Privacy Policy

1. Introduction

The purpose of the Policy is to detail how The Academy protects the privacy of all persons whose personal information is retained/stored as defined by the Privacy Act (2020) and the New Zealand Privacy Principles and the Health Information Privacy Code (2020).

We cannot achieve our mission without collecting and processing personal information about our prospective, current, and former students, as well as our donors and friends. We understand that trust is essential for individuals to relinquish control of their personal information, and we are committed to using this information responsibly and treating it with care and respect.

This policy explains how The Academy collects and processes your personal information. Personal data refers to any information that identifies or can identify a living individual. When various data elements are combined, they may reveal the identity of a particular person. Should you have any questions regarding the handling of your personal data, you can contact our Privacy Officer via email at privacy@theacademy.ac.nz.

The Academy must comply with the relevant New Zealand legislation including:

• Privacy Act 2020
• Health Information Privacy Code 2020
• Health Act 1956

This Privacy Policy details how The Academy Board protects your privacy and how we comply with the requirements of the Privacy Act, New Zealand Privacy Principles, and the Health Information Privacy Code 2020 by outlining:

• The New Zealand Privacy legislation;
• Who we collect personal information from;
• The types of personal information we collect;
• The purpose of the personal information collection;
• How we collect personal information;
• How we use personal information;
• How we store and make your personal information secure;
• How you can gain access to your personal information and seek its correction;
• How you may complain or inquire about our collection, handling, use or disclosure of your personal information and how that complaint or inquiry will be handled; and
• Whether we are likely to disclose your personal information to any overseas recipients.

2. Types of Personal Data We Process

We handle personal information from our students, their families or legal guardians, as well as from our employees, job applicants, suppliers, contractors, potential customers, and third parties legally authorised to act on their behalf. The types of personal data we typically process include:

• Names, addresses, telephone numbers, email addresses, and other emergency and medical contact details.
• Family details.
• Nationality and location.
• Previous schools attended, qualifications, recommendations, and references.
• Educational and employment data.
• Images, audio, and video recordings, including CCTV footage.
• Safeguarding information (such as court orders and professional involvement).
• Financial information.

We may also collect and process additional data based on our school's requirements and your consent, including:

• Medical history.
• Food intolerances or allergies.
• Behavioural information.
• Special educational needs.
• Biometric data.
• Criminal records linked to an individual.
• Ethnicity.
• Religious beliefs or ideology.

3. How We Collect and Process Personal Data

The Academy collects information directly from individuals or legally authorised parties acting on their behalf in several ways, including:

• From emails and hand-delivered documents, such as job applications, invoices, letters, and consent forms.
• Through online tools such as apps, educational platforms, and other software used by our schools.
• Via telephone.
• Through our website.
• Using cookies on our website, which collect login data, browsing behaviour, settings, and actions in web applications.
• Via CCTV cameras located at our premises.

The Academy does not collect or process information from individuals under the legal age without parental or legal guardian consent.

4. Lawful Basis for Processing Your Information

We process your information based on the consent you provide, as well as for the performance of a contract and to comply with any legal obligations arising from it. We may also process your information based on the legitimate interests of The Academy, such as when sending communications about our activities.

5. Purposes for Which We Process Personal Data

Below is a summary of the purposes for which we may process your personal data, along with the corresponding lawful bases. In some cases, we may rely on more than one legal basis, depending on the specific circumstances. If you would like more details about the specific legal grounds we rely on, please contact us.

