From:
s 9(2)(a)
To:
S241
Cc:
s 9(2)(a)
Subject:
Re: NZTA CA05 Application - Auror Limited
Date:
Thursday, 7 April 2022 4:15:35 pm
Attachments:
~WRD0000.jpg
image003.png
CA05-Auror Limited.pdf
Auror Privacy Statement.pdf
Auror NZ Bank Account Slip.pdf
NZTA - MVR Application 2022.pdf
Auror DD Authority.pdf
Auror Platform Security Overview - Sep 2021.pdf
CAUTION: The sender of this email is from outside Waka Kotahi. Do not click links, attachments, or replyACT 1982
unless you recognise the sender’s email address and know the content is safe.
Thank you very much, Gemma.
I have attached the following documentation:
CA05-Application form (unfortunately I was unable to align the text within the lines
in the form, so I have additionally attached a PDF which has our answers in a format
that may be easier to read - see NZTA MVA Application 2022)
Auror DD Authority form attached as well as a bank account slip
Auror Privacy Statement
Auror Trust Center: https://www.auror.co/trust-center
INFORMATION
Please let me know if you require any further information. I look forward to hearing from
you.
Best,
s 9(2)(a)
On Thu, 7 Apr 2022 at 12:42, S241 <[email address]> wrote:
Hello s 9(2)(a)
Thank you for your email and it’s great to hear that Auror are planning ahead for the
renewal.
Yes, a new direct debit form will need to be completed, I’ve attached this, along with the
application form for you to complete. The current authorisation for Auror Limited
expires on 13 September, however I would encourage you to submit your application as
soon as possible, as they can take a significant amount of time to process.
Since your application was previously granted in 2017, we have adjusted our approach to
the purposes and conditions of authorisation, making these more robust in light of the
considerable potential risks of allowing access to personal information and to better align
with recent changes to the Privacy Act. Section 241 access to the Motor Vehicle Register
is a privilege that needs to be treated very carefully, and as part of the application, Auror
RELEASED UNDER THE OFFICIAL
Limited will need to demonstrate how it would avoid breaches of privacy, as instances of
unauthorised access can have severe consequences for the individual whose privacy has
been breached. As such, Waka Kotahi must be satisfied that Auror Limited has sufficient
measures in place to ensure that personal information will be protected and to prevent
instances of misuse before granting an application.

You can view the terms and conditions for some recently granted here:
https://www.nzta.govt.nz/vehicles/how-the-motor-vehicle-register-affects-
you/authorised-access-to-the-register/terms-and-conditions/ Hopefully these examples
will provide some clarity on the type of conditions you may see reflected, and we
suggest you keep these in mind when providing your answers to the questions on the
application form. Think carefully about how you would meet each condition and how
you could then supply evidence to Waka Kotahi of doing so. Any evidence of your
current recording processes, privacy policies and staff training materials should also be
supplied with your application.
If you have any questions please let me know.
Kind regards
ACT 1982
Gemma Rush (she/her)
Senior Case Officer, Exemptions & Registers Integrity
Te Roopu Waeture | Regulatory Services
Waka Kotahi NZ Transport Agency
Palmerston North
Private Bag 11777, Palmerston North 4442, New Zealand
twitter | youtube | facebook
INFORMATION
s 9(2)(a)
From:
@auror.co>
Sent: Thursday, 7 April 2022 11:11 AM
To: S241 <[email address]>
Subject: NZTA CA05 Application - Auror Limited
CAUTION: The sender of this email is from outside Waka Kotahi. Do not click links, attachments, or reply
unless you recognise the sender’s email address and know the content is safe.
To whom this may concern,
Auror Limited are applying to renew our authorised access to current names and
addresses in the Motor Vehicle Register. We currently have a direct debit set up with
NZTA. Could you please confirm whether you would be able to direct debit the
application fee from our current account set-up? Or whether we need to fill in another
direct debit form?
Many thanks in advance,
s 9(2)(a)
--
RELEASED UNDER THE OFFICIAL
s 9(2)(a)
s 9(2)(a) @auror.co
s 9(2)(a)

