Virtual Assistant Contracts in New Zealand: Key Terms

A virtual assistant business is built on trust. Clients may hand over inbox access, calendar control, customer details, cloud files, passwords, invoices and internal processes, often before they have met you in person. A vague quote or friendly email chain is rarely enough to manage that level of access.

Common mistakes include promising "admin support" without defining what that means, working extra hours without written approval, using shared passwords, or letting a subcontractor help without client consent. These issues can create disputes about payment, privacy, confidentiality and who is responsible if something goes wrong.

A well-drafted virtual assistant contract in New Zealand should tell clients exactly what you will do, how access will be handled, what happens when tasks change, and where your liability starts and ends. It also gives you a practical process for saying yes to new work without letting scope creep take over your week.

What a VA Service Agreement Should Cover

A VA service agreement should convert a flexible working relationship into clear commercial rules for tasks, access, payment, confidentiality and risk. It does not need to be overly formal, but it should be detailed enough that both parties can point to the same document when a question arises.

Virtual assistant work often sits between administration, operations, marketing, bookkeeping support, customer service and executive assistance. That variety is useful for clients, but it can blur the line between included services and extra work. Your agreement should make that line visible.

For most VA and admin support businesses, the contract can be structured as client terms and conditions, a service agreement, or a contractor agreement for virtual assistant services. The right format depends on how you sell your services. A one-person VA may use a signed proposal plus standard terms. A growing agency may use a master services agreement that applies to every package, with a separate schedule for each client.

Your agreement should usually cover:

• Parties: The legal names of your business and the client, including the company name and NZBN if relevant.
• Services: The tasks you will provide, any exclusions, and how new tasks are approved.
• Hours and availability: Monthly retainer hours, turnaround times, business hours, urgent work and unused hours.
• Client responsibilities: Information, instructions, timely approvals, system access and secure credential sharing.
• Fees: Retainers, hourly rates, project fees, expenses, GST treatment if applicable, invoicing and late payment.
• Confidentiality: How client information, business plans, customer lists and internal documents are protected.
• Privacy: How personal information is handled under the Privacy Act 2020.
• Systems access: Rules for inboxes, CRMs, cloud storage, calendars, accounting tools, social accounts and password managers.
• Subcontractors: Whether you can delegate work and what approval process applies.
• IP ownership: Who owns documents, templates, graphics, automations, processes or other work products.
• Liability: Liability caps, excluded losses, client indemnities and your responsibility for third-party platforms.
• Ending the engagement: Notice periods, handover, final invoices and removal of access.

New Zealand businesses should also think about consumer and trading law where the client is a small business or individual in trade. The Fair Trading Act 1986 prohibits misleading or deceptive conduct, so your service descriptions, package inclusions and results claims must match what you can realistically deliver. The Consumer Guarantees Act 1993 may apply to services supplied to consumers, and business-to-business terms sometimes address whether statutory guarantees are excluded where legally permitted and fair.

The contract should match the way you actually work. If you operate through a company, make sure the company is the contracting party rather than you personally. If you trade under a brand name, use the correct legal entity behind that brand. If you rely on packages shown on your website, make sure the website copy and your written terms tell the same story.

Defining Tasks Hours and Scope Creep

Scope creep is best managed by defining the service in task categories, time limits and approval steps before the first inbox is connected. The goal is not to make the engagement rigid, but to stop small extras becoming unpaid ongoing obligations.

A phrase like "general admin support" can mean very different things to different clients. One client may mean calendar management and document formatting. Another may assume you will chase invoices, write newsletters, answer customer complaints, organise travel, update their CRM and cover urgent evening requests. Your admin support contract in NZ should be specific enough to prevent that mismatch.

For example, a monthly retainer schedule could state that your included services are:

• Inbox triage, flagging priority messages and drafting responses for approval.
• Calendar management and meeting scheduling during agreed business hours.
• CRM updates based on information provided by the client.
• Preparation of standard documents using client templates.
• Weekly reporting on completed tasks and outstanding queries.

The same schedule can list excluded work, such as:

• Giving legal, accounting, financial, HR or tax advice.
• Approving supplier invoices or payments without written authorisation.
• Signing contracts or making binding commitments for the client.
• Handling customer complaints beyond agreed scripts.
• Creating original marketing strategy or marketing services unless included in the package.
• Work requiring access to systems that the client has not properly authorised.

Time terms matter just as much as task terms. If a client buys ten hours per month, state whether unused hours roll over, expire or can be used only within the same month. If work exceeds the included hours, your agreement should say whether you stop work, seek approval, or charge additional time at your standard rate.

Turnaround times and service levels should also be realistic. A small VA business can quickly get into trouble by promising same-day responses to every client. You might instead set expectations such as a two business day turnaround for standard tasks, with urgent work subject to availability and a different rate. If you provide support outside standard New Zealand business hours, write that down clearly.