1. To register you as a new customer for the purpose of performance of a contract with you
   Type of Data:
   - Identity
   - Contact
   - Profile
   - Financial Information
2. To provide educational services for the purposes of ensuring admission criteria, providing educational services, and fulfilling legal requirements
   Type of Data:
   - Identity
   - Contact
   - Profile
   - Educational Records
   - Health Records
   - Safeguarding Information
   - Family Details
   - Images, audio, and video recordings, including CCTV footage
3. To notify you of legal obligations and changes for the purpose of performance of a contract with you
   Type of Data:
   - Identity
   - Contact
   - Profile
4. To improve our services for the purpose of pursuing our legitimate interests
   Type of Data:
   - Identity
   - Contact
   - Profile
   - Marketing and Communications
5. To administer and protect our business and websites for the purpose of pursuing our legitimate interests
   Type of Data:
   - Identity
   - Contact
   - Profile
   - Technical
6. To use data analytics for the purpose of pursuing our legitimate interests
   Type of Data:
   - Technical
   - Usage
7. To manage CVs and employment applications for the purpose of managing recruitment and employment processes
   Type of Data:
   - Identity
   - Contact
   - Professional Background
   - References
8. To enable participation in competitions or awards for the purposes of fulfilling contracts and pursuing our legitimate interests
   Type of Data:
   - Identity
   - Contact
   - Profile
   - Usage
   - Marketing and Communications
9. To carry out fraud assessments for the purpose of performance of a contract with you
   Type of Data:
   - Identity
   - Contact
   - Financial
   - Transaction
   - Technical
10. To collect and recover money owed to us for the purpose of performance of a contract with you
    Type of Data:
    - Identity
    - Contact
    - Financial
    - Transaction
11. To make product or service recommendations for the purpose of pursuing our legitimate interests
    Type of Data:
    - Identity
    - Contact
    - Technical
    - Usage
    - Profile
12. To deliver relevant content and advertising for the purpose of pursuing our legitimate interests
    Type of Data:
    - Identity
    - Contact
    - Profile
    - Usage
    - Marketing and Communications
    - Technical

6. Sharing Your Personal Data

We will not share your personal information with others unless it is necessary for the purposes for which it was provided or as required by law.

7. Data Retention

Personal data will only be kept for as long as necessary to fulfil the legal or business purposes for which it was collected in line with The Academy’s ‘IT, Digital Records and Digital Security Policy’. After that, the information will be securely deleted or anonymised.

8. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to access and correct your personal information. You can make a specific request by contacting our Privacy Officer at privacy@theacademy.ac.nz. We aim to respond to your request within 10 working days of receipt.

9. Marketing

With your consent, we may use your personal information for direct marketing purposes. You have the choice to opt out of marketing communications at any time by following the unsubscribe links in our emails or by contacting us directly.

• Promotional Offers: We may use your identity, contact, technical, usage, and profile data to determine what products, services, and offers might be of interest to you.
• Opting Out: You can request to stop receiving marketing messages at any time. Even if you opt out, we may still process your data for legitimate reasons, such as fulfilling a contract or complying with legal obligations.

10. Use of Photographs and Audiovisual Recordings

Images are created to celebrate student achievements and to serve as memories of students’ time at The Academy. These images may be used internally and externally, including for marketing purposes. Consent for such use is required via our ‘Student Information Consent Form’ and can be withdrawn at any time by contacting our Privacy Officer at privacy@theacademy.ac.nz.

11. Storing and Securing Information

The Academy uses appropriate technical and organisational measures to ensure the security, confidentiality, integrity, and privacy of personal data, preventing unauthorised access, unlawful processing, accidental loss, destruction, or damage in line with The Academy’s ‘IT, Digital Records and Digital Security Policy’.

We may use third-party service providers to store your personal information and provide us with services. This means that we may transfer personal information, or access it from, countries other than New Zealand.

We recognise that we are accountable for your personal information wherever it is in the world. Where possible, we will send personal information only to countries with adequate privacy laws. If this is not possible, we will take reasonable steps to ensure that any third-party service providers meet our privacy and security expectations.

12. Cookies on Our Website

We use cookies to improve your experience on our website and to store visitor information, such as session IDs. Functional and targeting cookies require your consent. You can find more information about our Cookies Policy at: https://www.theacademy.ac.nz/cookiePolicy.

13. Social Networks and External Links

Our site contains links to other websites, including social networks. The Academy is not responsible for the privacy practices or content of these sites. Please review their respective privacy policies before using their services.

14. Complaints

If you believe your request has not been adequately addressed or that your data is being processed in violation of applicable laws, please contact our Privacy Officer at privacy@theacademy.ac.nz or lodge a complaint with the relevant supervisory authority.

This policy is subject to change. Any modifications will be communicated via our website. This version aims to reflect our commitment to protecting your personal information. Should you have any questions, do not hesitate to reach out to us.

Last updated August 2024