Auror.
Image removed by sender.
The content of this e-mail (the "Communication") is confidential, may contain copyright information, and is
for the use only of the intended recipient. If this Communication is not intended for you, please notify the
sender immediately by return e-mail, delete the Communication and return e-mail, and do not read, copy,
retransmit or otherwise deal with it. Thank you.
ACT 1982
This message, together with any attachments, may contain information that is classified
and/or subject to legal privilege. Any classification markings must be adhered to. If you
are not the intended recipient, you must not peruse, disclose, disseminate, copy or use
the message in any way. If you have received this message in error, please notify us
immediately by return email and then destroy the original message. This communication
may be accessed or retained by Waka Kotahi NZ Transport Agency for information
assurance purposes.
--
INFORMATION
s 9(2)(a)
s 9(2)(a) @auror.co
s 9(2)(a)
Auror.
The content of this e-mail (the "Communication") is confidential, may contain copyright information, and is for
the use only of the intended recipient. If this Communication is not intended for you, please notify the sender
immediately by return e-mail, delete the Communication and return e-mail, and do not read, copy, retransmit or
otherwise deal with it. Thank you.
RELEASED UNDER THE OFFICIAL

Application for authorised access to current names
CA05
and addresses in the Motor Vehicle Register
Anyone can apply for an authorisation from Waka Kotahi NZ Transport Agency to access current names and addresses in the
Motor Vehicle Register.
Applications for access are made under section 241 of the Land Transport Act 1998. Waka Kotahi consults with the Ombudsman,
Privacy Commissioner and Police Commissioner (our advising agencies) before deciding whether to grant an authorisation. An
authorisation should be for a specific purpose and is subject to any conditions specified by Waka Kotahi.
We suggest you view some of the current terms and conditions (which you can view in detail here: www.nzta.govt.nz/authorised-
access-mvr/tc) then think carefully about how you would meet each condition and how you could then supply evidence to
Waka Kotahi of doing so.
For more information visit the Waka Kotahi website at www.nzta.govt.nz/authorised-access-mvr
Use this application if you want authorisation to access current names and addresses in the Motor Vehicle Register only (this does
not include details of previously registered persons). You don’t require an authorisation to access non-personal vehicle information
(eg make, model, licence expiry dates, etc.). This authorisation does not allow access to details about finance owing on vehicles.
That information is held by the Personal Property Securities Register (www.ppsr.govt.nz/cms).
ACT 1982
Please consider the following alternatives before you apply:
•
Case-by-case applications for personal information can be made with this transaction at
https://transact.nzta.govt.nz/transactions/ReqPersonalInfoAccess/entry
•
We have a free online confirmation service available here with no authorisation needed at
https://transact.nzta.govt.nz/transactions/ConfirmRegisteredPerson/entry
Privacy
The information requested is required to process your application for Application for authorised
access to current names and addresses in the Motor Vehicle Register under section 241 of the Land
Transport Act 1998. Collection of this information is required by Part 6 of the Land Transport
(Motor Vehicle Registration and Licensing) Regulations 2011.
Waka Kotahi, in its capacity as the Registrar of Motor Vehicles (and its agents), will hold, st
INFORMATION
ore,
use and disclose any personal information collected as part of this application in accordance with
the Land Transport Act 1998 and the Privacy Act 2020. In particular Waka Kotahi must, at the
request of an individual, provide the name of any person to whom personal information about
that individual has been disclosed where that disclosure has been made to a person who has been
authorised to access names and addresses under section 241 of the Land Transport Act 1998.
You are entitled to access, and request the correction of, any readily retrievable personal
information held about you by Waka Kotahi. You can do so by writing to us at Private Bag 11777,
Palmerston North 4442 or by emailing us at [email address].
Payment
We must receive payment with your application in order for it to be considered.
The application fee applies regardless of whether the application is approved or declined. The fees
(including GST) are:
Individual (except for sole traders)
$621.46
Business that is not a representative body or member of a representative body
$854.57
(including a sole trader)
Representative body with a disciplinary power
$1165.30
Representative body with no disciplinary power
$1320.65
Any other applicant not covered above
$1165.30
You should pay the fee to Waka Kotahi at the time of application. Applications will not be
completed unless the correct fee is paid. You can pay by direct debit:
• To pay by direct debit, please use our direct debit form (available from www.nzta.govt.nz/dda).
Please post the original form, not a photocopy, or email a high quality scan with your application.
RELEASED UNDER THE OFFICIAL
Sending in your
Please email this form along with a high quality scan of the direct debit form and any extra relevant
application
information to [email address].
You can also print and complete this form and send it with the original direct debit forms and any
extra relevant information to:
Exemption and Registers Integrity
Waka Kotahi NZ Transport Agency
Private Bag 11777
Palmerston North 4442
04/22

