Privacy and other policies

• Feedback & Complaints
  
• Child protection policy
• Safeguarding policy

1. This Privacy Policy explains the terms under which personal data is shared with Habitat for Humanity NZ, how that data is used and your rights with respect to understanding and modifying how it will be collected and used.

• Habitat: Means Habitat for Humanity New Zealand Limited and each of its Affiliates.
• Personal Data: Includes any information or image that relates directly to, and can be identified as being associated, either directly or indirectly with a named individual person.
• Sensitive Personal Data: Includes health, dietary, medication, biometric, religious associated, sexual identification, political viewpoints or affiliation information in relation to a named individual person.
• Privacy Breach: A Privacy Breach occurs when personal information is accessed, disclosed, altered or destroyed in an unauthorised manner or where personal information is lost or becomes unavailable because of some sort of action.
• Notifiable Privacy Breach: Where a Privacy Breach occurs in such a manner that it could have a serious impact on any affected individual or business. In such a case, there is a mandatory requirement to notify the Privacy Commissioner.
• Urgent Disclosures: A provision under the Privacy Act 2020 that allows cross-border disclosure of personal information when it is necessary to maintain public health or safety, to prevent a serious threat to life or health or for the maintenance of the law.

1. The European Union has enacted the General Data Protection Regulations (GDPR) and these have been adopted by HFHI, who has required their adoption by Area Offices and National Offices, for application to personal data collected in relation to the Global Village programme.
   
2. The NZ Privacy Act 1993 has been repealed and replaced with the Privacy Act 2020. This brings it into closer alignment with GDPR provisions.
   
3. GDPR provisions are considered to be a proxy for Best Practice in the field of Privacy provisions.
   
4. This Policy has been formulated to be fully compliant with the requirements of the NZ Privacy Act 2020 for all programmes and concurrently fully compliant with GDPR for the Global Village programme and almost fully compliant for Habitat NZ’s other programmes with exceptions as specifically identified. This has been done to simplify electronic systems and reduce complexity of operating two systems, one for NZ operations and one for Global Village.
   
5. This policy has been written in plain English, Question and Answer format so as to be easily understood by the Data Processors (usually Habitat staff) and the Data Subjects (individuals who already have or may provide personal data to Habitat).

(a) How does this Privacy Policy apply to you?

1. This Privacy Policy applies to the personal data you provide to Habitat, including but not limited to, when you:

• make a donation

• register for an event

• sign up for a Newsletter

• otherwise provide information via the Habitat website or via phone, email, social media, texting, mobile applications, at a special event, face-to-face or in response to a solicitation

2. We will only collect personal data that we have a need to know in order acknowledge or process a donation or make the necessary arrangements to satisfy your enquiry and/or participation in a Habitat event.

3. Before we request your personal data, we will advise you what the data is being collected for, how it will be used and ask you to confirm your agreement to these conditions by indicating in the “Tick box” or by signing a statement as appropriate.

4. You may give Full Consent or Limited Consent. Full Consent enables Habitat to use the data for all the stated purposes and can keep you updated with progress reports, Habitat news and new opportunities. Limited Consent restricts the use of the data to only the primary purpose it was collected for and the data will be deleted after the primary purpose has been completed and there is no remaining functional and legitimate reason for retention of the data.

(b) Why do we hold and process personal data?

1. Habitat may request from you, or you may volunteer to provide, your contact information, including your name, mailing address, phone number(s), social media handles and email address(es). We hold and process supporters’ personal data for a number of reasons including:

a. to keep a record of donations made and actions taken by our supporters and our communications with them

b. to comply with any statutory obligations

c. to send our supporters marketing information about our projects, fundraising activities and appeals where we have consent or are otherwise permitted to do so

d. to fulfil contractual obligations entered into with supporters

e. to support volunteers , such as during build or fundraising events

f. to support community-based fundraising and campaigning

g. to ensure we do not send unwanted information to supporters or members of the public who have informed us they do not wish to be contacted

h. to manage supporters’ accounts and provide customer service

i. to offer sweepstakes, contests, giveaways or other promotions

j. to enforce the website terms of service

k. to perform other functions as described at the time Habitat for Humanity collects the information

l. to allow urgent disclosures to be made

2. If you make a donation or otherwise provide us with your information, Habitat for Humanity may contact you from time to time about opportunities to make additional donations or to provide you with information about upcoming programmes.

