Privacy notice

How AttendanceHQ Limited handles information in Roll Call and on this website.

Last updated: 9 November 2026.

Who handles your information?

AttendanceHQ Limited operates Attendance HQ and Roll Call. Contact our privacy contact at admin@attendancehq.com, or write to AttendanceHQ Limited, PO Box 5434, Palmerston North, New Zealand.

Your childcare or programme provider manages its family, child and staff records in Roll Call. AttendanceHQ Limited provides the software and hosting arrangements. We also handle signup enquiries, account administration, security and support information for our own service. This notice does not replace your provider's own privacy notice.

Information we handle and why

• Access requests and support: organisation name, contact name, email, optional phone and region, messages and support correspondence, to review requests, arrange access and respond to you.
• Accounts: staff and parent account details, password hashes, invitations, access permissions and session records, to authenticate users and manage access.
• Care records: information entered by providers or authorised users, including parent and child details, emergency and pickup contacts, medical or care notes, subsidy details, bookings, attendance, communications, attachments and pickup signatures, to support the provider's care administration.
• Connected accounting: supported contact details, invoice and payment information and connection credentials, to provide an organisation's authorised Xero integration.
• Technical records: request, security, audit and error records, which may include IP addresses, user identifiers and timestamps, to operate, protect and troubleshoot the service.

Required fields are marked on forms. Without the required contact details we cannot process an access request. Providers decide what care information they need; ask them about the consequences of not supplying it. Do not include children's medical details in a public signup enquiry.

Where information comes from

Information may come from you, your provider, its authorised staff, linked parents or caregivers, imported records and an authorised Xero connection. Providers must have a lawful basis for adding other people's information and give the required notices, including for indirect collection where applicable. We will help identify the appropriate contact for questions about a record.

Access and sharing

Provider records are made available according to organisation membership, roles and linked family access. Authorised Attendance HQ personnel may need access for support, administration, security or recovery. Service providers process information needed for hosting, storage, email and connected services. Information may also be disclosed where required or permitted by law. Customer care records are not offered for sale or advertising.

The Roll Call application and database are hosted in Oracle Cloud's Sydney, Australia region (ap-sydney-1). We use a separate web host for private attachments and backup copies, Google Workspace for email, and Xero when a provider connects its account. These services have separate storage and processing arrangements; the Sydney location does not describe all copies of your information. Information may be processed outside New Zealand. Contact us for information about these arrangements.

Security, cookies and incidents

Roll Call uses sign-in and role checks, protected web connections, audit records and backups. No online service can guarantee that an incident will never occur. Keep credentials private, limit staff access and secure devices and downloaded files.

The application uses cookies needed for login, sessions and form security. This update does not add advertising trackers or analytics cookies. Hosting services may keep technical access logs.

Report suspected unauthorised access promptly using our support email, with “Privacy incident” in the subject. Do not send passwords or unredacted care records. We will assess incidents, work with the affected provider and make notifications required by law. This mailbox is not an emergency response service.

Retention, exports and deletion

Records should be kept only for the purposes for which they are needed, including applicable recordkeeping obligations. The retention schedule for enquiries, account records, customer data, logs and backups is still being finalised. There is no promise of immediate or automatic erasure from every backup.

An authorised organisation owner can contact us to arrange an export or closure request. We will verify authority and agree the scope, available format, timing and any separately quoted migration work before proceeding. PDFs and reports are available in the app; a complete self-service account export or account deletion is not currently provided.

For deletion requests, we will assess legal retention needs and explain what can be removed from live records and how retained backups will be handled. Closing Roll Call access does not delete records held independently in Xero or by your provider. These arrangements need to be confirmed before a live service agreement is accepted.

Your rights and complaints

You can ask for access to your personal information or request a correction. For care records, start with your provider, or contact us and we will help route the request. We may need to verify identity and authority, including authority to act for a child. Requests are handled within the applicable statutory timeframes; a decision is normally due within 20 working days, subject to lawful extensions or exceptions. If a correction is declined, you can ask for a statement of the requested correction to be attached.

Raise privacy concerns with us first. You may also contact the Office of the Privacy Commissioner. Nothing here limits your statutory rights.

Changes to this notice

We will date updated versions and communicate material changes to affected customers.