This Privacy Policy provides information relating to how Citycare Water collects, stores, uses, discloses and disposes of personal information.

Individuals are entitled to:

request access to personal information that is held about them
request that the information held about them be corrected

By providing personal information to us, you are accepting and consenting to the practices described in this Privacy Policy. If you do not agree with any of the terms of this Privacy Policy, please inform us and do not submit any further personal information to us.

The Privacy Act 2020 (the “Act”) promotes and protects individual privacy, and this policy does not limit or exclude any individual rights under the Act. If you wish to seek further information on the Act, see www.privacy.org.nz.“Personal information” under the Act means “information about an identifiable individual”.

Information and Privacy Principles

The Act establishes 13 information and privacy principles (IPPs) that cover the collection, use and disclosure of information relating to individuals by the Employer, as well as access to and correction of that information by the individuals concerned.

The privacy principles are subject to certain restrictions imposed by the Act and may be expressly overridden by provisions in other Acts.

A breach of the IPPs may amount to interference with privacy, which the Privacy Commissioner may investigate.

Complaints not settled by the Privacy Commissioner may fall to be determined by the Human Rights Review Tribunal.

The IPPs provided for by the Act are:

Principle 1 – Purpose:  Information must be collected for a lawful purpose connected with the activity and functions of the Employer. The collection of the information must be necessary for that purpose.

Principle 2 – Source:  Personal information must be collected directly from the individual concerned, apart from in limited circumstances.

Principle 3 – Collection:  When personal information is collected directly from an individual, the person collecting must ensure that the individual is aware of several matters, including the purpose for which it is collected, the intended recipient, the fact that the individual has a right to access to, and a right to request correction of, that information.

Principle 4 – Manner of Collection:  Personal information may not be collected unlawfully or in any way that is unfair in the circumstances or which intrudes unreasonably on personal privacy.

Principle 5 – Storage and Security:  The Employer must ensure that it has reasonable safeguards for securing from loss, access, use, modification, disclosure or misuse of the information.

Principle 6 – Access to Personal Information:  Any individual is entitled to confirmation from the Employer as to whether it holds personal information and access to that information about them if it is readily retrievable.

Principle 7 – Correction:  An individual is entitled to request correction of personal information about them held by the Employer.

Principle 8 – Accuracy:  The Employer cannot use personal information without taking reasonable steps to ensure that the information is up to date, complete, relevant and not misleading.

Principle 9 – Time Limit:  Personal information may not be kept longer than necessary for the purpose for which it may lawfully be used.

Principle 10 – Limits on Use:  Personal information obtained for one purpose may not be used for another purpose subject to certain exceptions.

Principle 11 – Limits on Disclosure:  The Employer must not disclose personal information to any person or agency, unless one of the following applies:

there is a reasonable belief that disclosure is one of the purposes for which information has been obtained;

disclosure is to or on behalf of the individual concerned;

disclosure is necessary to enable the sale of the business;

disclosure is necessary to prevent a serious or imminent threat to public health or safety;

it has been authorised by the Privacy Commission;

the information is publicly available;

disclosure is necessary to avoid prejudice to the maintenance of law; and

the information will not be used in a form which identifies the individual concerned; and

Principle 12 – Cross-Border Disclosure: The Employer may disclose information to a foreign person or entity only under limited circumstances as outlined in the Act.

Principle 13 – Unique Identifier:  The Employer may not assign a unique identifier to an individual unless this is necessary to enable it to carry out its functions effectively.  A “unique identifier” is a tag that does not use the individual’s name.

Purpose

This Privacy Policy sets out the principles which are used by Citycare Water to collect, store, use, disclose and dispose of personal information. Citycare Water’s Privacy Policy is provided to all staff and Board members. It is the responsibility of each staff and Board member to understand and apply this policy. It also applies to contractors engaged by Citycare Water. It is the responsibility of the Manager engaging the contractor to ensure they comply with all Citycare Water policies while working for Citycare Water.

Scope

Citycare Water collects, holds and uses personal information to perform our work and as part of employing and engaging staff. Citycare Water is committed to ensuring that personal information is managed appropriately, and we strive to uphold good practice privacy standards in the collection, storage, use and disposal of personal information.

Personal information at Citycare Water is subject to:

The Act and associated 13 IPPs that cover the collection, handling, storage and use of personal information
The Official Information Act 1982
The Public Records Act 2005

What personal information is collected?

Citycare Water only collects personal information that is reasonably necessary to conduct the functions or activities of our business. The purpose for collecting the personal information will be clearly articulated before, at, or as soon as practicable after the collection. Generally, personal information will be used for dealing with your request, enquiry or employment-related matters.

Personal information collected will differ depending on the purpose of collection. For example, a resume/cv may be required from candidates applying for a position; mailing address details for subscriptions to company newsletters; and emergency contact and tax information for human resource management.

By sending emails, you will be providing Citycare Water with certain personal information which may include your name and contact details. This information is collected by Citycare Water for the purpose of dealing with your request. Citycare Water may not be able to deal with your request without collecting this information from you.

When it is reasonable and practicable to do so and provided another exception in the IPPs does not apply, Citycare Water will collect your personal information directly from you.

Citycare Water also collects personal information from recruitment service providers in seeking out prospective job applicants.

