Policy Provisions and Procedures
4.1 Collection and Use of Personal Information
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may process your data in order to enter into and perform a contract with you, or based on our legitimate interest of fraud prevention, safety and security; error detection and rectification; marketing our services; or analytics in terms of visitors’ website use and their experience in order to improve the service. Sometimes we may seek your consent or get in touch based on the contact email you left on our website, of which you can always opt-out by clicking a link in our correspondence or emailing us to GDPR@studygroup.com.
Our staff will have access to your personal information only where they have a genuine need to do so.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:
Information you give us
You may give us information about you by filling in forms on our site or by corresponding with us by phone, e-mail or otherwise. This includes information when applying for enrolment, at orientation sessions, during periods of study and information that you provide when you register to use our site, subscribe to our service, search for a product, and when you report a problem with our site. The information you give us may include your name, address, telephone number(s), email addresses(s), date of birth, gender, country of birth, nationality, citizenship country, passport details, academic and English language attainments, disabilities, health information, including illnesses, allergies and dietary Information. SGNZ may also collect information regarding payment of fees.
Information we collect about you
With regard to each of your visits to our site we may automatically collect the following information:
- technical information, including the Internet protocol (IP) address used to connectyour computer to the Internet, your login information, browser type and version, timezone setting, browser plug-in types and versions, operating system and platform;
- information about your visit, including the full Uniform Resource Locators (URL)clickstream to, through and from our site (including date and time);
- products you viewed or searched for;
- page response times, download errors, length of visits to certain pages, pageinteraction information (such as scrolling, clicks, and mouse-overs); and
- methods used to browse away from the page and any phone number used to call ourcustomer service number.
Information we receive from other sources
We may receive information about you if you use any of the other websites we operate or the other services we provide. We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them in relation to your expressed interest in our services and information required to enter into a contract with you such as creditworthiness.
4.2 Recipients of your personal data
In order to conduct its proper functions and activities and as required under the Education Act 1989 and other laws, regulations, and contractual agreements by which it is bound, SGNZ may disclose the student information it holds to:
government departments, and agencies for financial support and pastoral care:
Such agencies include, but are not limited to:
The Ministry of Education (information will be recorded on the NationalStudent Index and used in an authorised information matching programmewith the NZ Birth Register);
The Ministry of Social Development (including Work and Income NZ andStudyLink);
Inland Revenue Department;
Immigration New Zealand;
Tertiary Education Commission;
New Zealand Qualifications Authority;
New Zealand Vice–Chancellors Committee;
New Zealand Trade and Enterprise;
Statistics New Zealand;
Education New Zealand; and
Scholarship providers or sponsors.
- related body corporates of SGNZ;
- bodies responsible for course moderation, benchmarking or quality assurance andprofessional accreditation or membership;
- external organisations such as secondary schools, other tertiary educationinstitutions, and tertiary admission centres, and English language testing verificationservices to verify qualifications for selection processes;
- Service providers contracted to SGNZ. Where one of our service providers is locatedoutside of New Zealand, personal information collected and held by SGNZ may betransferred outside of New Zealand;
- organisations that provide services related to your status as a student or staffmember (including public transport providers, academic dress hire providers andorganisations that provide discounts or benefits);
- parents or guardians of students under 18 years old;
- social media – including Facebook (in order to provide targeted information on SGNZprogrammes and events);
- in the event of an emergency, to police, medical or hospital personnel, civilemergency services, legal representatives or nominated emergency contact persons,or other persons assessed as necessary to respond to the emergency;
- Legal advisors or other professional advisors and consultants engaged by SGNZ;and
- Other agencies or individuals where permitted or required in accordance with thePrivacy Act 1993 or other legislation.
SGNZ will not disclose an individual’s personal information to another person or organisation unless:
- the individual concerned is reasonably likely to have been aware, or madeaware that information of that kind is usually passed to that person ororganisation;
- the individual concerned has given written consent to the disclosure;
- SGNZ believes on reasonable grounds that the disclosure is necessary to preventor lessen a serious and imminent threat to the life or health of the individualconcerned or of another person;
- the disclosure is required or authorised by or under law; or
- the disclosure is reasonably necessary for the enforcement of the criminal lawor of a law imposing a pecuniary penalty, or for the protection of the publicrevenue.
In such circumstances, SGNZ will include in the records containing that information a note of the disclosure.
Any person or organisation to whom personal information is disclosed as described in this procedure must not use or disclose the information for a purpose other than the purpose for which the information was supplied to them.
4.3 Sensitive Information
Under the GDPR, information relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, sex life, sexual orientation and criminal convictions is considered sensitive information.
