TŪMATAITI ME NGĀ RARAUNGA

Privacy and Data Policy

How New Zealand Film Collaborators collects, uses, stores, shares, and disposes of personal information, in line with the Privacy Act 2020.

Version v0.6
20 August 2026
Draft, for review

Kaupapa

1. Purpose

New Zealand Film Collaborators 2018 Incorporated (NZFC) protects the privacy of everyone who engages with the organisation. This policy sets out how NZFC collects, uses, stores, shares, and disposes of personal information, in line with the Privacy Act 2020 and its 13 Information Privacy Principles. NZFC collects only what it needs to support its members and its mahi, and stays transparent about what it holds and why.

Whānuitanga

2. Scope

The policy reaches every person NZFC holds information about and everyone who handles that information on NZFC's behalf.

It applies to all personal information NZFC holds about members, prospective members, volunteers, crew, operations team members, role applicants, contractors, and people at partner organisations. It also applies to every Officer, volunteer, and third party who handles personal information for NZFC. NZFC has no paid employees, so information collected from people applying for volunteer and lead roles is treated as personal information under this policy, not under a separate staff policy.

Ngā Whakamārama

3. Definitions

Several terms carry specific meanings throughout the policy, and they are set out below.

Personal information: Information about an identifiable individual, as defined in the Privacy Act 2020.
Sensitive information: A subset of personal information needing extra protection, including health information, criminal history, and identity documents.
Indirect collection: Personal information NZFC receives about a person from a source other than that person.
Unique identifier: A number or code NZFC assigns to a person, such as a member number.
Collection notice: The short notice given at the point information is collected, telling a person why NZFC is collecting it and what happens next.
Guardian: A parent or legal guardian giving consent on behalf of a child or young person.
Electronic message: An email, text, or similar message sent to promote NZFC or its activities.
Officer: A person in a governance or designated operational role at NZFC who is authorised to handle personal information on its behalf, including board members and appointed leads.
Privacy Officer: The NZFC Officer responsible for policy governance, breach management, and privacy queries and requests.
Data processor: A third party that processes personal information on NZFC's behalf under an agreement.
Privacy breach: Unauthorised or accidental access to, disclosure of, alteration of, or loss of personal information.
Notifiable privacy breach: A breach likely to cause serious harm, triggering notification under section 113 of the Privacy Act 2020.
RealMe verification: Government-backed digital identity verification through the New Zealand government's RealMe service.
Child or young person: A person under 18. NZFC applies additional protections to their personal information.
Vetting information: Police and criminal-record check results, and related records, held to assess a person's suitability for a role of trust.

Te Kohikohi Mōhiohio

4. Information collection and purpose

NZFC collects personal information at a number of points across its mahi. What it collects, why, and how the information reaches NZFC are covered below.

4.1 What we collect

NZFC collects only the personal information it needs for its functions. Depending on how someone engages with NZFC, this may include names and contact details, emergency contact details, parent or guardian details where a participant is under age, any access or safety needs a person asks NZFC to accommodate, information supplied when applying for a volunteer or lead role, background check and vetting results, identity verification records, images and footage taken at NZFC activities, information arising from a safety or conduct concern, and communications in the course of NZFC activities. NZFC tells a person which information is required and which is voluntary, and what happens if they choose not to provide it. NZFC collects only what it needs, and does not ask for or infer sensitive information simply because it might be useful. Where a practical need exists, NZFC records the requirement rather than the underlying detail, for example a note that someone needs a quiet space rather than a specific diagnosis.

NZFC does not collect or process financial or payment information at this stage. If that changes, the policy will be updated before any such information is collected.

4.2 Why we collect it

NZFC collects and uses personal information to run and grow the organisation and to support its members and the wider screen community. The purposes cover coordinating members, volunteers, and crew, running events and filming opportunities, managing role recruitment, keeping people safe through vetting where required, meeting legal and reporting obligations, applying for and managing funding, making better-informed decisions about NZFC's direction, and understanding and improving the services NZFC offers the community.