One practical approach is to include a change request process. It can be simple:

1. The client requests extra work by email or through your task management system.
2. You confirm whether it is within the existing scope or outside scope.
3. You provide an estimate, rate or fixed fee for the extra work.
4. The client approves the extra work in writing before you begin.

This process is particularly useful when a client starts with inbox management and then asks for social media scheduling, customer service, recruitment support or operations assistance. Those tasks may be perfectly suitable for your business, but they need separate pricing, time allocation and risk settings.

Your virtual assistant terms and conditions should also make clear that the client remains responsible for business decisions. A VA may prepare drafts, organise information and complete agreed administrative steps, but the client should approve important communications, business commitments, payments and decisions unless you have a specific written authority to act.

Managing Inbox Access Passwords and Client Data

Access rules are the most distinctive part of a virtual assistant contract because VA work often requires entry into sensitive client systems. Your agreement should explain how access is granted, used, recorded and removed.

Inbox access can expose you to customer personal information, confidential supplier communications, internal disputes, pricing details and strategic plans. Calendar access can reveal health appointments, HR meetings or acquisition discussions. A CRM may contain hundreds or thousands of customer records. Treating these systems as casual admin tools can create privacy and confidentiality risk for both you and the client.

Your contract should require clients to provide access through secure methods. Shared passwords sent by text or email are risky. A better approach is to require the client to use named user accounts, delegated access, role-based permissions or a password manager. The agreement can also say that you are not responsible for delays caused by the client's failure to provide secure access or necessary permissions.

For inbox and calendar access, consider terms that cover:

• Whether you can read all emails or only specific folders, labels or shared mailboxes.
• Whether you can send emails directly or only prepare drafts for approval.
• Whether you can delete, archive, unsubscribe or move messages.
• How urgent or sensitive emails are escalated.
• What signature or identifier is used when you send messages on the client's behalf.
• Whether you can access personal folders or only business accounts.

For passwords and systems, your terms should require the client to tell you what level of authority you have. If you can create customer accounts, issue refunds, download reports, update payment settings, change website content or access accounting information, those permissions should be described. A VA should avoid being placed in a position where they appear to have broad authority without written instructions.

The Privacy Act 2020 is especially relevant where you handle personal information for clients. Personal information can include names, email addresses, phone numbers, order histories, appointment notes, employee records and customer messages. Your agreement should require both parties to comply with applicable privacy obligations and use personal information only for the agreed services.

Useful privacy terms for a VA service agreement in NZ include:

• Personal information must only be accessed, used and disclosed for the purpose of providing the services.
• Client data must not be copied to personal devices or personal cloud accounts unless approved and secure.
• Security incidents must be reported promptly, including unauthorised access, accidental disclosure or loss of devices.
• The client remains responsible for giving privacy notices to its own customers, staff or contacts where required.
• Data should be returned, deleted or securely destroyed at the end of the engagement, subject to lawful record keeping.

New Zealand's privacy breach notification rules can require notification to the Privacy Commissioner and affected individuals where a notifiable privacy breach has caused, or is likely to cause, serious harm. Your contract should set up a practical reporting path so the client can assess any incident quickly. For example, if a VA accidentally sends a spreadsheet of customer details to the wrong recipient, the client needs enough information to decide what steps to take.

Confidentiality should be broader than privacy. It should protect information about business plans, pricing, suppliers, trade secrets, marketing strategy, passwords, internal processes, financial information and any information that a reasonable person would treat as confidential. If you work with multiple clients in the same industry, the agreement should reassure clients that you will not misuse their confidential information, while still allowing you to use your general skills and knowledge.

Fees Subcontractors IP and Liability Settings

Commercial terms should match the risk profile of VA work, especially where you handle client systems but do not control the client's business decisions. Clear payment, delegation, IP and liability clauses reduce the chance of a small admin issue becoming a major dispute.

VA pricing can be hourly, retainer-based, project-based or package-based. Each model needs different drafting. Hourly work should explain how time is recorded and rounded. Retainers should say what is included, when fees are payable, and whether unused hours roll over. Project fees should define deliverables and assumptions in a goods and services agreement. Package terms should describe inclusions in enough detail that clients cannot argue that every related task is included.

Late payment terms are useful because many VA businesses rely on steady cash flow. Your agreement can include payment due dates, suspension rights for overdue accounts, debt recovery costs where lawful and reasonable, and a right to withhold non-essential work until invoices are paid. If you are GST registered, your pricing and invoices should be consistent about whether amounts are GST inclusive or exclusive.

