ZEDUCATION

Collection, Use & Retention of Personal Information
 
Policy Statement 

Zeducation Limited is dedicated to maintaining the privacy and confidentiality of personal information. 
We ensure that all practices related to the collection, sharing, and retention of personal information 
comply with relevant legislative requirements, including the Privacy Act 2020, Tax Administration Act 
1994, Goods and Services Tax Act 1985, Electronic Transactions Act 2002, and any other relevant 
legislation applicable to Zeducation's services. 

Application of Policy 

This policy applies to all employees, contractors, volunteers, and governance members engaged by 
Zeducation who collect, access, use, or manage personal information. 

Objectives 
● To collect personal information for clear, specific, and lawful purposes. 
● To ensure clients are fully informed about the collection, access, and use of their personal 
information. 
● To guarantee clients' rights to access and correct their personal information. 
● To protect the personal information of children and young people. 
● To dispose of personal information securely when it is no longer required. 
● To address privacy matters promptly and report serious privacy breaches. 

Procedures 

1. Collection of Personal Information 

● Purpose Specification: Personal information will be collected only for purposes that are clear, 
specific, and lawful. The specific purpose of the information collection will be communicated to 
the client at the time of collection. 

● Notification: Clients will be informed in a clear and comprehensive manner about the purpose of 
collecting their personal information, the entities and individuals who will have access to their 
information, and how their personal information will be used. 

● Consent: Explicit, informed consent will be obtained from clients before collecting their personal 
information. Consent will be documented and stored securely. 

● Minimal Collection: Only the minimum amount of personal information necessary to achieve the 
specified purpose will be collected. 

● Children and Young People: extra care will be taken to ensure collection is fair and not 
unreasonably intrusive; consent will also be obtained from a parent or guardian where 
applicable; information will be collected in a manner appropriate for the age and understanding 
of the child or young person. Where applicable, Zeducation will comply with relevant obligations 
under the Children's Act 2014. 

2. Use of Personal Information 

● Usage Limitation: Personal information will be used solely for the purposes for which it was 
collected unless otherwise authorised by the client or required by law. 

● Access Control: Access to personal information will be restricted to authorised personnel who 
need it to perform their duties. Access will be managed through secure systems and processes. 

● Data Sharing: Any sharing of personal information with third parties will be conducted in 
compliance with relevant legislation and with the client's informed consent. Third parties will be 
required to adhere to our privacy standards. 

2.1 Māori and Pasifika Data Sovereignty 

Zeducation recognises the importance of Māori and Pasifika data sovereignty and is committed to 
ensuring that personal information relating to Māori and Pasifika individuals and communities is 
collected, used, and interpreted in a culturally respectful, appropriate, and empowering manner. 
Zeducation will: 

● Ensure that Māori and Pasifika data is interpreted and represented in a strengths-based and 
positive context, avoiding deficit-based assumptions. 

● Build and maintain relationships with relevant Māori and Pasifika communities and stakeholders 
to support appropriate use, interpretation, and sharing of data. 

● Support the access, use, and empowerment of communities in relation to their data, where 
appropriate and in accordance with privacy and legal obligations. 

3. Retention and Disposal of Personal Information 

● Retention: Personal information will be retained only for as long as necessary to fulfil the 
purposes for which it was collected, or as required by law. Specific retention periods will be 
established based on legal and business requirements. 

● Disposal: When personal information is no longer required, it will be disposed of securely to 
prevent unauthorised access, use, or disclosure — including shredding physical documents, 
securely deleting electronic records, and ensuring third-party service providers adhere to our 
disposal standards. 

4. Client Rights 

● Access Rights: Clients have the right to request access to the personal information held about 
them by the organisation. Requests will be processed within the timeframes specified by the 
Privacy Act 2020. 

● Correction Rights: Clients have the right to request corrections to their personal information if it 
is inaccurate or incomplete. The organisation will verify the identity of the requester, correct the 
information within a reasonable timeframe, and inform the client of the correction or the reason 
for not making it. 

● Process for Requests: Requests for access or correction can be made in writing or 
electronically. The organisation will provide assistance to clients who require help in making a 
request. 

5. Security of Personal Information 

Personal information will be protected against unauthorised access, use, modification, or disclosure 
through appropriate technical and administrative safeguards, including: 

● Password protection and restricted access permissions on all systems holding personal 
information. 

● Secure physical storage of paper-based records. 

● Training on Zeducation's policies and procedures, including privacy, is recorded in Zeducation's 
Policies and Procedures Training Register. Policies are reviewed on a regular basis, and staff 
training is refreshed monthly, or more frequently where needed, to ensure all staff remain up to 
date on current policies and procedures, including their privacy responsibilities 

● Regular review of access permissions to ensure only authorised personnel retain access. 

● Firewalls, antivirus, device security and secure disposal of IT equipment are covered separately 
in Zeducation's IT and Cyber-Security Safety Policy. 

6. Responding to Privacy Matters 

● Privacy Officer: A designated Privacy Officer is responsible for managing privacy-related 
enquiries and complaints, investigating and resolving complaints in a fair and timely manner, and 
maintaining a record of all privacy complaints and their outcomes. 

● Reporting Breaches: Serious privacy breaches will be reported to the Privacy Commissioner in 
accordance with the Privacy Act 2020. The organisation will notify affected individuals promptly, 
take immediate steps to mitigate the breach and prevent future occurrences, and document the 
breach and the measures taken in response. 

Review and Monitoring 

This policy will be reviewed annually to ensure ongoing compliance with relevant legislation and best 
practices in privacy management. Any updates or changes will be communicated to all staff and 
stakeholders. The Privacy Officer will be responsible for monitoring compliance with this policy and 
providing regular reports to the senior management team. 

Contact Information

For further information about our privacy policies and procedures, or to make a request or complaint, 
please contact: 

Zeducation Limited 
Privacy Officer: Sandra Haufano 
2E Glasgow Road, Pukekohe 2120 
Phone: 027 303 3910 
Email: sandra@zeducation.co.nz 
Website: www.zeducation.co.nz 

Policy Approval 
This policy is approved by the Directors of Zeducation Limited and takes effect from the date of approval 
below. 

Position: Director          
Name: Sandra Haufano          
Acknowledgement 
Date: 18 May 2026 ​