(c) When will we send you personalized marketing communications?

1. Habitat may contact you for marketing purposes eg to keep you up to date on our work or to let you know how you can support that work, only where we have your consent or we are otherwise allowed to do so because of your prior engagement with Habitat, as explained further below (see (c) 5“Our reliance on your prior support”)

2. We will make it easy for you to tell us if you would like to receive marketing communications from us and hear more about our work, and the ways in which you would like to receive this information. We will not send you marketing material if you tell us that you do not wish to receive it. Instructions for how to do so are below (see (j) “How to control what we send you or update your personal information”)

3. Duration: In respect of the Global Village programme only, where you give us consent to send marketing information, Habitat will presume that your full consent will last for 24 months unless you have chosen the limited consent option. After this time, in order for us to update you, Habitat will seek your refreshed consent. You can update or withdraw your consent at any time. If you have chosen limited consent, your data will be deleted as soon as it is no longer needed.

Habitat will presume a longer period of consent in several situations:

a. where you have committed to making a regular donation. In this situation, unless you withdraw your consent, we will treat consent as ongoing unless you cancel your donation, at which point your consent will be assumed to expire 24 months after the date of your last donation.

b. where you have notified us that you will be leaving a legacy to Habitat.

c. where your name is associated with any financial transactions, that information is required by statute to be retained within our accounting system for 7 years.

d. Where your name is associated with any Health and Safety incident, that information is required by statute to be retained within our systems for 10 years

4. Our reliance on your prior support: You may also receive marketing material from Habitat if you have previously made a donation to Habitat or agreed to receive newsletters. However, we will not rely on your prior consent if you have opted out of receiving emails, newsletters or other marketing material in your communications with Habitat.

(d) How and when do we obtain information about you?

1. Habitat may obtain your personal data in the following circumstances:

a. when you give it to Habitat when you make a donation, payment, sign up for one of our events or when you make an application for one of the housing programmes we offer.

b. when you give it to Habitat indirectly. Sometimes your personal data is collected by an organisation acting on Habitat’s behalf such as a professional fundraising agency. In such cases, the agency is working on our behalf and we are the “data controller” responsible for security and proper processing of your data.

c. when you access Habitat’s sponsored social media sites including Facebook, WhatsApp, Twitter or LinkdIn you make personal data available depending upon your settings or the privacy policies of these social media and messaging services.

d. when information is publicly available such as in a newspaper or other media coverage and open postings on social media sites. Habitat will not seek such publicly available information on an ongoing basis without consent.

2. When we use cookies. Cookies are used to help you interact with our Website and they help us understand the effectiveness of our communications strategies. You can manage the use of cookies in respect of your computer. For more information on cookies, visit: www.aboutcookies.com

3. The Habitat website may contain hyperlinks to websites owned by other organisations. These third-party websites have their own policies on privacy and cookies. Habitat cannot accept responsibility for the privacy practices of such third-party websites.

4. If you are a child or young person, Habitat will consider the way it collects your personal information to ensure our actions are fair in the circumstances.

(e) What personal information might Habitat collect?

1. Habitat will only collect personal data about you that is relevant to the type of transaction or project you have engaged in with us. For example, if you have made a donation we may need your name, contact details and bank account details to allow for the proper processing of the donation. Age, travel restrictions, personal building-related skills, health, next-of-kin and passport information will be required if you wish to join an international team.

2. All personal data is stored on a restricted access system and is only available to staff on a need-to-know basis.

3. Sensitive personal data. We do not collect your “sensitive personal data”, such as health or dietary information, unless there is a clear reason for doing so. For example, we will have a need to understand any health limitations and also medications being used if you wish to join a Global Village international build project.

4. Information similar to credit card details will not be stored in house as per Payment card industry data security standards.