Answer all questions as best you can. We’re required under legislation to ask these questions as part of the
application process.
You can also attach any extra information you think might be relevant to the application (eg privacy policies, sample
agreements).
Company details
Company name
The company name is the
Auror Limited
name that we will issue the
Trading as name
authorisation under. If you are a
sole trader, enter the name you’ve
n/a
registered with the Motor Vehicle
Traders Register.
Company number
Write n/a in any boxes not
3792596
applicable.
Motor Vehicle Trader (MVT)/Financial Service Provider (FSP) numberACT 1982
n/a
Waka Kotahi NZ Transport Agency customer number
n/a
Motochek account number
s 9(2)(a)
What is the nature of the business?
INFORMATION
Crime Intelligence Software Platform that assists retailers (such as fuel companies) and police prevent crime and reduce loss
Attach a separate sheet if
What locations does the business operate from?
necessary.
Auckland, New Zealand
How long has the business been operating?
10 years. The business was incorporated in May 2012.
Name
Company contact
s 9(2)(a)
Phone
Email
s 9(2)(a)
s 9(2)(a)
Staff and agents
How many staff or agents are likely to have access to the register?
employed
Access is restricted three key staff members at Auror.
Fill out this section if you employ
staff or engage agents
What are the roles of those likely to have access?
RELEASED UNDER THE OFFICIAL
• Write n/a for your answer
Debt recovery and customer support team.
where not applicable
We have an automated process in place whereby the staff members do
• Continue on a separate sheet
of necessary
not actually directly view the personal information retrived from the
register.
CA05 Application for authorised access to current names and addresses in the MVR
page 2

Staff and agents
What training will you give those who are likely to have access on the proper handling
of the information from the register?
employed (continued)
All employees are provided with training on privacy, information security,
and acceptable use policy requirements for information handling. Any
employee that requires access to the register also has training on our
debt recovery and MVR access process.
ACT 1982
What controls do you have in place to ensure that those who are likely to have access
handle the information properly?
Our business involves handling sensitive personal information every day – we already work closely with NZ Police and safely share sensitive
information with them. We have processes and policies (including our privacy policy) that ensures information is handled properly.
We have a well developed process for access to the MVR which includes overnight batch requests and the resultant data is uploaded into our
software which then automatically generates the letters to be sent off for printing and delivery. This means that our employees do not need to
view the personal information that is provided by the MVR. Once the letter process is complete (this occurs on a weekly basis), the MVR data file
is hard deleted from the employee’s device.
Employees accessing the Motor Vehicle Register use Auror provided devices and these devices are protected by endpoint protection and
antivirus solutions. All systems (including our debt recovery process system) that hold Sensitive Data are hosted in Microsoft Azure. Security
configuration standards are reviewed annually and on significant business change and all changes to the configuration of our controls
automatically alert our security channels and email.
Our debt recovery system is designed to:
Automatically request data from the MVR using the overnight query request;
INFORMATION
Automatically ingest the results to create Fuel supplier branded recovery letters that are then sent to a mailhouse for printing and postage;
Provide a dedicated online payment portal link to make payment easy, private, secure;
Remove the associated vehicle from any Automatic Numberplate Recognition systems.
What disciplinary measures can you take against those who do not handle the
information from the register properly?
Access to this information will be tightly controlled and we have the right
to revoke access to this information for any staff or agents that do not
handle this information properly.
Failure to follow Auror policies and procedures may result in disciplinary
action, up to and including termination of employment.
RELEASED UNDER THE OFFICIAL
CA05 Application for authorised access to current names and addresses in the MVR
page 3

