RUC Pass Privacy Policy
Effective date: 21 July 2026
Version: 21 July 2026
A quick note before the details
RUC Pass helps users manage vehicle information, Road User Charges (“RUC”), vehicle licensing/registration (“rego”), Warrant of Fitness (“WOF”) information, reminders, and related vehicle services.
To provide those services, we need to collect and use some personal information. This may include account details, vehicle details, registration plates, odometer readings, transaction information, payment-related information, support messages, and technical information about how the Services are used.
We do not sell, rent, trade, license, or otherwise monetise your personal information. We use personal information to provide, operate, secure, support, and improve the Services, and we share it only where reasonably necessary for those purposes, where you authorise us, or where required or permitted by law.
We aim to collect only what we reasonably need, use it for clear purposes, protect it carefully, and give you control over your information where the law allows.
This Privacy Policy explains how we collect, use, store, disclose, retain, and protect personal information when you access or use RUC Pass.
1. Who we are
1.1 The Services are operated by RUC ON RAILS LIMITED.
Company Number: 9362845
NZBN: 9429053041746
Registered Address: 26 Hobson Street, Suite 15587, Auckland, 1010, New Zealand
1.2 RUC Pass is a product and brand of RUC ON RAILS LIMITED and is not a separate legal entity.
1.3 In this Privacy Policy, references to “RUC Pass”, “we”, “us”, or “our” refer to RUC ON RAILS LIMITED in its capacity as operator of the Services.
1.4 RUC Pass is a privately operated vehicle-management service. We do not represent the Crown, the New Zealand Government, the New Zealand Transport Agency Waka Kotahi (“NZTA”), the Ministry of Transport, or any other Crown entity, government department, public agency, or public body.
2. Scope of this Privacy Policy
2.1 This Privacy Policy applies to personal information collected through or in connection with the Services, including but not limited to:
The RUC Pass website at https://www.rucpass.co.nz;
The RUC Pass mobile application;
Account creation and account management;
Vehicle management features;
RUC purchase requests;
Rego renewal requests;
WOF, rego, RUC, and vehicle reminder features;
Vehicle data lookups and vehicle information services;
Payment and transaction processing;
Support requests, enquiries, complaints, and other communications;
Mailing list, waitlist, or expression-of-interest signups;
Analytics, cookies, diagnostics, and similar technologies;
Fraud prevention, security, and misuse monitoring.
2.2 The website and mobile application are together referred to as the “Services”.
2.3 This Privacy Policy does not apply to third-party websites, apps, services, payment providers, public-agency services, or external platforms that are not controlled by us, even where they are linked to or accessible from the Services.
3. What personal information means
3.1 “Personal information” means information about an identifiable individual, as defined in the Privacy Act 2020.
3.2 This does not include information that has been irreversibly anonymised or aggregated so that it no longer identifies an individual.
4. Personal information we may collect
4.1 We may collect personal information directly from you, automatically through your use of the Services, from third-party service providers, from public or commercial data sources, or from public-agency systems where relevant to the Services.
4.2 The information we collect depends on how you use the Services.
5. Information you provide to us
5.1 We may collect information that you provide directly, including but not limited to:
Name;
Email address;
Password or login credentials, stored by our identity provider in hashed or protected form;
Phone number;
Account profile information;
Region or location preference;
Vehicle registration plates added to your account;
Odometer readings or hubodometer readings you enter;
Vehicle notes, preferences, or saved vehicle information;
RUC purchase request details;
Rego renewal request details;
Support requests, enquiries, complaints, feedback, and other correspondence;
Marketing preferences;
Waitlist, launch notification, or expression-of-interest details;
Information you provide when requesting account closure, correction, deletion, or privacy support.
5.2 You must ensure that information you provide is accurate, complete, and current.
6. Vehicle information we may collect or process
6.1 When you add a vehicle, request a lookup, submit a purchase request, or use vehicle-management features, we may collect, display, process, or store vehicle-related information.