Information collected via our website

To ensure Citycare Water are meeting the needs and requirements of our website users, and to develop our online services, Citycare Water may collect aggregated information by using cookies. Cookies are unique identification numbers like tags that are placed on the browser of our website users. The cookies do not in themselves identify users personally but are linked back to a database record about them. Citycare Water may use cookies to track use of our website, and to compile statistics on visits to the site in an aggregated form and log anonymous information such as:

the address of a user’s server;
a user’s top-level domain (such as .com or .nz);
the date and time of a user’s visit;
the pages a user accessed and downloaded;
the search engine a user used;
the type of browser that was used.

When a user visits our site, a cookie may be placed on their machine. Where a user has visited us before, the cookie may be read each time they re-visit the site. Citycare Water do not use this technology to access any other personal information of a user in our records and a user cannot be personally identified from a cookie.

Our website host Plato Creative Design Limited also has access to our website and may from time to time need to access the site and data contained within it. Plato Creative Design Limited’s privacy policy can be found on platocreative.co.nz). Citycare Water currently have Google Analytics, Facebook Pixel, and LinkedIn Pixel codes on our website.

Ceridian Dayforce is the web-based recruitment system used by Citycare Water to view applications from candidates who have registered or made an application for a vacancy at Citycare Water. Ceridian Dayforce’s privacy policy can be found on  https://www.ceridian.com/privacy

Please note that the above examples do not provide a complete list of all areas where personal information is collected and may be subject to change.

How will Citycare Water use and disclose personal information?

Citycare Water will use personal information only for the purposes for which it is collected, except where legislation allows it to be used for other purposes. Citycare Water will, when using information, take reasonable steps to ensure it is complete, relevant, up-to-date and not misleading. 

Personal information will only be disclosed to unrelated third parties with your consent or where required by law, or for one of the purposes for which the information was obtained. We may disclose your personal information to:

our employees, related bodies corporate, contractors or service providers for the purposes of operating our business or website, fulfilling requests by you or to provide products and services to you;
suppliers and third parties with whom we have commercial relationships, for business, marketing and related purposes; and
other organisations for authorised purposes with your express consent.

Citycare Water may share personal information with related companies or with contractors performing services for Citycare Water. In these instances, we will use reasonable endeavours to ensure that these organisations comply with the IPPs.

How will Citycare Water store and manage your data?

Citycare Water will maintain all reasonable safeguards against the loss, misuse or inappropriate disclosure of personal information and maintain processes to prevent unauthorised use or access to that information. In particular:

Citycare Water will keep physical documents secure, including circumstances where there is a business need to take them outside of Citycare Water premises, and no technical solution is applicable.
Citycare Water will keep electronic personal information secure by ensuring its data storage is protected from external sources, maintaining a regular backup of data to secure storage and applying good practices for information security management.
Citycare Water may use cloud computing services to manage and store information. Where used, Citycare Water will take reasonable steps to protect the personal information we hold from misuse and loss, interference and from unauthorised access, modification or disclosure.

Citycare Water will securely de-identify or dispose of personal information when we have no further need to use it, or when we are required by law to do so.

Email Security

In accordance with our email policy, any emails you send will be automatically scanned which may result in your email or attachments being blocked. Our IT administrators may have access to your emails to authorise the content for security purposes only and not thereafter.

How can I access and correct information?

You may request access to personal information that we hold about you. Citycare Water will provide you with access to personal information in accordance with the Act and IPPs. There may be instances where we cannot grant you access to the personal information that we hold, for example, if it would interfere with the privacy of others or if would result in breach of confidentiality. If you are refused access to information, we will provide you with reasons for the refusal and inform you of any exceptions relied upon under the IPPs.

Citycare Water will take reasonable steps to make sure that the personal information we collect, use or disclose is accurate, complete and up to date. If you believe that the personal information Citycare Water holds about you is inaccurate or out of date, please let us know and request us to amend it. Citycare Water will consider your request, and if Citycare Water is satisfied with your request, will take reasonable steps to correct the information. If it is not agreed that there are grounds for amendments, then Citycare Water will follow the procedures set out in the IPPs.

Privacy incidents

A privacy incident includes an actual privacy breach, a potential privacy breach, or a near miss.

A privacy breach occurs when there is unauthorised or accidental access to or disclosure, alteration, loss or destruction of personal information. A privacy breach can also include an action that prevents Citycare Water from accessing the information on either a temporary or permanent basis.

A potential privacy breach occurs where an IPP might have been breached, but it is not known if an actual breach occurred. 

A near miss is where an action could have resulted in a breach, but ultimately, the breach does not occur. 

All privacy incidents (actual and potential breaches or near misses) discovered by staff should be notified to their immediate manager. Managers are responsible for managing the response to the privacy incident. 

A Privacy Incident Reporting form should be completed as soon as possible. This will be provided to Citycare Water’s Privacy Officer, who will advise further on the management of the privacy incident. This may include notifying the Office of the Privacy Commissioner of the incident where required under the Act or if notification is considered necessary in the interests of transparency. 

Requests and Complaints 

Where any member of staff becomes aware of a privacy complaint made by an individual to Citycare Water or to the Office of the Privacy Commissioner, Citycare Water’s Privacy Officer should be notified.

Who to contact?

Citycare Water’s Privacy Officer is Heidi Walkley. Her contact details are as follows:
Telephone:  021 223 9164 Email Heidi.Walkley@citycarewater.co.nz