Privacy Policy
Electricity industry software applications, including market analysis, network pricing, connection pricing, billing and related tools.
Effective date: 29 September 2026 · Version 1.3
This policy explains how 221b Limited (“221b”, “we”, “us”) collects, holds, uses and discloses personal information in connection with our electricity industry software applications and related services. It is written to meet the requirements of the Privacy Act 2020 (including the Information Privacy Principles and IPP 3A) and to describe how privacy works in a deliberately local, self-contained product architecture.
1. Who we are
221b Limited is a New Zealand company that designs and supplies software for Electricity Distribution Businesses (EDBs), traders, and other electricity market participants. Our applications support market analysis, reconciliation and volume analysis, network and connection pricing, billing and ledger functions, and related operational reporting.
  • Legal name: 221b Limited
  • Company number: 5824507 · NZBN: 9429042009948
  • Registered office: 56 Frances Street, Balclutha 9230, New Zealand
  • Email: privacy@221b.co.nz
  • Website: www.221b.co.nz
  • Privacy Officer: Malcolm Souness, Director
2. Scope and architecture
2.1 Applications covered
This policy applies to personal information handled in connection with 221b software applications and related professional services, including (as supplied from time to time):
  • Native desktop applications for electricity market and EDB analysis (including local macOS applications (ICPLedger™, TOU Router™) designed to run as a self-contained source of truth).
  • Network pricing, connection pricing and authority-aligned connection tools (including products marketed as 221b Connect, 221b LRMC or similar).
  • Billing, ledger and pricing-scenario tools used by EDBs and other market participants.
  • Supporting websites, documentation, support channels and professional services.
Where a customer has a separate written agreement with 221b that contains more specific privacy or data-processing terms, those terms prevail to the extent of any inconsistency.
2.2 Local-first design
A core design principle of 221b applications is that operational electricity data is intended to remain on the customer’s own machine or environment. The applications are deliberately self-contained. There is no requirement to move sensitive operational datasets through 221b-hosted cloud infrastructure in order to use the software.
This architecture is a privacy control as well as an operational choice. It reduces the circumstances in which 221b itself holds customer operational data, and it keeps reconciliation, ICP, tariff, billing and market datasets under the customer’s custody wherever practicable.
2.3 Our role under the Privacy Act
How the Privacy Act applies depends on what information is involved and who controls it.
  • Customer operational data. ICP identifiers, metering and consumption data, EIEP files, registry extracts, customer names and addresses held in a billing or connection management system, network asset and pricing data, and similar electricity-industry records are typically collected and held by our customer (the EDB, trader or other participant) for that organisation’s own functions. Where 221b processes such information solely on the customer’s behalf and does not use it for 221b’s own purposes, section 11 of the Privacy Act 2020 will often mean that 221b is not treated as “holding” that information. The customer remains the agency responsible for compliance with the Information Privacy Principles in respect of that information.
  • 221b account and relationship data. Information about the people we deal with at customer and prospect organisations — names, roles, emails, phone numbers, licence details, support tickets, invoices and similar — is personal information that 221b itself collects and holds as an agency.
  • Website and communications data. Information collected through www.221b.co.nz, email, phone or in-person contact is held by 221b as an agency.
Customers remain responsible for ensuring they have a lawful basis to load operational datasets into 221b applications, including any consumer, ICP or retailer data obtained under the Electricity Industry Participation Code, Use of System Agreements, EIEP protocols, or other industry protocols.
3. What personal information we collect
3.1 Information we collect as an agency
We collect only what we need for a lawful purpose connected with our functions (IPP 1). Typical categories include:
  • Identity and contact details of customer staff, contractors and prospects (name, job title, organisation, email, phone, postal address).
  • Commercial relationship information (licence or subscription details, purchase orders, invoices, payment references, correspondence).
  • Support and professional-services records (tickets, diagnostic notes, meeting notes, implementation configuration that identifies users).
  • Website technical data that may identify a visitor in combination with other information (IP address, browser and device data, pages viewed, referral source), if and when such logging is enabled.
  • Information you choose to send us (CVs if applying for work, feedback, or attachments in support requests).
3.2 Information that may be processed in applications
Depending on how a customer configures and uses an application, the software may store or process records that include personal information, for example:
  • ICP identifiers and associated registry attributes.
  • Names, addresses and contact details of connected customers or applicants, where those fields exist in billing, connection or ICP datasets.
  • Consumption, demand, tariff, invoice and payment history linked to an ICP or account.