NZFC keeps its purposes clear and reasonably foreseeable, so information collected for one part of its mahi is not siloed from a directly related part, while only ever being used for the purpose it was collected for or a purpose directly related to it. Information collected to keep people safe or to handle a complaint is used only for that purpose. It is never used for promotion, fundraising, or public content.

4.3 How we collect it directly

NZFC collects personal information by lawful and fair means. Most of the time it comes directly from the person, when they fill in a form, apply for a role, sign up as a member, attend an event, or otherwise deal with NZFC.

4.4 How we collect it indirectly

Sometimes NZFC receives information about a person from someone other than that person. NZFC collects indirectly from referrals by existing members, from images and footage captured at events where others appear, from partner organisations and film schools, and from engagement data through its communications platform. When NZFC collects a person's information from another source, it takes reasonable steps, as soon as reasonably practicable, to make that person aware of the collection, its purpose, who the information may be shared with, and their right to access and correct it, unless an exception under the Privacy Act applies. This duty for indirectly collected information came into force on 1 May 2026.

4.5 Unique identifiers

NZFC assigns a member number or similar identifier only where it needs one to do its work, for example to run the member register. NZFC does not use another organisation's identifier, such as an IRD number, as its own.

4.6 Sensitive information

Some of the information NZFC collects is sensitive, most notably vetting and criminal-history results and identity documents. NZFC collects sensitive information only where a role or a legal duty requires it, limits who can see it to those who need it for that purpose, and holds it under the security and retention rules in sections 10 and 14.

Te Manatoko Tuakiri

5. Identity verification

NZFC keeps identity checks light and confirms identity only where a role or a legal duty genuinely requires it, such as vetting for roles working with tamariki and rangatahi. Where a check is needed, NZFC uses the least intrusive method available and prefers RealMe, which confirms identity without NZFC holding identity documents. If NZFC does need to sight a document, it records only the minimum detail required, keeps it only as long as the role requires, and does not retain copies longer than needed.

Te Whakamahi me te Whakaatu

6. Use and disclosure

NZFC uses personal information for the purposes it was collected for, and shares it only where sharing is needed. How it uses, shares, and sends information overseas, and how it handles aggregated information, is covered below.

6.1 How we use it

NZFC uses personal information for the purposes set out in section 4.

6.2 Who we share it with

NZFC may share personal information with data processors who help it operate, such as IT and communications providers, with professional advisers such as accountants or lawyers, with the Police Vetting Service where vetting is required, and with government agencies where the law requires or allows it. Processors may only use the information to do the work NZFC has asked of them. NZFC does not sell, trade, or rent personal information.

6.3 Disclosing information overseas

Some of NZFC's providers are based overseas or store information overseas, including in Australia and the United States. Before disclosing personal information overseas, NZFC takes reasonable steps to make sure it is protected by safeguards comparable to the Privacy Act. NZFC stays responsible for information a provider holds on its behalf.

6.4 Aggregated and de-identified information

NZFC may combine and de-identify information so that it no longer identifies anyone, and use that aggregated information for reporting, funding applications, research, and improving its services. Aggregated and de-identified information is not personal information and is not subject to the rules in this policy.

Whakaaetanga Whakaahua

7. Media and image consent

NZFC is a film and screen collective, so it photographs and films people at workshops, events, screenings, and productions. Images and footage of an identifiable person are personal information.

NZFC tells people when an activity will be photographed or filmed, and how the images may be used, and gives them a way to decline being photographed or to ask that an image not be used. For anyone under 18, NZFC obtains a guardian image release before using their image. Where someone withdraws consent, NZFC stops using the image going forward, though it may not be able to recall material already published or held in its archive.

Ngā Karere Hiko

8. Electronic communications

NZFC sends members and subscribers electronic messages about its activities, events, and opportunities where they have agreed to receive them, or where the law otherwise allows. This is consistent with the Unsolicited Electronic Messages Act 2007.