Using and collecting
What is your estimated volume of plate enquires each year?
the information
100,000
For help in answering this
Do you currently use the register?
question, see ‘Standard terms’
listed at the end of this form.
No
✔ Yes
If yes, what do you currently use the register for?
On behalf of our fuel supplier customers, we automate the process for obtaining details from the MVR, printing and sending letters, and collecting payment for unpaid goods and services.
What do you intend to use the register for?
Vehicle trader
✔
Fuel suppliers
Finance companies and insurers
Other (please specify)
ACT 1982
What are your reasons for not collecting the information directly from the individual
concerned?
INFORMATION
The individual has visited a fuel station and driven-off without paying for the fuel or
providing their contact information (intentionally or unintentionally).
What are your reasons for not collecting the information from a source other than the
register?
We are not aware of any other source that we can get the vehicle owner
information based on the vehicle registration.
What are you reasons for not seeking confirmation of the registered person through
the Waka Kotahi free online service?
(https://transact.nzta.govt.nz/transactions/ConfirmRegisteredPerson/entry)
The Waka Kotahi requires:
the vehicle’s plate number
the name or driver’s licence number of the person being confirmed.
Since the individual is visiting a fuel station and drives-off without paying for fuel or providing their contact information, the fuel site would not be able to obtain the name or driver’s licence number.
What are your reasons for not asking for the information through the Official
Information Act 1982?
Our customers have more than 100,000 incidents a year and many of these incidents may
require details. Therefore, requesting these under the Official Information Act 1982 would be
time-consuming for everyone involved (including NZTA).
Let us know how you tell your
How will you tell the persons whose information has come from the register about the
customers that you accessed their
fact that the register was the source of the information?
information from the register. For
example, verbally, in writing, in
In the letters sent out to the registered vehicle owner it informs them that
contract documents.
RELEASED UNDER THE OFFICIAL
their personal information was obtained from the MVR.
In most circumstances we will
require you to inform your
customer that you are accessing
their information and that they
can opt out.
CA05 Application for authorised access to current names and addresses in the MVR
page 4

How will you tell the persons whose information has come from the register about
Using and collecting
what you use the information for?
the information
(continued)
Vehicle owners are contacted by letter which informs them of the reason for contact
(non-payment of fuel), and details of the event the vehicle was involved in. These details include
an image of the vehicle, the date, time, amount of fuel taken, the pump number, and the site
location. Video evidence is also captured by the fuel retailer if the vehicle owner queries the
incident to ensure it is resolved correctly with the right person (the letter provides the fuel
retailer’s contact details).
It also provides them with a link to pay the money owed online or to visit the applicable fuel site.
Video evidence if the vehicle owner queries the incident to ensure it is resolved correctly with the
right person.
How will you tell the persons whose information has come from the register about the
fact that they can notify the Registrar that they do not wish to have their names and
addresses made available under an authorisation?
ACT 1982
In the letters sent out to the registered vehicle owner it informs them that
their personal information was obtained from the MVR.
INFORMATION
Security and privacy
What physical and computer security systems do you have in place to ensure that
information from the register is kept secure?
We need to know how that any
computers that might access
We utilise leading security standards, with secure Microsoft hosting and encrypted databases. These data centres utilise industry leading security
policies and standards and are SOC 1/SSAE 16/ISAE 3402, SOC 2, and ISO 27001/27002 compliant. Microsoft manages the physical and
the register are secured from
environmental security concerns of the data centres. Each Azure facility is designed to run 24x7x365 and employs various measures and
safeguards to help protect operations from power failure, physical intrusion, and network outages. These data centres comply with industry
the public and are password
standards (such as ISO 27001) for physical security and availability. They are managed, monitored, and administered by Microsoft operations
protected to use.
personnel.
All information in transit to and from Auror is currently encrypted using SSL 256-bit encryption. The Auror platform can only be accessed using a
secure channel where the data traffic is encrypted using a Comodo SHA-2 certificate (256-bit encryption). Transport Layer Security (TLS/SSL) is
used to protect the transfer of information and data to Auror's servers.
Auror employs independent third parties to regularly test and affirm the integrity of our security systems. Testing includes network and
application-level penetration testing
Auror offices are physically secured with key access fobs uniquely assigned to team members and an alarm system. There is no sensitive data,
customer information, permanent computing equipment or infrastructure on-site so no additional controls are needed. Auror has a documented
and published Physical Security Standard that addresses these requirements.
For example, you could tell us
What physical and computer security systems do you have in place to ensure that
about your staff training.
information from the register is only used for the purpose or purposes specified in the
authorisation?
As above, we have designed our debt recovery system and process to
restrict access to the information and that it is only used for the
purposes described above. Access to the debt recovery system is also
restricted within the company.
RELEASED UNDER THE OFFICIAL
CA05 Application for authorised access to current names and addresses in the MVR
page 5