  • Network location, capacity, ANZSIC or similar segmentation flags used in pricing analysis.
  • User account names and audit logs inside the application (who ran a scenario, exported a file, or changed a price).
221b does not require customers to send these operational datasets to us in order to operate local applications. If a customer elects to provide a copy for support, implementation, model calibration or a hosted arrangement, we treat that copy as confidential customer data and use it only for the agreed purpose.
3.3 Information we do not seek
We do not seek special categories of information such as health records, biometric identifiers, or payment card primary account numbers as part of standard application use. We do not sell personal information. We do not use customer operational electricity data to train public generative-AI models.
4. How we collect information
We collect information:
  • Directly from you, when you contact us, request a demonstration, enter a licence or services agreement, use support, or visit our website (IPP 2 and IPP 3).
  • From the organisation that employs or engages you, where that organisation is our customer.
  • From publicly available industry sources that are not themselves personal information (for example published Electricity Authority or NZX market data, network disclosures, and Commerce Commission publications), and from industry systems only where a customer is authorised to obtain them.
  • Indirectly, in limited cases — for example a colleague giving us your work email so we can issue a licence key, or a customer sending a support file that contains user names. From 1 May 2026, IPP 3A requires us to take reasonable steps to notify an individual when we collect their personal information from a source other than that individual, unless an exception applies (for example the individual is already aware, notification would be impossible or would undermine the purpose, or the information is publicly available). Where IPP 3A applies, this policy is one of the means by which we give that notice.
5. Purposes of collection and use
We use personal information we hold as an agency for the following purposes (IPP 1 and IPP 10):
  • To supply, licence, configure and support 221b applications.
  • To communicate about products, renewals, incidents, and changes to this policy.
  • To invoice, collect payment, and meet tax and company-law record-keeping duties.
  • To investigate defects, security issues and misuse.
  • To improve products using aggregated or de-identified feedback, not by mining customer operational datasets for our own secondary purposes.
  • To comply with law, including the Privacy Act 2020, the Companies Act 1993, tax legislation, and any lawful request from a New Zealand public sector agency.
We do not use personal information for unrelated secondary purposes unless an IPP 10 exception applies (for example you authorise the use, the use is directly related to the original purpose, or use is necessary to avoid a serious threat).
Where we process customer operational data solely as the customer’s agent, we use it only on the customer’s instructions and for the purpose the customer specifies — typically operating the licensed application, diagnosing a fault, or delivering agreed professional services.
6. Disclosure
We do not sell personal information. We disclose personal information we hold only where that is permitted under IPP 11, including:
  • To the customer organisation that employs or engages you, in the ordinary course of supplying the application.
  • To professional advisers (lawyers, accountants) under confidentiality obligations.
  • To service providers who process information solely on our behalf (for example an email host, accountant, or domain registrar). We remain responsible for those arrangements.
  • Where required or authorised by law, or to a New Zealand public sector agency with lawful authority.
  • With your authorisation.
Industry operational data that remains on the customer’s machine is disclosed by the customer, not by 221b. Customers must comply with the Electricity Industry Participation Code, Use of System Agreement, EIEP protocols, registry rules and their own privacy notices before sharing ICP or consumer data with any third party.
7. Overseas disclosure (IPP 12)
221b is based in New Zealand and designs its applications so that operational datasets need not leave the customer’s New Zealand environment. We do not operate a multi-tenant cloud platform that stores customer ICP or billing data in overseas regions as a default feature of the local applications.
Limited overseas disclosure may occur for 221b’s own account and relationship information if a service we use stores data outside New Zealand (for example an email or office-productivity provider). Where that happens we take the steps required by IPP 12, including ensuring the recipient is subject to comparable safeguards or that you are expressly informed and authorise the disclosure. We will not send customer operational electricity datasets overseas unless the customer instructs us to do so in writing.
8. Storage, security and retention
8.1 Security (IPP 5)
We take reasonable steps to protect personal information we hold against loss, unauthorised access, use, modification or disclosure. Measures are proportionate to the sensitivity of the information and include:
  • Local-first application design so operational datasets remain under customer custody.
  • Access limited to people who need the information to perform their role.
  • Device encryption, unique credentials, and current operating-system and application updates on systems we control.
  • Confidential treatment of any support files a customer elects to send us, and deletion or return when the support purpose is finished.
  • Contracts or equivalent instructions with any processor acting on our behalf.