6.2 This may include but is not limited to:
Registration plate;
Make, model, year, and vehicle description;
Body type, fuel type, vehicle type, or class;
RUC vehicle type, weight, distance band, or class information;
WOF expiry information and related WOF details;
Rego expiry information and related vehicle licensing details;
RUC information, expiry estimates, distance information, purchase history, or related RUC details where available;
Odometer history and odometer readings you enter;
Stolen vehicle indicators or other vehicle-status indicators where available;
Registered address status or vehicle address-related information where relevant and available;
Transaction records connected to a vehicle;
Reminders, estimates, predictions, or alerts generated in relation to a vehicle;
Other vehicle-related records available through third-party, public, commercial, or government-related data sources.
6.3 Vehicle information may relate to an identifiable individual where it is linked to your account, your vehicle, your address, your transaction history, your correspondence, or other personal information.
7. Transaction and purchase information
7.1 If you submit a RUC purchase request, rego renewal request, or other vehicle-related transaction request, we may collect and process information required to arrange, facilitate, support, verify, record, or complete that request.
7.2 This may include:
The vehicle selected and registration plate;
RUC distance or purchase amount;
Odometer or hubodometer reading;
Rego renewal period;
Transaction amount, service fees, convenience fees, processing fees, payment fees, government charges, or statutory fees;
Payment status, purchase date, time, and transaction status;
Confirmations, receipts, temporary licences, labels, notices, or other transaction records;
Communications about the transaction;
Refund, correction, cancellation, failed payment, chargeback, or dispute information;
Fraud prevention, security review, audit, and accounting records.
7.3 We retain transaction records only where, and for as long as, reasonably necessary for a specific legal, accounting, audit, tax, fraud-prevention, dispute-resolution, regulatory, enforcement, or security purpose, as described in Section 18.
8. Payment information
8.1 We use third-party payment processors, banking providers, and payment service providers to securely handle financial transactions.
8.2 We may collect or receive payment-related metadata, including:
Payment method type (e.g., credit card, debit card);
Payment status and transaction references;
Amount paid, date, and time;
Partial card details, such as card brand and last four digits, provided by our payment processor;
Billing or receipt information;
Chargeback, refund, reversal, failed payment, or dispute information.
8.3 We do not store full payment card numbers or CVV codes on our servers. Full payment details are processed directly by our payment providers subject to their own security standards and privacy practices.
9. Automatically collected information
9.1 When you access or use the Services, we may automatically collect technical and usage information, including:
IP address;
Device type, model, operating system, and browser information;
App version and build details;
Pages or screens viewed, features interacted with, and timestamps;
Referring URLs or campaign sources;
Approximate location derived from IP address;
Crash logs, diagnostic metrics, performance logs, and security event logs.
9.2 This information helps us operate, secure, maintain, diagnose, improve, and understand performance and usage of the Services.
10. Cookies and similar technologies
10.1 We may use cookies, pixels, local storage, software development kits (SDKs), device identifiers, and similar technologies for purposes including:
Operating the Services and keeping you signed in;
Remembering preferences and settings;
Securing the Services and preventing fraud, spam, or unauthorised access;
Understanding how the Services are used;
Improving performance, feature design, and user experience;
Measuring marketing campaign performance.
10.2 You can manage or disable cookies through your browser settings. Disabling cookies may affect certain functionalities of the Services.
11. Analytics, interaction recording, and advertising measurement
Analytics and Session Monitoring
11.1 We use analytics and diagnostic services (including tools such as PostHog) to analyze user interaction, identify bugs, monitor service reliability, and optimize user experience and product design.
11.2 These tools may record technical interaction data, including screens viewed, taps, clicks, scrolling activity, interface interactions, error logs, and basic device information.
11.3 In some cases, session summaries or visual interaction logs may be generated to help our team diagnose usability issues or technical errors. We implement reasonable technical safeguards and masking rules to prevent sensitive input fields (such as passwords, credit card numbers, or sensitive account forms) from being recorded.
Advertising Measurement & Attribution
11.4 We use advertising measurement tools, including SDKs and APIs provided by Meta and Reddit, to understand whether our advertising campaigns effectively lead to app downloads or verified account registrations, and to optimize campaign performance.
11.5 For ad measurement and attribution, we may share limited interaction events (such as an app installation or completed registration) along with pseudonymized identifiers, such as device advertising identifiers (e.g., IDFA on iOS or GAID on Android) or a cryptographic hash of your email address.
11.6 Strict Exclusion: We do not send vehicle details, registration plates, RUC history, payment details, transaction amounts, or customer support messages to Meta or Reddit for advertising purposes.