Security and privacy
Have you ever been found to have breached any of the information privacy principles
in the Privacy Act 2020 or previous privacy legislation?
(continued)
✔
No
Yes
If yes, please explain
Have you ever been found, in proceedings of any kind, to have breached any
confidentiality obligation?
✔
No
Yes
If yes, please explain
ACT 1982
Credit check
Do you have a credit rating and, if so, what is it?
We will check for any debts to
n/a
Waka Kotahi as part of the
application process.
Authorisation term
How long do you want the authorisation to last (maximum of 5 years)?
Five years.
INFORMATION
Checklist
✔
Direct Debit Authority for payment
Make sure you’ve answered all
✔ All questions answered
the questions and attached all
✔
Any extra relevant information is attached (Any evidence of your current recording
relevant information.
processes, privacy policies and staff training materials should also be supplied with your
application.)
Standard terms
Term
Definition
To help with the timely processing
Vehicle traders
• Checking the registered person when purchasing a vehicle.
of applications, we’ve developed
• Checking that the registered person has been changed correctly
the following sets of standard
when you sell a vehicle.
terms.
• Finding registered persons for the purpose of a safety recall
When sending in an application
(wholesalers only).
for an authorisation, please
• Any other purpose necessary to facilitate the sale and purchase of
indicate in your answer to the
vehicles aside from marketing.
question ‘What do you intend to
use the register for?’ if a set of
Fuel suppliers
• Finding the registered person information of vehicles involved where
these standard terms applies to
there has been a failure to pay for goods or services.
your application.
Finance companies
• Checking the registered person of a vehicle when assessing an
and insurers
application to provide finance in relation to that vehicle.
• Checking the registered person of a vehicle when you have a security
interest in that vehicle.
• Checking the registered person of a vehicle which is involved in an
accident with your client (insurers only).
RELEASED UNDER THE OFFICIAL
• Verifying that payments for claims are made to the registered person
of the relevant vehicle (insurers only).
• Any other purpose that is reasonably required for assessing or
processing an insurance policy or claim in relation to the vehicle
(insurers only).
CA05 Application for authorised access to current names and addresses in the MVR
page 6

ACT 1982
INFORMATION
RELEASED UNDER THE OFFICIAL

s 9(2)(a)
ACT 1982
*000000-0000-0000-000000000*
INFORMATION
RELEASED UNDER THE OFFICIAL

CA05 Application for authorised access to current names and
addresses in the Motor Vehicle Register
Company details
Question
Response
Company name
Auror Limited
ACT 1982
Trading as name
n/a
Company number
3792596
Motor Vehicle Trader
n/a
(MVT)/Financial Service Provider
(FSP) number
Transport Agency customer
n/a
number
Motorcheck account number
s 9(2)(a)
INFORMATION
What is the nature of the
Auror is a Crime Intelligence Software Platform that
business?
assists retailers (such as fuel companies) and police
prevent crime and reduce loss.
Our Fuel customers include s 9(2)(b)(ii)
We provide the debt recovery
process for these retailers including accessing
Motorcheck, sending letters to registered vehicle
owners, and processing debt payments..
The purpose of our access is to undertake the above
service on behalf of our fuel customers. Specifically:
To assist in finding the registered person details in
respect of a motor vehicle that has been involved with
non-payment or failure to pay in-full for goods and
services, provided that Auror has entered into a
contract with a Fuel supplier instructing them to
undertake this activity on their behalf.
What locations does the business Auckland, New Zealand
operate from?
How long has the business been
The business was incorporated in May 2012.
operating?
RELEASED UNDER THE OFFICIAL
Company contact
Question
Response

Name
s 9(2)(a)
Phone
Email
s 9(2)(a) @auror.co
Staff and agents employed
Question
Response
How many staff or agents are
Access is restricted to three key staff members at ACT 1982
likely to have access to the
Auror. However, we have an automated process in
register?
place whereby the staff members do not actually
directly view the personal information retrieved from
the register.
What are the roles of those likely
Debt recovery and customer support team.
to have access?
What training will you give those
All employees are provided with training on privacy,
who are likely to have access on
information security, and acceptable use policy
the proper handling of the
requirements for information handling. Any employee
information from the register?
that requires access to the register also has training
INFORMATION
on our debt recovery and MVR access process.
What controls do you have in
place to ensure that those who
Our business involves handling sensitive personal
are likely to have access, handle
information every day – we already work closely with
the information properly?
NZ Police and safely share sensitive information with
them. We have processes and policies (including our
privacy policy) that ensures information is handled
properly.
We have a well developed process for access to the
MVR which includes overnight batch requests and the
resultant data is uploaded into our software which
then automatically generates the letters to be sent off
for printing and delivery. This means that our
employees do not need to view the personal
information that is provided by the MVR. Once the
letter process is complete (this occurs on a weekly
basis), the MVR data file is hard deleted from the
employee’s device.
Employees accessing the Motor Vehicle Register use
Auror provided devices and these devices are
protected by endpoint protection and antivirus
solutions. All systems (including our debt recovery
process system) that hold Sensitive Data are hosted
RELEASED UNDER THE OFFICIAL
in Microsoft Azure. Security configuration standards
are reviewed annually and on significant business
change and all changes to the configuration of our
controls automatically alert our security channels and

