Privacy

The purpose of this Policy is to set out how Rapid Relief Team (RRT) NZ Limited (“RRT NZ”, “we”, “us”, “our”) collects, holds, uses, and discloses Personal Information in accordance with the Privacy Act 2020 (NZ). This Policy ensures that RRT NZ handles all Personal Information responsibly, securely, and transparently in line with legal obligations and community expectations.

This Policy applies to:

1. All RRT NZ staff, volunteers, contractors, and representatives who collect, handle, or process Personal Information on behalf of RRT NZ.
2. All Personal Information collected through RRT NZ’s websites, digital platforms, forms, and events, as well as information collected directly or indirectly from clients, donors, suppliers, and beneficiaries.

This Policy does not apply to information collected through channels without a link to this Policy.

1. Personal Information: Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.
2. Sensitive personal information (internal term): Personal information that, due to its nature (for example, health, biometrics, background checks, or information about vulnerability), could cause greater harm if misused or disclosed. This term is used in this Policy to describe information requiring extra care; it is not a defined term in the Privacy Act 2020.
3. Privacy breach: Unauthorised or accidental access to, disclosure, alteration, loss, or destruction of Personal Information, or an event that prevents RRT NZ from accessing Personal Information (temporarily or permanently).
4. Notifiable privacy breach: A privacy breach that has caused, or is likely to cause, serious harm to an affected individual (as assessed under the Privacy Act 2020).
5. Cookies: Small data files stored on a device that track user interactions with a website and support online functionality and analytics.

RRT NZ is committed to protecting the privacy of all individuals whose Personal Information we collect. We handle all information lawfully, fairly, and with respect for individual privacy, and in accordance with the information privacy principles in the Privacy Act 2020.

We may update this Policy from time to time. The most current version is available at https://rrtglobal.org/nz  and is effective from the date of posting. Unless otherwise required by law, it is the user’s responsibility to review our website periodically to check for updates to this policy.

By using our Website you consent to our collection and use of the Information as described in this Privacy Policy and our Cookie Policy. If we change our privacy policies and procedures, we will post those changes on our Website or otherwise notify you to keep you aware of what information we collect, how we use it and under what circumstances we may disclose it.

1. Rapid Relief Team (RRT) NZ Limited has appointed a Privacy Officer in accordance with section 201 of the Privacy Act 2020. The Privacy Officer is responsible for:
   1. Promoting compliance with the Privacy Act 2020 and this Privacy Policy across RRT NZ.
   2. Providing advice to directors, staff and volunteers on privacy obligations and good information handling practices.
   3. Responding to requests for access to, or correction of, Personal Information in accordance with the Privacy Act 2020.
   4. Managing privacy complaints and coordinating RRT NZ’s response to actual or suspected privacy breaches.
   5. Acting as the primary contact with the Office of the Privacy Commissioner on privacy-related matters.
   6. Supporting ongoing privacy awareness, training and continuous improvement within RRT NZ.
2. Privacy enquiries, requests or complaints should be directed to the Privacy Officer using the contact details provided in Section 16 of this Policy.

1. RRT NZ collects Personal Information directly from individuals and, where appropriate, from third parties such as partner charities or service providers. Information is collected when individuals engage with RRT NZ, such as through volunteering, donating, attending events, or visiting our websites.
2. Where RRT NZ collects Personal Information about an individual from a third party (rather than directly from the individual), we will take reasonable steps, as soon as reasonably practicable, to notify the individual, unless an exception under the Privacy Act 2020 applies. Where notification is required, we will, where reasonable in the circumstances, inform the individual:
   1. that we have collected Personal Information about them;
   2. the purpose for which the information has been collected;
   3. the identity and contact details of Rapid Relief Team (RRT) NZ Limited as the collecting agency;
   4. the intended recipients, or classes of recipients, of the Personal Information (where applicable);
   5. whether the collection is authorised or required by law and, if so, the relevant legislative authority;
   6. the individual’s right to request access to, and correction of, their Personal Information under the Privacy Act 2020.

RRT NZ will not provide notification where an exception under Information Privacy Principle 3A applies, including where the individual has already been made aware of the collection, notification would prejudice the purpose of the collection, notification would not be reasonably practicable, or another exception permitted by the Privacy Act 2020 applies.

