Privacy Policy

Last Updated: 6 November 2026

1          Introduction

At XFunge, accessible from www.xfunge.com and www.xfunge.co.nz, the privacy of our clients and their members is a core priority.

XFunge provides a managed service that creates digital membership cards and other wallet passes and issues them into Apple Wallet and Google Wallet on behalf of clubs, businesses and organisations (“Clients”). We act as a Data Processor, processing personal data strictly on behalf of our Clients, who are the Data Controllers.

This Privacy Policy explains what information is collected, how it is used and protected, and how privacy rights are exercised. It should be read together with the XFunge Terms and Conditions.

2          Scope

This policy applies to personal data processed through the XFunge website, the XFunge client portal, and the card services XFunge provides. It does not apply to information collected offline or through systems operated independently by Clients.

Members receive their card by email and keep it in Apple Wallet or Google Wallet. XFunge does not operate its own app. Apple and Google handle cards stored on a member’s device under their own privacy policies.

3          Role of XFunge

Data Controller: The Client that issues the membership or loyalty card decides what member data is supplied and the purpose it is used for.

Data Processor: XFunge processes personal data solely on documented instructions from the Client. Uploading a CSV file of member details through the client portal is an instruction to issue cards to the members listed in it.

4          Information We Collect

Member information. Clients supply only the details needed to issue and deliver a card, which may include:
- Name
- Membership number or member identifier
- Email address, used to send the card
- Phone number, where the Client supplies it
- Membership type

Client information. Contact details for the Client’s representatives, account and billing details, and the logos, images and content supplied for card templates.

Client payment information. When a Client pays an invoice, the payment is processed by Stripe, a third party payment provider. The Client may choose to save its payment details for future invoices, and these are stored by Stripe under its own privacy policy. This applies only to the Client as the paying club or business, never to its members.

Website and portal information. Technical information such as IP address, browser type and device information when people visit the website or use the client portal.

XFunge does not collect KYC documents, government identification, members’ payment details, or data granting financial rights. Clients must not include sensitive information, payment card details or passwords in any CSV file.

5          How Information Is Used

Member information is used solely to:
- Create membership or loyalty cards
- Send each card to the member by email
- Update or void a card, or resend the card link via email for an existing card, where the Client requests it and the platform allows it
- Provide support to the Client

Client information is used to provide the service, communicate with the Client, and invoice fees.

Member details are not entered into XFunge’s CRM or any custom list or database. XFunge does not market to members and does not use personal data for profiling.

6          Cookies and Tracking Technologies

The XFunge website uses cookies and similar technologies for technical operation, session management, performance monitoring and measuring the effectiveness of advertising.

Cookies relate only to Client administrators and other visitors using the XFunge website and client portal. They do not relate to members. Members receive their cards by email and do not need to use the XFunge website or client portal, and member details are not linked to any cookie or tracking data.

Cookies that are not essential are used only with consent where the law requires it.

7          Log Files

Log data such as IP address, browser type, device information, and timestamps may be collected from the website and client portal for security monitoring and troubleshooting purposes. This information is not used to profile individuals.

8          Data Retention

Clients are responsible for the files and content they upload to the client portal, and are free to delete their files once the cards have been issued. XFunge may also delete files from the portal once the cards have been issued.

Card details held by the pass issuing platform are kept for the life of the card.

A card stays on a member’s device until the member deletes it. Neither XFunge, Apple nor Google can remove a card from a device remotely.

Upon instruction from the Client, member data held by XFunge is securely deleted or returned, subject to legal obligations.

9          Data Security

XFunge implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, or disclosure.

Access to each Client’s area of the client portal is limited to that Client’s authorised users and XFunge.

10       Cross Border Data Transfers

The pass issuing platform, Apple, Google and other service providers may store or process personal data outside New Zealand. Where personal information is sent overseas, XFunge takes reasonable steps to ensure it is protected in a way comparable to the Privacy Act 2020.

11       Member Privacy Rights

Members exercise their privacy rights, including requests to access or correct their information, through the Client that issued their card. XFunge provides reasonable assistance to Clients in responding to access, correction, or deletion requests.

Members can delete their card from Apple Wallet or Google Wallet at any time.

12       Children’s Privacy

Some Clients issue cards to junior members. Where a Client supplies details of a child, the Client is responsible for having the appropriate consent from a parent or guardian. XFunge does not knowingly collect personal data directly from children.

13       Third Party Services

XFunge uses third party service providers to deliver the service, including:
- A pass issuing platform that creates and delivers cards
- Apple Wallet and Google Wallet, which store cards on members’ devices
- Stripe, which processes Client invoice payments
- The client portal and email delivery providers
- Cloud hosting providers

Providers that process personal data on XFunge’s behalf are bound by contractual data protection obligations.

14       Data Breaches

In the event of a personal data breach, XFunge will notify the affected Client without undue delay and provide the information the Client needs to meet any obligation to notify the Privacy Commissioner and affected members.

15       Changes to This Policy

This Privacy Policy may be updated from time to time. XFunge will notify Clients of material changes by email. Updated versions take effect upon publication.

16       Contact Information

For privacy enquiries, contact:
Email: [email protected]
Websites: www.xfunge.com and www.xfunge.co.nz