5. All sensitive personal data is stored on a password-protected system to which only a limited number of relevant staff have access. It is deleted when it is no longer needed and is available for you to see and review it should you wish to do so.

(f) How will Habitat use your personal data? We will advise you when we request your personal data the reasons we wish to collect the data. These reasons could include any one or more of the following or other specified reason:

1. for administrative reasons relating to your communications with us and ours with you.

2. to confirm and recognize donations made to us

3. in relation to correspondence you have entered into with us

4. in relation to any statutory obligations we must comply with

5. to assist in the event of an emergency that involves you

6. for internal record keeping so as to keep a record of your relationship with us

7. to implement any instructions you have given us with regard to withdrawing consent to send marketing information

8. to use IP addresses to identify location of users and to block disruptive use and analyse geographic spread

9. for marketing and fundraising purposes

10. to analyse and improve the activities and content offered by the Habitat website to provide you with the most user-friendly navigation experience

(g) What about personal data we provide to other Habitat organisations?

1. We may share your information with another Habitat Organisation overseas, such as in connection with your participation in a Global Village Build or to enable a National Organisation of a country in which you have expressed an interest, to update you about its programmes and marketing materials.

2. Before we will share your personal data with another organisation, Habitat requires that the organisation receiving the data maintains security controls that will ensure that your data is securely stored and accessible only by appropriately trained personnel who have a legitimate need to know. In cases where the organisation is overseas, the Privacy Act 2020 provides rules an organisation must follow whenever personal data is sent “across Borders”. Habitat NZ is required by its International parent organisation to comply with the European Union Privacy requirements. These already meet the NZ Privacy Act requirements.

3. Habitat understands that emails do not have inbuilt security that is sufficiently robust to ensure a high level of data privacy. We therefore discourage you from sending personal data by email and we always provide either on-line forms that can ensure secured data transmission or downloadable forms that you can print off, complete and post to us.

(h) Will we share your information outside the Habitat network?

1. Facebook and Social Media sites: We may use your email address and phone number to match to your Facebook or other social media account in order to show you Habitat content while you use those services. We only do this where you have consented to receiving marketing emails, either by opting in (where you reside within the European Economic area) or by not opting out (where you reside elsewhere). We may also use your email address and phone number to link to Facebook or other social media sites in order to identify other users of these sites whom we believe would be interested in Habitat.

2. You can prevent this use of your data by either updating your consent preferences directly with us at Habitat or via the social media sites.

3. There may also be occasions when Habitat needs to share your personal data with service providers to enable them to deliver their service. An example is when Global Village teams are being organized and a Travel Agent or airline needs to know specific personal information in order to carry out ticketing processes.

4. We will also comply with requests from third parties where disclosure is required by law or where that disclosure is permitted by law and for a justified reason.

5. Under some circumstances and in situations involving children, we may share information with third parties as provided for under the Family Violence Act 2018 and recent amendments to the Oranga Tamariki Act 1989 that require that agencies providing Children’s Services consider sharing information upon request from a specified group of other providers of children’s services. Such consideration will take into account:

a. whether the requesting agency is authorized to receive such information and

b. whether the information is being requested for an approved reason and

c. whether the best interests and safety of the child are being served by the information release

6. In addition, care will be taken to:

a. ensure that information provided is up to date and accurate

b. ensure that sufficient information is given, including background or related information to help achieve the desired outcome, but

c. to ensure that information given does not include anything that is not relevant to the purpose for which it was requested and

d. wherever possible, we will seek permission from persons to whom information being considered for release, relates.

(i) How long will Habitat keep your personal information?

1. We will hold your personal information on our systems only for as long as we have a need for that information or until you withdraw your consent. Personal Information you provide in connection with our Global Village programme will be presumed to expire after 24 months. In some circumstances, we may be required to hold your information beyond these times in order to comply with our legal and regulatory obligations.

2. If you request that we stop sending you marketing materials, we will keep a record of your contact details and the detail of your request to enable us to comply with your wishes.

3. Legacy income is vital to the running of the charity. In the event of a legacy contribution, we may keep personal information provided to us indefinitely, in order to carry out legacy administration and communicate effectively with the families of people who have left us legacies.