No method of storage is perfectly secure. Customers are responsible for securing the machines, backups and networks on which they install 221b applications, including access control, encryption at rest, and backup discipline.
8.2 Retention (IPP 9)
We keep personal information only as long as it is needed for the purpose it was collected, or as required by law. Typical periods:
  • Customer relationship and invoicing records: for the life of the commercial relationship and then for at least seven years to meet tax and company record obligations.
  • Support correspondence: generally up to seven years after the relevant matter is closed, unless a longer period is needed to evidence a licence or defect.
  • Prospect contact details: until it is clear there is no ongoing interest, or you ask us to delete them.
  • Support copies of operational datasets: only for the duration of the agreed task, then deleted or returned.
Customer-held data inside a local application is retained according to the customer’s own retention schedule. Uninstalling the application does not of itself delete separate customer databases or export files the customer has created.
9. Accuracy, access and correction
We take reasonable steps to keep personal information we hold accurate, up to date, complete, relevant and not misleading (IPP 8).
You may request access to personal information 221b holds about you, and you may request correction (IPPs 6 and 7). Send requests to the Privacy Officer at privacy@221b.co.nz. We will need to verify your identity. We will respond as soon as reasonably practicable and in any event within the timeframes in the Privacy Act 2020.
If the information you want sits only in a customer’s instance of a 221b application (for example an ICP record or a connection application), you should make the request to that customer. They are the agency that holds it. We will reasonably assist a customer who needs our help to locate or export such information from software we support.
We do not usually charge for access or correction. If a charge were ever contemplated, we would tell you first.
10. Cookies and website analytics
The 221b website is primarily informational. If we use cookies or a privacy-respecting analytics tool, we will collect only what is needed to operate and understand use of the site. We do not use advertising pixels as a core part of our product model. Where a cookie is not strictly necessary, we will provide an appropriate choice. Browser settings can usually block or delete cookies.
11. Children
Our applications are business tools for electricity industry organisations. They are not directed at children. We do not knowingly collect personal information from children for marketing purposes.
12. Automated decision-making and AI
Pricing, forecasting and scenario tools may apply models, statistical methods or machine-learning techniques to electricity volumes, prices, network attributes and similar operational inputs. Those tools are used by the customer organisation to support its own analysis. They are not used by 221b to make legally significant decisions about identifiable consumers without human involvement at the customer.
If 221b uses AI tooling internally (for example to assist software development or to summarise a support thread you sent us), we will not upload customer operational datasets containing personal information to a public model in a way that allows that data to be retained or used to train the model. Any use of AI on personal information remains subject to the Information Privacy Principles.
13. Privacy breaches
If we become aware of a notifiable privacy breach involving personal information we hold as an agency, we will notify the Office of the Privacy Commissioner and affected individuals as required by Part 6 of the Privacy Act 2020.
If a breach occurs in a customer-controlled environment (for example an unencrypted export left on a shared drive), the customer is responsible for assessing notification duties. We will cooperate promptly if our assistance is needed.
14. How to contact us or complain
Questions, access requests, correction requests and privacy complaints should be sent to:
  • Privacy Officer: Malcolm Souness
  • Email: privacy@221b.co.nz
  • Post: 221b Limited, 56 Frances Street, Balclutha 9230, New Zealand
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner:
You may also seek advice from the Electricity Authority or your own organisation’s privacy officer if the matter concerns industry datasets held by a market participant rather than by 221b.
15. Changes to this policy
We may update this policy to reflect product changes, legal developments (including IPP 3A practice) or our contact details. The current version will be identified by the effective date on the first page. Material changes will be notified to licensed customers by email or through the usual support channel.
Continued use of 221b applications or continued dealings with us after a change takes effect constitutes notice of the updated policy. It does not reduce any rights you have under the Privacy Act 2020.
16. Interpretation
References to “personal information”, “agency”, “holds” and the Information Privacy Principles have the meanings in the Privacy Act 2020. References to industry instruments (the Code, EIEP, registry, ICP) have their ordinary meanings in the New Zealand electricity market.
This policy is not legal advice to customers on how they should draft their own consumer-facing privacy statements. EDBs and traders that hold consumer information should maintain their own notices covering collection from consumers, registry and retailer sources, and any secondary use of ICP data for pricing, outage or connection purposes.

© 2026 221b Limited. All rights reserved.
This document is intended for publication to customers, prospects and users of 221b applications. It may be reproduced in full. It must not be altered and reissued as if it were 221b’s current policy.