email.
Our debt recovery system is designed to:
-
Automatically request data from the MVR
using the overnight query request;
-
Automatically ingest the results to create Fuel
supplier branded recovery letters that are then
sent to a mailhouse for printing and postage;
-
Provide a dedicated online payment portal link
to make payment easy, private, secure;
-
Remove the associated vehicle from any
Automatic Numberplate Recognition systems.
ACT 1982
What disciplinary measures can
Access to this information will be tightly controlled and
you take against those who do
we have the right to revoke access to this information
not handle the information from
for any staff or agents that do not handle this
the register properly?
information properly.
Failure to follow Auror policies and procedures may
result in disciplinary action, up to and including
termination of employment.
INFORMATION
Using and collecting information
Question
Response
Do you currently use the register
Yes
If yes, what do you currently use
On behalf of our fuel supplier customers, we automate
the register for?
the process for obtaining details from the MVR,
printing and sending letters, and collecting payment
for unpaid goods and services. We undertake this for
over 400 petrol stations across New Zealand from
customers including s 9(2)(b)(ii)
.
Our Purpose for access is:
To assist in finding the registered person details in
respect of a motor vehicle that has been involved with
non-payment or failure to pay in-full for goods and
services, provided that Auror Limited has entered into
a contract with a Fuel supplier instructing them to
undertake this activity on their behalf.
RELEASED UNDER THE OFFICIAL
Positive Impact on Vehicle Owners
The sending of debt recovery letters and providing an
online payment service on behalf of our Fuel
customers provides the vehicle owners with a better

experience without judgement or presumptions of
guilt.
The automated process we undertake on behalf of our
fuel customers also enhances the privacy of motor
vehicle owners as it ensures that staff members at
individual service stations are not accessing the MVR,
retaining owner details, or sending unauthorised
communications (which is what used to take place).
Further, many fuel stations now have Automatic
ACT 1982
Numberplate Recognition (ANPR) technology which
prevents vehicles from obtaining fuel if that vehicle
has been involved in a non-payment event where
money is still outstanding. By utilising Auror’s
automated process, it ensures that vehicle owners are
able to quickly and easily repay any outstanding
amounts and have their vehicle removed from ANPR
alerting systems (allowing the vehicle to fill up without
prepayment or denial of service).
INFORMATION
What do you intend to use the
Fuel suppliers
register for (select out of the
following):
What are your reasons for not
The individual has visited a fuel station and driven-off
collecting the information directly
without paying for the fuel or providing their contact
from the individual concerned?
information (intentionally or unintentionally).
What are your reasons for not
We are not aware of any other source that we can get
collecting the information from a
the vehicle owner information based on the vehicle
source other than the register?
registration.
What are reasons for not seeking
The Waka Kotahi requires:
confirmation of the registered
● the vehicle’s plate number
person through the Waka Kotahi
● the name or driver’s licence number of the
free online service?
person being confirmed.
Since the individual is visiting a fuel station and
drives-off without paying for fuel or providing their
contact information, the fuel site would not be able to
obtain the name or driver’s licence number.
What are your reasons for not
Our customers have more than 100,000 incidents a
asking for the information through year and many of these incidents may require details.
the Official Information Act 1982?
Therefore, requesting these under the Official
Information Act 1982 would be time-consuming for
RELEASED UNDER THE OFFICIAL
everyone involved (including NZTA).
How will you tell the persons
In the letters sent out to the registered vehicle owner it
whose information has come
informs them that their personal information was

