Privacy Policy

Here are a few key privacy messages, outlined in more detail below:

• We only collect personal information where this is necessary to carry out our functions.
• We may collect personal information about you either directly from you or from other people or agencies, and we may create records about you (for example, your participation in events, workshops or training) when we carry out our functions.
• If we collect personal information about you from another person or agency, we will take reasonable steps to ensure you are informed as soon as reasonably practicable. We will inform you about who provided the information to us and how we will use it, the purpose of collection, who it may be shared with, who holds it, any legal authorisation for collecting it, and how you can access and correct it.
• We store all our data (including your personal information) with secure cloud providers.
• We protect our data with all reasonable technical and process controls.
• You can ask us for a copy of your personal information or ask us to correct it by emailing info@tepou.co.nz at any time.
• We will only use and share personal information where necessary to carry out the functions for which we collected it, or if required by law.

Effectively engaging with people and providing our services requires us to collect and use some personal information. We only collect personal information where it is necessary to carry out our functions, support the delivery of our programmes and services, meet our contractual or legal obligations, or otherwise authorised by law.

Some of the information people share with us is sensitive. This includes lived experience of mental distress or addiction that people may disclose during our work. We treat this information with particular care: we limit who can access it, we use it only for the purpose it was shared with us, and we take care that people cannot be identified when we aggregate or report information.

This may include situations where you provide informarion to us, where your employer, a training provider, an individual delivering training programmes on our behalf, or another organisation provides your details to us so you can participate in an event, programme, grant or research activity. We may also collect information that is necessary to identify you, deliver a service, or meeting our funding or legal obligations.

Where another organisation provides your personal information to us, we take reasonable steps to ensure you are informed, either directly by us or through that organisation on our behalf. Where we rely on another organisation to tell you on our behalf, we ask them to confirm they have done so. You can opt out of our communications activities, such as receiving our newsletter, at any time.

We collect information about you from:

• you, when you provide personal information about yourself to us, including via our website and any related service, through any contact with us, or when you use our services or products
• third parties authorised by you to provide personal information or who provide publicly available information
• a third party where this is allowed by law
• if possible, we will collect personal information directly from you rather than a third party.

Where information is collected in these ways, we notify people in line with this Privacy Policy and the Privacy Act.

The information we collect when you engage with us can include:

• your name, age, gender and ethnicity
• your contact details, including your address, email address or phone number
• professional information such as qualifications, professional registration and your employer
• your bank account number, other identifying documents, or other details required for us to pay you
• the content of your enquiry
• any questions or comments you submit via our blog or live chat function
• details of any events you have registered for, including dietary or other specific requirements
• your responses to surveys, research, interviews or focus group discussions (these will usually be captured in a de-identified form)
• your e-learning results
• information that is required for a specific project or programme area.

We collect ethnicity information so we can report to funders and monitor equity of access to, and outcomes from, our services. We use it only for these purposes and handle it with care.

We also collect information about your use of our website. We make no efforts to associate this with your identity unless you have signed up to our website. Information collected includes:

• your IP address
• the search terms you used
• the pages, resources, and files you accessed on our website and the links you clicked on
• the date and time you visited the site
• the referring site (if any) through which you clicked to our website
• your operating system (such as Windows 10)
• the type of web browser you use (such as Mozilla Firefox).

We use some third-party providers to manage some of our engagement processes and services, such as newsletters, events registration, live chat and e-learning. Where we do this, any personal information you provide (such as your email address) may also be collected and stored by this provider and you should also check their privacy statements when using those services. We take steps to ensure that any providers we use meet our privacy and security requirements in order to protect any personal information they process for us. See a list of our third-party providers. We have agreements with these providers requiring them to protect your personal information, and we check they continue to meet our privacy and security requirements. Some providers may store information outside Australia and Singapore; where they do, we only use providers with comparable privacy safeguards to New Zealand.

We take all reasonable steps to ensure any personal information we collect is protected against loss, unauthorised access and disclosure or any other misuse, including meeting the requirements prescribed by the New Zealand Government for the secure handling, storage and disposal of any protectively marked or security classified information.

We use third party providers to store and process our data.

We store most of the personal information we collect and generate electronically on Microsoft Azure cloud servers located in Australia and Digital Ocean servers in Singapore. We also use Microsoft Office 365 for our email and other office productivity applications. While your information may be stored overseas, we only use providers that have comparable privacy safeguards to New Zealand.

We retain personal information only for as long as necessary. We keep it in line with our retention and disposal schedule, and we securely dispose of it once we no longer have a lawful reason to keep it.

How we use it

We will only use the personal information provided to us for the purposes of delivering the services requested (such as registering you for an event, applying for funding) or carrying out our lawful functions.

