Payments Privacy Policy For Subscription Businesses

Do you really need a payments privacy policy for your subscription business, or can your usual privacy policy do the job?

The reassuring answer is that you usually don't need a completely separate document. But if you take recurring payments, your privacy policy should clearly explain how billing, payment processors and customer account data work in practice.

Customers are trusting you with more than an email address. They may be creating an account, saving a card, choosing a plan, receiving invoices, pausing subscriptions or disputing a payment. A clear payments privacy policy in NZ helps you meet your Privacy Act 2020 obligations and gives customers confidence that you know what you're doing.

Do I Need A Payments Privacy Policy For Recurring Billing?

Yes, if your subscription business collects personal information for recurring billing, your privacy policy should cover payment-related data in a clear and specific way.

Under the Privacy Act 2020, you need to be open about why you collect personal information, how you use it, who you share it with, how long you keep it and how customers can access or correct it. Payment information can include more than card numbers. It can include names, billing addresses, email addresses, transaction records, subscription status, invoice history and fraud checks.

For many subscription businesses, the payment processor holds the full card details rather than the business itself. That's a good thing from a risk perspective, but it doesn't remove your privacy responsibilities. You still decide to use that processor, you still collect account information, and you may still receive tokens, card type, the last four digits of a card, payment status and billing history.

Say you run an online pilates membership for $39 per month. Your platform stores customer names, emails, plan type, renewal dates, failed payment notices and invoice history. Stripe or another processor stores the card details. Your privacy policy should explain both parts, because customers won't know where the line sits unless you tell them.

This doesn't have to be complicated. The goal is to be accurate, plain-English and consistent with how your checkout, subscription terms and account settings actually work.

What Payment Information Should My Privacy Policy Cover?

Your policy should cover every type of personal information your business collects, creates or receives in connection with subscription payments.

Start by mapping what happens from sign-up to cancellation. You may be collecting personal information when a customer:

• creates an account
• chooses a subscription plan
• enters billing details
• uses a discount code or gift card
• updates their payment method
• pauses, upgrades or downgrades their subscription
• contacts support about a payment
• requests a refund
• raises a chargeback with their bank

Your privacy policy shouldn't say you collect card details if you don't actually see or store full card numbers. It's usually better to be precise. For example, you might say your payment processor collects and processes card details, while your business receives payment status, transaction references, invoice information and limited card details such as card type and last four digits.

You should also cover customer account data. For a subscription service, this may include login details, subscription preferences, usage history, support messages, delivery details for physical subscriptions, and communications about renewals.

If you use analytics tools to track subscription behaviour, such as churn, conversion or failed payment recovery, say so in a practical way. You don't need to list every internal dashboard, but customers should understand that you use account and transaction information to manage, improve and protect your service.

How Should I Explain Payment Processors And Overseas Sharing?

You should clearly name or describe the types of third parties that handle payment data, especially where information may be stored or accessed overseas.

Most NZ subscription businesses use payment processors, hosting providers, customer support tools, email platforms and subscription management software. These providers may be based overseas or use overseas infrastructure. Under the Privacy Act 2020, Information Privacy Principle 12 deals with disclosing personal information outside New Zealand.

In plain English, you need to take care when sending personal information offshore. Depending on how the arrangement is structured, you may need to be satisfied the overseas recipient has comparable privacy protections, or rely on another permitted basis. Processor arrangements can be technical, so this is an area where tailored advice is often worthwhile.

What Customers Usually Need To Know

Your privacy policy should tell customers:

• that you use third-party payment processors to process recurring payments
• whether those processors may store or access information outside New Zealand
• what payment-related information you share with them
• why you share it, such as to process payments, manage refunds, prevent fraud or handle chargebacks
• that those providers may handle information under their own privacy terms where relevant

Be careful not to overpromise. If your processor stores data in multiple countries, don't say all customer payment data stays in New Zealand. If you don't control the processor's internal security standards, don't describe them as guaranteed. A practical statement is usually stronger than a sweeping one you can't back up.

You should also make sure your customer-facing privacy policy lines up with your supplier contracts. If your processor terms allow overseas processing, your privacy policy shouldn't suggest otherwise.

How Long Can I Keep Payment And Account Data?

You can keep payment and account data only for as long as you have a lawful business purpose for keeping it.

The Privacy Act 2020 says you shouldn't keep personal information for longer than is required for the purposes for which it may lawfully be used. For subscription businesses, that doesn't always mean deleting everything the moment a customer cancels. You may need some records to manage invoices, refunds, chargebacks, fraud prevention, legal compliance, accounting and customer support.

The key is to set sensible retention periods, document your data retention approach and explain them in your privacy policy. You don't need to publish a complex internal schedule, but you should give customers a fair idea of what you keep and why.

A Practical Retention Example

Imagine Mia runs a meal kit subscription in Auckland. A customer pays $120 every fortnight and cancels after 10 months. Mia's business deletes the customer's saved delivery preferences from the active account after cancellation, but keeps invoice records, payment status and support messages for a longer period so it can deal with refund questions, accounting records and possible chargebacks.