We are required under New Zealand law to collect information relating to:
- your racial or ethnic origin, as part of our admission and enrolment processes;
- your criminal convictions, if you are being employed in a role covered by theVulnerable Children Act 2014.
We may also collect information relating to:
- your racial or ethnic origin, for statistical purposes and promotion of equity anddiversity;
- your criminal convictions, as part of our pre-employment vetting processes andwhere you have applied for certain programmes (e.g. education and health);
- your trade union membership information, to ensure that you are employed on thecorrect employment agreement; and
- your health information, as part of our employment processes, where you haveenrolled with Mauri Ora (our Student Health and Student Counselling services),Disability Services, Accommodation Services or our recreation services, applied for afield trip, student exchange or study abroad programme. This helps us ensure wecan provide a safe and healthy environment.
We do not collect any other form of sensitive information. However, if you or others have provided it to us, we may hold it in our systems.
If you are in the European Union, please note that some New Zealand law requirements regarding our collection of sensitive information may conflict with your rights under the GDPR. If you have any concerns about our collection of sensitive information, please email GDPR@studygroup.com.
4.4 Cross-border disclosures
Before SGNZ discloses personal information to an overseas recipient, it will take reasonable steps to ensure that the overseas recipient does not breach the IPPs in relation to that information.
4.5 Disclosure of personal information to University Partners
SGNZ delivers courses and provides services on behalf of certain universities. In each case, all data collected on behalf of a university is provided by SGNZ to the university.
4.6 Security of Personal Information
SGNZ will take all reasonable steps to ensure any personal information collected is relevant to the purpose for which it was collected, is accurate, up-to-date, complete and not misleading.
SGNZ will store securely all records containing personal information. SGNZ will take all reasonable security measures to protect personal information collected from unauthorised access, misuse or disclosure.
4.7 Third-party marketing
We will get your express opt-in consent before we share your personal data with any company outside SGNZ for marketing purposes.
4.8 Right to Access and Correct Records
You have a right to access personal information that SGNZ holds about you, subject to any exceptions in the Privacy Act 1993. If you wish to seek access to your personal information or inquire about the handling of your personal information, contact the Privacy Officer by email at email@example.com.
If an individual considers their personal information to be incorrect, incomplete, out of date or misleading, they can request that the information be amended.
Where a record is found to be inaccurate, a correction will be made. Where a student requests that a record be amended because it is inaccurate but the record is found to be accurate, the details of the request for amendment will be noted on the record.
You also have the right to make a complaint to the Office of the Privacy Commissioner if you think we have breached, or may have breached, your privacy. You can contact the Office of the Privacy Commissioner at www.privacy.org.nz.
In addition, the GDPR gives you the right to:
- withdraw consent, where consent is the legal basis for our processing of yourinformation;
- be forgotten, that is your information to be removed from systems that we use toprocess your personal information. However, under New Zealand law, we arerequired to retain certain information under the Public Records Act 2005;
- request copies of your personal information in a structured, commonly used andmachine-readable format and/or request us to transmit this information to anotherperson (where this is technically feasible);
- restrict our processing in certain ways;
- object to certain processing activities by us; and
- make a complaint to a supervisory authority.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive. A cookie message will appear on our site before we store any cookie on your device.
4.10 Advertising and Remarketing Cookies
SGNZ uses 3rd party vendor re-marketing tracking cookies including the Google Adwords tracking cookie. These tell us when a user arrives on our site by clicking on one of our paid adverts. We also use Google Adwords Remarketing to advertise SGNZ across the internet. Remarketing will display relevant ads tailored to you based your prior use of our website, through cookies placed on your machine.
These cookies do not in any way identify you or give access to your computer or mobile device. These cookies allow us to tailor our marketing to better suit your needs and only display messages relevant to you.
Requests to access or obtain a copy of personal information must be made in writing and should be sent to the Privacy Officer at firstname.lastname@example.org.
Students may be required to verify their identity when requesting access to information. SGNZ may charge a fee to cover the cost of verifying the request and locating, retrieving, reviewing and copying any material requested. SGNZ will advise the likely cost in advance.
4.11 Retention of personal information
We retain your personal information for as long as is necessary for our Purposes and Legitimate Interests and for us to comply with our legal obligations and perform our contracts with you.
We are required under New Zealand law to retain information in accordance with the Public Records Act 2005. If you are in the European Union, please note that in some situations, this may conflict with your rights under the GDPR.
4.13 Complaints and Appeals
If a student has a complaint or an appeal regarding privacy and personal information, the SGNZ Student Complaints and Appeals Policy and Procedure will apply.
The Head of Compliance is responsible for responding to requests for personal information.