropriate due diligence and contractual privacy, security, access, retention, deletion, audit and data-breach obligations.

• Match information may be disclosed to law-enforcement or regulatory bodies only where required or authorised by law, or otherwise permitted under the Privacy Act. The basis and details of the disclosure should be recorded.

3.5.  CLIENT RESPONSIBILITIES

As the venue or Client using our App, you are responsible for:

• Providing an FRT-specific collection notice at or before capture. Suggested notice: “Facial recognition technology is operating at this venue to assist with authorised exclusion,

• banning and harm-minimisation measures. Facial images and biometric information are processed for matching. For information about retention, disclosures and your rights, see [privacy notice/QR code] or contact [details].” The Client must not state that entry constitutes consent unless it has established a valid consent process.

• Establishing and documenting the lawful basis, necessity and proportionality of FRT at the venue before activation, and supplying and maintaining accurate, authorised watchlists in the agreed format.

• Ensuring venue personnel are properly trained in privacy obligations, use of the App, independent match verification, false-positive escalation, harm-minimisation procedures and access to personal information.

• Ensuring that any follow-up actions (e.g., refusal of entry, safe removal, welfare checks) comply with relevant legislation, licensing conditions, harm-minimisation requirements, and that data-handling flows are consistent with this policy.

• Making this privacy statement and any venue-specific collection notice readily available, and responding to patron questions or directing them to the appropriate contact.

• Cooperating with audits or reviews of system use, match-logs and data-handling practices, when requested.

5. RETENTION AND DE-IDENTIFICATION POLICY

• Matched-event records, including relevant image captures, identifiers and audit logs, are retained only for as long as reasonably necessary for incident management, exclusion administration, legal obligations and audit under a documented retention schedule. The duration of a membership or exclusion is not automatically the retention period for every image or event record.

• No-match image captures may be retained for an initial operational period of up to 72 hours. Following this period, image data are moved to a restricted storage environment for continued retention for up to 30 days. Access to this restricted storage environment is limited to a small number of authorised personnel and is used for incident investigation, security purposes, and responding to lawful requests (for example, from law enforcement or regulators). No-match images are securely deleted when the retention period expires.

• After the applicable retention period expires, we securely delete or irreversibly de-identify the information. Deletion procedures apply to active systems, restricted storage, caches, and provider-held copies to the extent technically applicable. Transient biometric templates are not independently stored by COMS.

• We may retain aggregated, non-identifying statistical data (e.g., number of matches per month, system usage metrics) indefinitely for analytics, improvement, and compliance reporting.

6.  DATA BREACH AND INCIDENT RESPONSE

• In the event of an eligible data breach involving personal information, including facial images or biometric information, we will follow our data-breach response plan and notify affected individuals and the Office of the Privacy Commissioner (OPC) as required by the Privacy Act 2020.

• We will also inform the Client venue without undue delay so that coordinated response can occur (e.g., patron notification, regulatory filings, mitigation).

• We conduct periodic security reviews and audits of the system, access logs, and use of the App to detect misuse or inappropriate access.

 7.  YOUR RIGHTS AND CHOICES

You have the following rights:

• You may request access to personal information held about you and request correction where it is inaccurate, out of date, incomplete, irrelevant or misleading. Access may be subject to lawful exceptions and, where information is held by the Client, we may refer the request to the Client.

• You may ask how your information was processed, raise a concern about a potential match and make a privacy complaint. Where consent is the lawful basis, you may withdraw consent for future processing, subject to any legal or operational consequences explained at the time consent is sought.

• You may request that the Client or we investigate a disputed match and correct or annotate the relevant record where appropriate.

• You may request this statement in an accessible alternative format and may contact us for further information about the operation of the App.

• You can ask questions or make a complaint if you believe your privacy has been breached (see section 2.7).

• You can request our policy in an alternate format if required.

We will not disadvantage you for making an access, correction or privacy complaint request. This does not affect lawful venue-access restrictions or exclusion requirements.

8. GLOSSARY AND DEFINITIONS

Excluded person: an individual who is not permitted entry to the venue under the venue’s or regulatory body’s policy.

Banned person: an individual formally banned by the venue or regulatory body from access.

At-risk person: an individual identified by the venue (or regulatory body) as requiring additional safety/harm-minimisation measures (e.g, because of intoxication, behavioural risk, self-harm risk).

Biometric template: a mathematical representation generated from facial imagery for matching. The App uses transient templates during cloud-based processing and does not independently store them after matching is completed.

Face-matching: the process of comparing biometric information derived from a captured facial image with facial images on an authorised watchlist. A similarity alert is subject to independent human review before any action is taken.

Client: the venue, club or operator using our App and supplying the patron-status lists.

We/Us/Our: COMS Systems Limited, the provider of the App and associated biometric/matching service.

9. POLICY REVIEW AND VERSION CONTROL

This policy is Version 2.1, Ref: 3305046576, dated 27 October 2026. We will review it at least annually or sooner if our systems, processing or legal/regulatory environment changes. Clients will be notified of material changes (including via update notices in the App or by direct email).