That can be a reasonable approach if the business has thought it through. What would be harder to justify is keeping full customer profiles, unused marketing tags and detailed behavioural data forever just because the system allows it.

Your internal retention plan might separate data into categories:

• Active account data: kept while the subscription is active
• Billing records: kept while needed for accounting, reporting, refunds and chargebacks
• Support messages: kept while needed to manage customer service and account history
• Marketing preferences: kept until the customer unsubscribes or the data is no longer useful
• Full payment details: usually held by your payment processor, not by your business

If a customer asks to access or correct their personal information, you generally need to respond as soon as reasonably practicable and no later than 20 working days, unless an extension applies. Your privacy policy should tell customers how to make those requests.

What Should My Policy Say About Chargebacks, Failed Payments And Account Deletion?

Your policy should explain that you may use and share payment-related information to manage failed payments, refunds, suspected fraud, disputes with banks and account deletion requests.

Chargebacks can feel like a billing issue, but they often involve personal information too. If a customer disputes a $79 monthly payment with their bank, you may need to provide transaction records, subscription terms acceptance logs, delivery records, login activity or support messages to your payment processor or bank. Your privacy policy should make this clear before the issue arises.

For failed payments, you might use automated retry tools or payment recovery emails. If you do, explain that customer account and billing information may be used to send renewal notices, failed payment reminders and account status updates.

When A Customer Wants Their Account Deleted

If a customer asks you to delete their account, first check what information you still need to keep for lawful business reasons. You may be able to close the account and delete some profile information, while keeping limited billing records for accounting, refund or chargeback purposes.

A sensible process might look like this:

1. Confirm the customer's identity: make sure you're dealing with the right account holder before changing or deleting data.
2. Check the subscription status: confirm whether there are unpaid invoices, pending refunds or active deliveries.
3. Separate data categories: decide what can be deleted, anonymised, archived or retained.
4. Record your decision: keep a short note explaining what you deleted and what you kept.
5. Reply clearly: tell the customer what action you took and who to contact with questions.

If something goes wrong, such as a payment data leak or a cybersecurity incident involving a processor error, act quickly. Keep records of what happened, what information was involved, who was affected, what steps you took and whether the breach is likely to cause serious harm. Serious privacy breaches may need to be notified to the Office of the Privacy Commissioner and affected individuals as soon as practicable after you become aware of them.

Payments Privacy Policy Template: What To Include

A payments privacy policy template can be a helpful starting point, but it should be tailored before you use it because subscription billing systems vary a lot.

Your policy needs to match your real setup. A SaaS business using annual invoices, a beauty box subscription using recurring card payments and a paid online course membership won't collect and keep identical information.

Here is a practical outline you can use when preparing your draft:

1. Who You Are: state your business name, trading name, NZBN if helpful, and contact details for privacy questions.
2. What Information You Collect: list account, billing, transaction, support, usage and marketing information.
3. How Payment Details Are Handled: explain whether your processor collects card or bank details and what limited payment data your business receives.
4. Why You Use The Information: cover recurring billing, invoices, renewals, refunds, fraud prevention, customer support and service improvement.
5. Who You Share Information With: describe payment processors, banks, software providers, support platforms, accountants and other service providers.
6. Overseas Storage Or Access: explain if providers may store or access information outside New Zealand.
7. Retention Periods: say how long you keep different categories of account and billing records, or how you decide this.
8. Customer Rights: explain how customers can request access to or correction of personal information, and mention the 20 working day response timeframe.
9. Account Closure And Deletion: explain what happens when a customer cancels, closes an account or asks for deletion.
10. Security: describe practical protections such as access controls, information security measures, processor security, staff permissions and monitoring, without promising more than you can guarantee.
11. Complaints And Contact: tell customers how to raise a privacy concern with you.
12. Changes To The Policy: explain how you'll update customers if the policy changes in a meaningful way.

Make sure this policy works alongside your subscription terms. Your terms usually deal with billing cycles, cancellation cut-offs, price changes, refunds and failed payments. Your privacy policy deals with the personal information behind those processes. When both documents line up, customers get a much clearer picture.

Key Takeaways

• A subscription business usually doesn't need a separate payments privacy policy, but its privacy policy should clearly cover recurring billing and account data.
• The Privacy Act 2020 requires you to explain what personal information you collect, why you use it, who you share it with and how customers can access or correct it.
• If you use payment processors, be clear about what they handle, what your business receives and whether information may be stored or accessed overseas.
• Set practical retention periods for billing records, support messages, account data and marketing information instead of keeping everything indefinitely.
• Your policy should cover failed payments, refunds, chargebacks, account closure and deletion requests in a way that matches your real systems.
• Templates can help with structure, but a tailored document is safer because payment flows differ across subscription businesses.

If you'd like help with your subscription privacy policy, recurring payment disclosures, processor sharing terms or customer account data practices, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.