Privacy Policy

The purpose of this PFRA Privacy Policy is to describe how the PFRA maintains the privacy of individuals in accordance with the Privacy Act 2020 (the Act) and the Information Privacy Principles under the Act.

This Policy applies when the PFRA collects, stores, uses, or discloses the personal information of any individual.

1. Personal information means information about an identifiable individual
2. The PFRA will only collect personal information if that information is necessary for the purposes of the PFRA's functions and activities.
3. Types of personal information the PFRA might collect include:
   1. An individual's
      1. name, address, and contact details;
      2. educational background, training records, job title, employment history, and areas of expertise;
      3. remuneration, benefits, and bank details;
      4. performance history, performance appraisals, misconduct complaints; and
   2. Information relating to fundraising activities.
   3. Information relating to complaints and the PFRA’s Code of Conduct.
   4. Information that is required for the accreditation of PFRA members.
      
   5. Records of correspondence between an individual and the PFRA.
      
   6. Other personal information provided by the individual to the PFRA.
      
   7. Any other information that is necessary to facilitate the purposes of the PFRA’s functions and activities.

1. The PFRA will collect personal information directly from the individual concerned. Some personal information may also be collected from other sources, such as:
   1. PFRA members;
   2. Third party service providers;
   3. Publicly available sources; and
   4. Other sources authorised by an individual (such as referees during recruitment).
2. If an individual refuses to provide their personal information, or if the PFRA is otherwise unable to collect an individual's personal information, the PFRA may not be able to carry out its functions or discharge its obligations to that individual. In such circumstances, the PFRA will inform the individual of the consequences of not being provided with the personal information.

1. The PFRA collects personal information for a variety of purposes connected with its functions and activities. The PFRA will only use personal information for the purposes for which it was collected (or directly related purposes), or for any other purposes authorised by the individual concerned, or as required by law.
2. Purposes of collection include:
   1. Verifying the identity of individuals;
   2. Assessing the suitability of applicants during recruitment;
   3. Administering the SAL scheme;
   4. Administering payroll;
   5. Fulfilling the legal and regulatory obligations of the PFRA;
   6. Purposes connected to the general management of the PFRA; and
   7. Any other purpose authorised by the individual.
3. Before using personal information, the PFRA will take reasonable steps to ensure the information is accurate, up to date, complete, relevant, and not misleading.

1. The PFRA may disclose personal information where disclosure is one of the purposes for which it was collected (or a directly related purpose), or to the individual concerned or to a third party if the individual has authorised that disclosure, or as required by law.
   
2. The PFRA may disclose personal information to:
   1. Legal and regulatory authorities (such as the Inland Revenue Department);
   2. Third-party professional providers (such as accountants, auditors, and lawyers); and
   3. Third-party providers of products and services to the PFRA (such as pay-roll providers, SAL, KiwiSaver providers, IT system suppliers, information management providers).
3. The recipients of disclosed personal information may be located outside of New Zealand. Some of the countries to which personal information is disclosed may not have privacy laws that provide comparable safeguards to those in the Act. In these cases, the PFRA will either:
   1. Take steps to ensure that the recipient of any personal information protects the personal information in a way that provides comparable safeguards to those in the Act, or otherwise complies with the Act; or
   2. Obtain the authorisation of the individual concerned to the disclosure, after informing the individual that their personal information may not be protected by the recipient with comparable safeguards to those in the Act.
4. Before disclosing personal information, the PFRA will take reasonable steps to ensure the information is accurate, up to date, complete, relevant, and not misleading.

1. The PFRA will take steps to ensure personal information is protected by reasonable security safeguards against unauthorised use, modification or disclosure, or loss, or misuse.
2. The PFRA will not keep personal information for longer than is required for the purposed of which it was collected.

1. A privacy breach occurs when personal information held by the PFRA is accessed, disclosed, altered, lost, or destroyed without authority or by accident. A privacy breach also occurs when the PFRA is prevented from accessing personal information that the PFRA should have access to.
2. If a privacy breach occurs and the PFRA believes this has caused, or is likely to cause, serious harm to any information, the PFRA will notify the affected individual(s) as soon as possible. There are certain circumstances under the Act where notification may be delayed or not required.
3. If a notifiable privacy occurs, the PFRA will also notify the Privacy Commissioner as required by the Act.

1. Individuals have a right to access to their personal information and to request that any inaccuracies are corrected. Individuals may request access to or correction of their personal information by submitting their request in writing to the PFRA. The PFRA will consider the request and will respond as soon as reasonably practicable by not later than 20 working days from the date the request is received.
2. Individuals have a right, at any time, to provide the PFRA with a statement of the correction sought and to request the PFRA attach that statement to their personal information (if the correction sought is not made). If the correction sought is not made, the PFRA will take reasonable steps to attach that statement to the individual’s personal information so that it is always read with the personal information.
3. The individual may need to pay an administrative fee to cover the PFRA’s costs associated with allowing the individual to access or correct their personal information.
4. There are certain circumstances where the PFRA may not be required or permitted to allow an individual to access or correct their personal information. In some situations, the PFRA may grant access to part, but not all, of the personal information requested. The PFRA will inform the individual of the reasons for refusing their request for access (or part of their request for access) or correction.

1. Individuals who have concerns or complaints about the privacy of their personal information should contact the National Manager of the PFRA.
2. Individuals may also complain to the Privacy Commissioner if they believe an action of the PFRA may be an interference with their privacy.

The PFRA may vary, replace, withdraw or not apply this policy at its absolute discretion. This policy does not form part of any employment agreements between the PFRA and its employees.