We may use your personal information to:

• contact you about your request, query, registration or possible research or evaluation related to a workshop or event you participated in
• follow up for research or evaluation you have already participated in
• inform research, evaluation and quality improvement
• send you electronic or hard copy newsletters, resources, or information you have requested
• consider and respond to your enquiry
• make a decision regarding your eligibility for funding
• moderate the content on our live chats and blogs (including contacting you about this)
• improve our website and the delivery of our online services
• conduct internal statistical analysis and meet our reporting requirements.

When we share it

We do not generally share your personal information with third parties other than third parties which are providing services to us (for example, trainers or facilitators who require participant information delivering training on our behalf). Where we share information with a trainer or facilitator, we share only the information they need to deliver the training or event. However, we may share your personal information, if necessary, to appropriately respond to your enquiry. We may share your personal information with a third party where the disclosure is authorised by you.

Sometimes we manage registrations for, host or co-host an event with another organisation. Where we do this, we may share registration, waitlist and attendance information (such as your name and contact details, and any requirements you have told us about) with that organisation, so it can organise, deliver, administer and follow up the event. Where this applies, we tell you at the point of registration that we are acting on behalf of or with that organisation and that your details will be shared with them. We share only the information needed for those purposes.

We may share personal information if required by law (for example to assist with the investigation of a criminal offence), to prevent or lessen a serious threat to the health and safety of a person or the public, for statistical purposes where you will not be identified, or for any other lawful purpose under the Act. If our staff are threatened or abused, we may refer this to the Police.

Some of our services are funded by government agencies. Some funding contracts require us to share information that identifies the people we work with to the funding agency for reporting purposes. Where we do this, we share it through secure data transfer, on the basis that the funder has a clear purpose for it and will protect it.

Your privacy rights and how to contact us

The Privacy Act gives you rights to request access to and correction of the personal information we hold about you. You can take steps to control the ways we use your information (such as opting out of receiving newsletters). You can also complain to us at any time if you think we have misused your personal information.

Contact us to exercise any of these rights, including the right to complain about our privacy practices.

Request access to or correction of your personal information

You have the right to request a copy of the personal information we hold about you (whether we have collected from you directly or from a third party). You also have the right to ask us to correct your information if you think it is wrong.

We will process your request as soon as possible, and no later than 20 working days after we receive it.

We will be as open as we can with you, but note your right to request personal information may be limited if it breaches another person’s right to privacy or is subject to an overriding national security legislation.

We may occasionally need to withhold personal information under sections 27-29 of the Privacy Act, for example where the information requested is legally privileged. However, we will only ever withhold information where necessary.

You may request a correction of personal information that you consider is inaccurate. Where the correction requested cannot be made or we dispute the accuracy of the correction, we will make a note on your personal information.

Opting out of certain uses of your information

You can opt out of receiving our newsletter or being included on any other subscription list or news feed by following the unsubscribe link at the end of the email or contacting us.

When you visit the Te Pou website it will attempt to set cookies on your browser. A cookie is a text file that a website transfers to your browser to remember specific information about your visit or visits. Some of these cookies may remain on your computer after you close your browser. Some of these cookies are from organisations we use to monitor website usage.

Te Pou does not use cookies to collect personal information about you, only about your browser session.

The cookies make it easier for you to use the dynamic features of certain website pages.

You can configure your internet browser not to store cookies and set your browser to ask for your permission before it accepts a cookie.

Privacy breaches

All staff receive relevant information privacy training to minimise the risk of a privacy breach.

A privacy breach includes unauthorised or accidental access to, or the disclosure, alteration, loss or destruction of, personal information, or being prevented from accessing it. All staff must report any actual or suspected privacy breach to the Privacy Officer as soon as they become aware of it. The Te Pou Privacy Officer helps assess the potential impact on the people affected. If a breach is likely to cause serious harm, an internal investigation is carried out, and an action plan is implemented.

If a breach of privacy occurs that is likely to cause affected individuals’ serious harm (guidance on this is available through the Privacy Commissioner’s Notify Us tool on their website), the Privacy Officer will notify the Privacy Commissioner and any affected individuals, as soon as practicable, unless an exemption under the Act applies.

Complaining about our privacy practices

We want to know if you have concerns about our privacy practices, whether these relate to the way we collect or share information about you or our decision on your access request. This allows us to try and put things right for you and helps us to identify and fix any problems with our systems or processes.

Let us know about your concerns and we will try our best to resolve it. This could include escalating your concerns to a senior staff member to ensure we have made the right decision and fully considered your concerns.

If we cannot resolve your concerns, then you have the right to complain to the Privacy Commissioner about our actions. For more information about the complaints process visit the Office of the Privacy Commissioner’s website.

Contact Te Pou Privacy Officer

Our Privacy Officer is Te Pou Chief Executive. You can contact the Privacy Officer at info@tepou.co.nz, marking your message for the attention of the Privacy Officer. We aim to acknowledge privacy enquiries within two working days.

Changes to the Privacy Policy

We may update this Privacy Policy from time to time.