4. Some information is required by law or by our external auditors to be retained for specified periods of time and for specified purposes. That information will generally be held on our Accounting system and will not be available for purposes other than what has been specified.

(j) How to control what we send you and update your personal information.

1. The accuracy of your information is important to us. We want to ensure that we are able to communicate with you in ways that you are happy with and to provide information that is of interest to you.

2. If you wish to change how we communicate with you, or update the information we hold, then please contact us:

a. to amend your contact details or preferences for any type of communication, email us: campaigns@habitat.org.nz including the details of the changes you want.

b. to stop receiving newsletters and marketing materials either click on the “Unsubscribe” link of a newsletter you have received or email us: campaigns@habitat.org.nz including your specific request.

3. In responding to a request to not receive marketing information, we will take all reasonable efforts to meet the following service:

a. emailed communications: 48 hours from receipt of email

b. mailed communications: 28 days from receipt of “do not mail” request. This period is longer than for other channels because of longer production times for mailing campaigns. Mostly, we would expect the change to be made much more quickly.

4. Under the terms of the General Data Protection Regulations and of NZ Privacy Law, you have the right to request a copy of the personal information we hold about you, to have any inaccuracies corrected and to have personal information deleted from our system. If you wish to request action under the provisions of this clause, please make a formalized request known as a Subject Access Request (SAR). A SAR form is available on our Website. In line with standard guidelines for these requests, we will require you to prove your identity with two pieces of approved identification. We will respond to such requests within 30 days of receipt. Please send any SAR requests, or questions or complaints about our Privacy Policy to: Data Privacy Officer, Habitat for Humanity NZ, PO Box 112 387, Ellerslie, Auckland 1642.

(k) How Habitat keeps your data safe.

1. We ensure that there are appropriate technical controls in place to protect your personal details. For example, our online forms that ask for personal information are stored on networks that are password-protected, are accessible only on a need-to-know basis and are routinely monitored.

2. All sensitive personal data is stored on a secure database, to which only a limited number of relevant staff have access. This data is deleted when it is no longer needed by us and is never shared with third parties. It is also available to you at any point should you wish to see it.

3. Within Habitat, we undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers or contractors.

4. Where we share your data with a Habitat National Organisation, your information remains secure because the National Organisation is required by Habitat for Humanity International to have similar data protection measures in place as described in this policy.

5. We may use external companies to collect or possess personal data on our behalf. We do comprehensive checks on these companies before we work with them and in our legal agreements we clearly set out our requirements regarding how they manage the personal data to which they have access.

(l) Privacy Breach

1. The Privacy Act recognises that there is a possibility of personal data held by organisations being disclosed, altered, lost or destroyed either unauthorized or accidentally (Confidentiality Breach). The Act also refers to an availability breach where personal information cannot be accessed possibly because of a technical issue or a denial-of-service attack (Availability Breach).

2. Where any such a breach occurs and it has or could have a serious impact on any affected individual or business it becomes mandatory for the details of the breach to be notified to the Privacy Commissioner.

3. If Habitat discovers any such breach that may have an impact on you, it will:

a. notify you of the breach;

b. investigate how the breach occurred and implement urgent measures to minimize any impact on you and to prevent a recurrence;

c. notify the Privacy Commissioner of the details of the breach and;

d. comply with any additional countermeasures required by the Privacy Commission.

(m) Use of unique identifiers

1. Habitat will not assign a unique identifier to your personal data.

2. In a situation where Habitat needs to request you provide a unique identifier provided by a third party (eg National Health Index number) Habitat will take steps to ensure that this data is not misused. Habitat will not require you to provide such a unique identifier unless it is necessary.

(n) Changes to this Privacy Policy

1. This privacy policy may be updated from time to time.

2. You may wish to check the policy each time you submit personal information.

3. If you do not agree with any changes that have been made, please do not continue using the Habitat website to submit personal information to Habitat.

4. If material changes are made to the Privacy Policy, we will notify you by placing a prominent notice on the website.

Last Updated: August 2021
Next Review Date: August 2024