Collection notices for forms

How to use this

Your privacy statement is the long version. A collection notice is the short version people actually see, right where they hand over information. Together they make up what the Privacy Commissioner calls a layered notice.

Each notice below covers the matters IPP 3 requires. It says that you’re collecting, why, who will receive it, whether it’s required, your name and contact, and the right to access and correct. Link to your full statement for the rest. Keep notices short enough that people read them.

Collection notices

Website sign-up or contact form

We’ll use your details to [respond to your enquiry / set up your account]. Only our [team / named service provider] will see them. Fields marked * are required; we can’t [respond / create your account] without them. You can ask to see or correct your information at any time. Read our privacy statement.

Newsletter sign-up

We’ll use your email address only to send you our newsletter, about [frequency]. You can unsubscribe from any email. We use [email provider] to send it, which stores your address [location]. Privacy statement.

Job application

We collect the information in your application to assess you for this role. The hiring panel and [recruitment provider] will see it. If you’re shortlisted, we’ll contact referees you nominate, and we may [check your criminal record through the Ministry of Justice / check your qualifications], with your consent. We keep unsuccessful applications for [6 months] and then delete them. You can ask to see or correct your information. Contact [privacy officer email].

The referee and background checks are indirect collections. Telling applicants here, in advance, covers IPP 3A for those collections.

Event or programme registration

We collect your details to manage your registration and contact you about this event. Dietary and accessibility information is used only to cater for you, and is deleted after the event. [Photos will be taken at the event and may be used on our website and social media. Tell us at check-in if you’d rather not be photographed.] Contact [email] to see or correct your information.

Information about a child, collected from a parent or caregiver

We collect this information about your child to [purpose]. It will be seen by [who] and, in an emergency, shared with health providers. [The law that requires it, if any.] Your child has the right to see and correct their information, and so do you on their behalf. Please share this with your child in a way that suits their age. Contact [email].

Collecting a child’s information from a parent is indirect collection under IPP 3A, so this notice is addressed to the parent so they can pass it on.

Health or sensitive information

We’re asking for this information because [specific reason]. It’s optional / required because [reason]. Only [named roles] will see it. It’s stored [securely, in New Zealand / with provider]. We’ll keep it for [period]. You can ask to see or correct it at any time by contacting [privacy officer].

Phone script

“Before we go on, I’ll be taking some details so I can [purpose]. They’ll be kept in our [system] and only our [team] will see them. You can ask for a copy of what we hold at any time. Is that OK?”

CCTV sign

Cameras operating. [Organisation] records video on these premises for [security and safety]. Footage is kept for [30 days] unless needed for an incident. To ask about footage of you, contact [phone/email].

Information you’ve received about someone else (IPP 3A notice after collection)

We’ve received information about you from [source], including [what]. We’ll use it to [purpose], and share it with [recipients]. [Law, if any.] You can ask us for a copy of what we hold and ask us to correct it by contacting [name, email, address].