through the register about the
obtained from the MVR.
fact that the register was the
source of the information?
How will you tell the persons
Vehicle owners are contacted by letter which informs
whose information has come
them of the reason for contact (non-payment of fuel),
from the register about what you
and details of the event the vehicle was involved in.
will use the information for?
These details include an image of the vehicle, the
date, time, amount of fuel taken, the pump number,
and the site location. Video evidence is also captured
by the fuel retailer if the vehicle owner queries the
incident to ensure it is resolved correctly with the right
person (the letter provides the fuel retailer’s contact
ACT 1982
details).
It also provides them with a link to pay the money
owed online or to visit the applicable fuel site.
Video evidence if the vehicle owner queries the
incident to ensure it is resolved correctly with the right
person.
How will you tell the persons who
In the letters sent out to the registered vehicle owner it
information has come from the
informs them that their personal information was
INFORMATION
register about the fact that they
obtained from the MVR.
can notify the Registrar that they
do not wish to have their names
and addresses made available
under an authorisation?
Security and privacy
Question
Response
What physical and computer
security systems do you have in
We utilise leading security standards, with secure
place to ensure that information
Microsoft hosting and encrypted databases. These
from the register is kept secure?
data centres utilise industry leading security policies
and standards and are SOC 1/SSAE 16/ISAE 3402,
SOC 2, and ISO 27001/27002 compliant. Microsoft
manages the physical and environmental security
concerns of the data centres. Each Azure facility is
designed to run 24x7x365 and employs various
measures and safeguards to help protect operations
from power failure, physical intrusion, and network
outages. These data centres comply with industry
standards (such as ISO 27001) for physical security
and availability. They are managed, monitored, and
administered by Microsoft operations personnel.
RELEASED UNDER THE OFFICIAL
All information in transit to and from Auror is currently
encrypted using SSL 256-bit encryption. The Auror
platform can only be accessed using a secure channel

where the data traffic is encrypted using a Comodo
SHA-2 certificate (256-bit encryption). Transport Layer
Security (TLS/SSL) is used to protect the transfer of
information and data to Auror’s servers.
Auror employs independent third parties to regularly
test and affirm the integrity of our security systems.
Testing
includes
network
and
application-level
penetration testing
s 9(2)(c)
ACT 1982
What physical and computer
security systems do you have in
As above, we have designed our debt recovery
place to ensure that information
system and process to restrict access to the
from the register is only used for
information and that it is only used for the purposes
the purpose or purposes
described above. Access to the debt recovery system
INFORMATION
specified in the authorisation?
is also restricted within the company.
Have you ever been found to
No.
have breached any of the
information privacy principles in
the Privacy Act 2020 or previous
privacy legislation?
Have you ever been found, in
No.
proceedings of any kind, to have
breached any confidentiality
obligation?
Credit check
Question
Response
Do you have a credit rating and,
n/a
if so, what is it?
Authorisation term
RELEASED UNDER THE OFFICIAL
Question
Response
How long do you want the
Five years.
authorisation to last (maximum of

5 years)?
ACT 1982
INFORMATION
RELEASED UNDER THE OFFICIAL

NZTA CUSTOMER NO:_____________________
IMPORTANT!
PLEASE ENCLOSE BANK DEPOSIT SLIP FOR
ACCOUNT VERIFICATION AND RETURN TO THE
NZ TRANSPORT AGENCY
ACCOUNT INFORMATION
Name of Account
AUTHORITY TO ACCEPT
Customer (Acceptor) to complete bank/branch number and account number
DIRECT DEBITS
and suffix of account to be debited.
(not to operate as an assignment or agreement)
s 9(2)(a)
ACT 1982
Bank
Branch Number
Account Number
Suffix
Authorisation Code s 9(2)(a)
(User Number)
TO: The Manager
Bank Name
s 9(2)(a)
Address (PO Box)
Town/City
Date
DD
/
MM
/ YYYY
INFORMATION
I/We authorise you until further notice in writing to debit my/our account with you all amounts which -
NEW ZEALAND TRANSPORT AGENCY
(hereinafter referred to as the Initiator)
the registered Initiator of the above Authorisation Code, may initiate by Direct Debit.
I/We acknowledge and accept that the bank accepts this authority only upon the conditions listed on the reverse of this form.
INFORMATION TO APPEAR ON MY/OUR BANK STATEMENT
Payer Particulars
Payer Code
Payer Reference
Name of Account (Customer to complete)
Authorised Signatures
s 9(2)(a)
FOR BANK USE ONLY
Date Received
Recorded By
Checked By
APPROVED
RELEASED UNDER THE OFFICIAL
BANK
0510
STAMP
10/10
Original
- Retain at Branch
Copy
- Forward to Initiator if requested

s 9(2)(b)(ii)
ACT 1982
INFORMATION
RELEASED UNDER THE OFFICIAL

Document Outline