Subcontracting deserves specific treatment. Many VA businesses grow by bringing in another assistant, bookkeeper, designer, copywriter or specialist admin contractor. From the client's perspective, this can feel different from engaging one trusted person. Your contract should say whether subcontractors may be used, whether client approval is required, and whether you remain responsible for their work.

A balanced service agreement clause might allow you to use suitably skilled subcontractors for agreed services, require them to follow confidentiality and privacy obligations, and state that you remain the client's main point of contact. For higher-risk access, such as accounting systems, HR files or medical appointment data, you may require specific written approval before a subcontractor is given access.

Intellectual property can also create confusion. A VA may create templates, procedures, spreadsheets, email drafts, automations, reports, social media captions or standard operating procedures. The client may expect to own everything created during the engagement, while the VA may want to keep pre-existing templates and know-how.

Your IP clause should separate:

• Client materials: Information, documents, branding, databases and content supplied by the client.
• Deliverables: Work created specifically for the client as part of the paid services.
• VA materials: Pre-existing templates, methods, checklists, workflows and tools you bring to the engagement.
• Third-party tools: Software, platforms, stock content or plugins governed by their own terms.

A common position is that the client owns paid deliverables created specifically for them, while you keep ownership of your pre-existing tools and grant the client permission to use those tools only as embedded in the deliverables. If you offer template packages or systems setup, this distinction becomes more significant.

Liability clauses should be practical, fair and consistent with New Zealand law. The Fair Trading Act can affect unfair contract terms in standard form small trade contracts, and misleading limitations may not be enforceable. The Consumer Guarantees Act may also affect some service relationships, particularly where services are supplied to consumers rather than businesses. Terms that attempt to exclude everything in all situations can create more risk than they solve.

For VA work, liability settings commonly address:

• A cap on your total liability, often linked to fees paid over a defined period.
• Exclusion of indirect loss, loss of profit, loss of opportunity and consequential loss where appropriate.
• No responsibility for client decisions, instructions, approvals or failure to review work.
• No responsibility for outages, errors or security failures in third-party platforms outside your control.
• A client indemnity for claims arising from materials, instructions or access supplied by the client.
• Carve-outs for confidentiality, privacy, fraud, wilful misconduct or other matters that should not be capped in the same way.

A worked example shows why this matters. A client asks a VA to send a promotional email to a list supplied by the client. The VA uploads the list and sends the campaign exactly as instructed. If recipients complain because the list was not properly collected, the contract should make clear that the client is responsible for the lawfulness of the list and marketing permissions, while the VA is responsible for performing the agreed task with reasonable care.

Termination and handover should not be left to goodwill. Your agreement should set out notice periods, immediate termination rights for serious breach, what happens to prepaid fees, and how access is removed. On exit, you may need to return client documents, provide handover notes, delete local copies and confirm that user accounts should be deactivated. A clean offboarding process protects both parties.

FAQs

Do I Need a Written Contract for Every Virtual Assistant Client?

Yes, a written contract is strongly recommended for every client, even small retainers. VA work often involves confidential information and system access, so a clear written record is safer than relying on emails, proposals or verbal promises.

Can I Use the Same Terms for Hourly and Retainer VA Work?

You can use the same core terms, but the service schedule should change for each pricing model. Hourly work needs time recording rules, while retainers need rules for included hours, unused time, extra work and monthly billing.

Should Clients Give Me Their Passwords?

Clients should use secure access methods wherever possible, such as named user accounts, delegated permissions or password managers. Your terms should discourage sending passwords by email or message and should require the client to provide appropriate permissions for the tasks requested.

Can a Virtual Assistant Use Subcontractors?

Yes, if the contract allows it and the client has agreed to the arrangement required by your terms. Subcontractors should be bound by confidentiality, privacy and security obligations, especially if they will access inboxes, customer data or internal systems.

What Should Happen When a Client Keeps Adding Extra Tasks?

Your contract should include a change request process. Extra tasks can then be quoted, approved and billed before work starts, instead of being absorbed into the original package without payment.

Key Takeaways

• A virtual assistant contract in New Zealand should cover services, hours, access, confidentiality, privacy, fees, subcontracting, IP, liability and exit steps.
• Scope creep is easier to manage when tasks, exclusions, turnaround times and approval steps are written into the service schedule.
• Inbox, calendar, CRM and password access should be handled through secure permissions and clear rules about what the VA can do.
• The Privacy Act 2020 is highly relevant where a VA handles customer, staff or supplier personal information for a client.
• Subcontracting clauses should explain when extra team members can be used and how client data will be protected.
• Liability terms should reflect the fact that the client controls business decisions, instructions, customer lists and third-party systems.

If your VA business needs practical client terms, a privacy-aware access process, subcontractor wording or clearer scope and payment clauses, Sprintlaw New Zealand can help you put the right documents in place. Contact us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.