Privacy Controls & App Tracking Settings
11.7 iOS Devices: On iOS, we adhere to Apple’s App Tracking Transparency (ATT) framework. We request your explicit permission before enabling ad tracking or sharing attribution event data with Meta or Reddit. You can grant, review, or revoke this permission at any time via your iOS device settings (Settings > Privacy & Security > Tracking).
11.8 Android Devices: On Android, we request your explicit permission in the App before enabling advertising measurement or sharing your advertising identifier, hashed email address, or registration event with Meta or Reddit. You can also reset or delete your Google Advertising ID via your device settings (Settings > Privacy > Ads).
11.9 Choice Respect: If tracking is declined, disabled, or unavailable, we respect your choice and do not use alternative tracking techniques or workaround identifiers to track you across third-party apps or websites for ad measurement.
11.10 Third-Party Policies: Information shared with advertising platforms is processed in accordance with their respective privacy terms. You can learn more by reviewing the Meta Privacy Policy and Reddit Privacy Policy.
12. How we use personal information
12.1 We may use personal information for purposes including:
Operating, maintaining, supporting, and improving the Services;
Creating and managing user accounts and authenticating logins;
Adding and managing vehicles within your account;
Providing vehicle lookup, WOF, rego, RUC, and odometer information features;
Generating vehicle reminders, alerts, estimates, and notifications;
Processing, arranging, facilitating, recording, or supporting RUC purchase and rego renewal requests;
Processing payments, refunds, chargebacks, reversals, and transaction disputes;
Issuing confirmations, receipts, temporary licences, labels, and notices;
Responding to enquiries, feedback, complaints, and support requests;
Sending service-related communications and permitted marketing updates;
Preventing fraud, misuse, spam, unauthorised access, chargebacks, account compromise, or security incidents;
Monitoring and improving performance, reliability, and system health;
Complying with legal, accounting, audit, tax, regulatory, or enforcement obligations;
Protecting our rights, property, users, systems, and Services;
Assessing or completing business transactions such as investment, restructuring, merger, acquisition, or sale.
12.2 We may combine information collected from different features or sources where reasonably necessary for these purposes.
13. Service-related communications and marketing
13.1 We may send service-related communications where reasonably necessary for the administration and operation of the Services.
13.2 Service communications include purchase confirmations, RUC licence or temporary licence emails, rego renewal receipts, security alerts, payment notices, operational updates, and legal notices. You cannot opt out of essential service communications.
13.3 If you opt in to receive marketing communications, product updates, or news, you can unsubscribe at any time by using the "unsubscribe" link included in those emails or by contacting us at support@rucpass.co.nz.
14. Disclosure of personal information
14.1 We may disclose personal information where reasonably necessary to operate our business and fulfill the purposes described in this Privacy Policy.
14.2 Recipients may include:
Hosting, cloud infrastructure, and database providers (e.g., AWS);
Authentication, identity, and security service providers;
Payment processors, banking institutions, and transaction gateways;
Vehicle data providers and public registers;
Analytics, diagnostic monitoring, and ad measurement partners (including PostHog, Meta, and Reddit);
Email, push notification, customer support, and messaging service providers;
Legal, accounting, audit, tax, and professional advisers;
Public agencies, regulators, law enforcement, courts, or dispute-resolution bodies where required or permitted by law;
NZTA or public-agency systems where relevant to a transaction or vehicle service request;
Potential investors, buyers, or advisers in connection with a proposed or actual corporate transaction, subject to appropriate confidentiality obligations.
14.3 We do not sell, rent, trade, license, or otherwise monetise personal information.
14.4 We may share anonymised or aggregated data that does not identify any individual for research, reporting, product development, or commercial analysis.
15. Public agencies and third-party data sources
15.1 Features of the Services rely on vehicle data, registers, labels, charges, and records administered by public agencies or commercial data vendors.
15.2 We collect, display, and process information from these sources for vehicle lookups, status checks, WOF/rego/RUC verification, transaction processing, and record-keeping.
15.3 References to NZTA, Waka Kotahi, the Ministry of Transport, RUC, rego, WOF, or official registers are for contextual and functional identification only. Such references do not imply endorsement, sponsorship, official partnership, or representation between RUC Pass and any public agency or government body.
