Privacy statement

How to use this

A privacy statement only helps if it’s true. Fill it in from your personal information inventory, not from memory or another organisation’s statement. Delete sections that don’t apply, and replace everything in [square brackets].

The Privacy Commissioner’s free Privacy Statement Generator is another good starting point. This template adds worked wording for indirect collection, overseas storage and retention, which are the sections people most often get wrong.

Write for your actual audience. If many of the people you serve speak te reo Māori, Samoan, Tongan, Hindi or Chinese, consider a short version in those languages too.

Privacy statement

[Organisation name] Last updated: [date]

This statement explains what personal information we collect, why, who we share it with, and what rights you have. We follow the Privacy Act 2020.

Who we are

[Organisation name] is [a short description, for example “a community health trust based in Whangārei”]. You can contact us at [email], [phone] or [postal address].

Our privacy officer is [name or role]. Contact them at [email] with any questions or requests about your information.

Information we collect from you

When you [use our services / buy from us / join / apply for a job], we collect:

• [contact details: name, email, phone]
• [account and transaction details]
• [information you give us when you contact us]
• [for job applicants: CV, work history, right to work]
• [anything else, listed specifically]

[If any information is optional, say so, and say what happens if you don’t provide it.]

Information we collect from other people or organisations

Sometimes we get information about you from someone other than you. When we do, we’ll tell you, unless you already know or another exception in the Privacy Act applies.

[Add a row for each indirect collection in your inventory. Name organisations where you routinely collect from them.]

Information collected automatically

When you use our website, we [describe: for example, “use privacy-respecting analytics that don’t use cookies or identify you” / “use cookies to keep you signed in”]. [Name any third-party tools, such as analytics or advertising services, and what they collect.]

Why we use your information

We use your information to:

• [provide the service you asked for]
• [process payments]
• [contact you about your account or booking]
• [meet legal obligations, such as tax records]
• [improve our services, using information that doesn’t identify you where we can]
• [send you news and offers, only if you’ve agreed. You can unsubscribe at any time.]

We won’t use your information for a different purpose unless you agree, or the law allows it.

Who we share it with

We share information only where needed for the purposes above:

• Service providers who work for us, such as [our IT provider, payment processor, email provider]. They may only use it to provide services to us.
• [Named partners], to [purpose].
• Government agencies where the law requires it, such as [Inland Revenue].
• Anyone else you ask us to share with.

We don’t sell your personal information.

Storing information overseas

Some of our service providers store information outside New Zealand, in [countries or regions]. They hold it on our behalf and may only use it to provide services to us, so we remain responsible for it under New Zealand law. [If you disclose information to an overseas organisation for its own use, explain how comparable safeguards are ensured.]

How we protect it

We protect your information with [describe briefly: access limited to staff who need it, multi-factor authentication, encryption, staff training]. If we have a privacy breach likely to cause you serious harm, we’ll tell you and the Privacy Commissioner as soon as practicable.

How long we keep it

We keep information only as long as we need it:

• [customer records: 7 years after your last transaction, to meet tax law]
• [unsuccessful job applications: 6 months after the role is filled, unless you ask us to keep it longer]
• [enquiries: 2 years]

Then we securely delete or destroy it.

Your rights

You can ask for a copy of the personal information we hold about you, and ask us to correct it if it’s wrong. Contact our privacy officer at [email]. We’ll respond within 20 working days. We may need to confirm your identity first.

If you’re not happy with how we’ve handled your information, please tell us first so we can try to fix it. You can also complain to the Privacy Commissioner at privacy.org.nz.

Changes to this statement

We’ll update this statement when our practices change, and change the date at the top.