1. RRT NZ may collect:
   1. Contact details (name, address, email, phone number);
   2. Demographic or logistical data (dietary needs, special requirements, travel details);
   3. Financial information (bank account or card details for donations);
   4. Employment or volunteer information (including application forms, CVs, referee information, police vetting or other background checks where authorised, training records, health information necessary for volunteer safety, and emergency contact details);
   5. Technical data (IP addresses, browser type, cookies, device identifiers, location); and
   6. Beneficiary or client details (delivery addresses, registration numbers such as NAIT).
2. Data minimisation: RRT NZ aims to collect only the Personal Information we reasonably need to carry out our charitable activities, manage volunteers and events, meet legal obligations, and maintain operational safety and integrity.

1. Personal Information may be used for a variety of business purposes, such as:
   1. Deliver RRT NZ’s community, emergency, and charitable services;
   2. Manage volunteers, donors, clients, and supplier relationships;
   3. Process donations and provide receipts;
   4. Administer websites and improve user experience;
   5. Conduct accounting, financial, audits, research, and operational analysis;
   6. Comply with legal and regulatory obligations.
2. Direct communications: Where we send updates or fundraising communications, individuals can opt out at any time using the unsubscribe mechanism provided (where available) or by contacting us.

1. Personal Information may be disclosed to other entities, as permitted by privacy laws, including:
   1. Service providers (IT, logistics, financial, and communications);
   2. Related bodies corporate;
   3. Professional advisers, auditors, and insurers;
   4. Government or law-enforcement agencies, where required by law.
2. All recipients are required to handle the information securely and in accordance with privacy obligations. We will only disclose Personal Information where we have a lawful basis to do so under the Privacy Act 2020 (for example, where disclosure is necessary for the purpose it was collected, authorised by the individual, or otherwise permitted by the Act).

1. RRT NZ stores information in both electronic and physical form, with safeguards to prevent loss, misuse, unauthorised access, or disclosure.
2. Where appropriate, encrypted transmission (SSL) and access-controlled systems are used.
   Information no longer required will be securely destroyed or de-identified in accordance with the RRT NZ Data Retention Policy.
3. RRT NZ also takes reasonable steps to ensure service providers who process Personal Information on our behalf have appropriate security protections in place.

1. If RRT NZ experiences a privacy breach, we will take steps to contain and assess it promptly.
2. Where it is reasonable to believe the breach has caused, or is likely to cause, serious harm to an individual, it may be a notifiable privacy breach and RRT NZ must notify the Office of the Privacy Commissioner and affected individuals as soon as practicable (unless an exception applies).
3. RRT NZ will keep internal records of privacy breaches and near misses, including remedial actions taken.

Individuals may request access to or correction of their Personal Information by contacting RRT NZ in writing using the contact details at the end of this Privacy Policy. Requests will be processed within a timeframe required by the Privacy Act 2020 (generally no later than 20 working days, unless a lawful extension applies).

RRT NZ takes reasonable steps to ensure Personal Information is accurate and current. Individuals should promptly notify RRT NZ of any changes.

External websites linked from RRT NZ platforms are not covered by this Policy. Users should review the privacy policies of those third parties.

Personal Information may be transferred overseas where necessary for RRT NZ’s operations (for example, cloud hosting, information technology services, or other service providers). Before disclosing Personal Information to an overseas recipient, RRT NZ will take reasonable steps to ensure the disclosure complies with Information Privacy Principle 12 of the Privacy Act 2020, including ensuring the recipient is subject to comparable privacy safeguards or another permitted exception applies.

If you have any questions about this Privacy Policy, wish to request access to or correction of your Personal Information, make a privacy complaint, or report a privacy concern, please contact RRT NZ’s Privacy Officer.

Privacy Officer
Rapid Relief Team (RRT) NZ Limited
Email:  [email protected]
Postal Address:  Rapid Relief Team NZ, PO Box 5206, Terrace End, Palmerston North 4441

To submit a formal complaint, please visit: https://rrtglobal.org/nz/contact/complaints/
Complaints will be acknowledged and addressed within 30 days. If unresolved, concerns may be referred to the Office of the Privacy Commissioner.