16. Overseas storage and processing
16.1 Personal information collected through the Services is primarily stored and processed using secure cloud infrastructure located in Australia (including the AWS Asia Pacific Sydney region).
16.2 Some of our third-party service providers (such as analytics or communication tools) may process or store data in other international jurisdictions, including the United States.
16.3 Where personal information is stored or transferred overseas, we take reasonable steps to ensure that appropriate data protection safeguards are in place in accordance with New Zealand Privacy Act 2020 requirements (including Information Privacy Principle 12).
17. Security
17.1 We implement reasonable technical, physical, and organizational security measures to protect personal information from loss, unauthorised access, misuse, disclosure, alteration, or destruction.
17.2 Safeguards include encrypted transmissions (SSL/TLS), strict system access controls, authentication protections, logging, continuous security reviews, and relying on tier-one cloud providers.
17.3 While we take robust precautions, no internet transmission or electronic storage system is 100% secure. We cannot guarantee absolute security.
18. Retention
18.1 We retain personal information only for as long as necessary to fulfill the lawful purposes for which it was collected, or as required by law.
18.2 Financial, transaction, tax, invoice, and payment records are retained for the period required by applicable New Zealand law (generally at least seven tax years).
18.3 Support correspondence, audit logs, and security records are retained only for as long as needed to resolve disputes, investigate incidents, maintain security, or fulfill operational requirements.
18.4 When personal information is no longer required, we securely delete or irreversibly anonymise it.
19. Account closure and deletion requests
19.1 You may request account closure or data deletion directly within the mobile application settings (where available) or by contacting us at support@rucpass.co.nz.
19.2 Upon confirming your deletion request:
Account access will be disabled, active sessions revoked, and marketing emails stopped immediately;
The account enters a 30-day grace period, during which you may contact support to cancel the deletion request and restore the account;
Following the 30-day grace period, personal profile details, login credentials, saved vehicles, and personal preferences will be permanently deleted or irreversibly anonymised.
19.3 Legitimate Retention Exceptions: Following account deletion, we may retain limited transaction records, tax invoices, accounting entries, and dispute logs where retention is required by law or necessary for fraud prevention, audit integrity, or legal compliance. Retained records will never be used for marketing purposes.
19.4 Backups: Residual copies of deleted data may remain in encrypted system backups for a limited period until automatically overwritten in accordance with our disaster recovery retention cycles.
20. Your privacy rights
20.1 Under the New Zealand Privacy Act 2020, you have the right to:
Access: Request access to the personal information we hold about you;
Correction: Request that incorrect or outdated personal information be corrected (or request that a statement of correction be attached to your record);
Complaint: File a complaint with us if you believe your privacy rights have been infringed.
20.2 To exercise your rights, please submit a written request to support@rucpass.co.nz. We may need to verify your identity before processing your request.
20.3 If you are unsatisfied with our response to a privacy concern, you have the right to make a complaint to the New Zealand Office of the Privacy Commissioner (www.privacy.org.nz).
21. Accuracy of information
21.1 We take reasonable steps to ensure that personal information we collect and use is accurate, up to date, and complete.
21.2 You are responsible for keeping your account information and vehicle details current.
21.3 Vehicle information retrieved from third-party registers or public databases may occasionally contain errors or delays. You should verify critical vehicle data against official government documentation where necessary.
22. Third-party websites and services
22.1 The Services may contain links to external websites, apps, or services.
22.2 We are not responsible for the privacy practices, content, or security of third-party platforms. We encourage you to read the privacy policies of any third-party service you visit.
23. Children
23.1 The Services are intended for general audiences and are not directed at children.
23.2 We do not knowingly collect personal information from individuals under the age of 16. If you believe a child has provided us with personal information, please contact us so we can take steps to delete it.
24. Changes to this Privacy Policy
24.1 We may update this Privacy Policy periodically to reflect changes in our legal obligations, features, or business operations.
24.2 Updated versions will be published on our website and app with a revised effective date.
24.3 If we make material changes to how we handle personal information, we will take reasonable steps to notify you (such as via an in-app notice or email) before changes take effect.
25. Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:
Email: support@rucpass.co.nz
Company: RUC ON RAILS LIMITED (NZBN: 9429053041746)
Address: 26 Hobson Street, Suite 15587, Auckland, 1010, New Zealand