Every marketing message clearly identifies NZFC and includes a working way to unsubscribe on the same channel the message was sent on, so a text can be stopped by text and an email by an unsubscribe link. NZFC actions unsubscribe requests promptly, in line with the Unsolicited Electronic Messages Act 2007.

Ngā Pihikete me te Tātari Tukutuku

9. Cookies and website analytics

The NZFC website uses cookies and similar technologies to remember preferences and understand how people use the site.

NZFC uses website analytics tools, including Google Analytics, to help improve the site and understand how people use it. People can control or disable cookies through their browser settings, though some parts of the site may then not work as intended. Where an analytics tool sends data overseas, that is covered by the overseas disclosure section above.

Te Rokiroki me te Haumaru

10. Storage and security

NZFC takes reasonable steps to protect personal information from loss, misuse, and unauthorised access, using access controls, secure storage, and encryption where appropriate. No method of transmission or storage is completely secure, so while NZFC takes reasonable steps to protect information, it cannot promise absolute security.

Paper records, such as consent forms and any copies of identity documents, are held in locked storage on secure premises, with access limited to Officers who need it. Where a third party stores or processes personal information for NZFC, NZFC requires it, through its agreement, to keep security safeguards equivalent to those in this policy.

NZFC is standing up a dedicated, owned workspace through its digital and data work. Until that lands, some information is held across existing accounts, and NZFC is working to consolidate it. The detailed storage, access, and security controls that sit behind this policy firm up as that workspace is established.

Mana motuhake raraunga

11. Māori data sovereignty

NZFC recognises that data connected to Māori, as individuals and as collectives (whānau, hapū, iwi), is a taonga. NZFC handles this data in a way that respects mana motuhake, whakapapa, and the collective benefit of those the data relates to.

Some information may carry cultural significance beyond its value as personal information, including information relating to Māori individuals and collectives, mātauranga Māori, and other taonga. NZFC is committed to protecting this information and to considering Māori Data Sovereignty principles in its decisions. NZFC is honest that the governance and access mechanisms to fully deliver this commitment are still being built, and they firm up through the workspace work and NZFC's internal data handling. NZFC will not disclose culturally significant information to third parties unless authorised, required by law, or consistent with the purpose it was collected for.

Ngā Tamariki me ngā Rangatahi

12. Children and young people

NZFC takes extra care with the personal information of children and young people, and explains collection in a way that suits their age and understanding. New Zealand privacy law sets no fixed age of consent, so NZFC has set its own thresholds:

For general personal information, NZFC collects from a person under 16 only with the involvement and consent of a parent or guardian, and, where the young person is able to understand, seeks their agreement as well.
For images and footage, NZFC obtains a guardian image release for anyone under 18.

NZFC collects sensitive information about a young person, such as medical, accessibility, or cultural information, only where it is needed to keep them safe or to provide an agreed adjustment, and shares it only with those who need it for that purpose. Consent given by a guardian can be withdrawn at any time. The safety arrangements that protect children and young people on set and at NZFC activities, including supervision, reporting, and contact with authorities, are set out in the Member Safety and Safeguarding Policy and the Consent, Intimacy and Safeguarding Policy.

Ngā Tika Tangata

13. Individual rights

Everyone whose information NZFC holds has rights over that information under the Privacy Act 2020.

Before it uses or shares personal information, NZFC takes reasonable steps to make sure the information is accurate, up to date, and complete. Every person can ask for a copy of the information NZFC holds about them and can ask NZFC to correct it. NZFC responds as soon as it reasonably can, and no later than 20 working days after receiving the request, as required by the Privacy Act. Where the information requested also contains personal information about other people, NZFC may need to withhold or redact parts of it to protect their privacy, as the Privacy Act allows. Where NZFC does not agree to a correction, the person can ask for a statement of the requested correction to be attached to the record. A person can ask NZFC to delete non-essential information once their engagement ends, subject to the retention rules in section 14. Requests are made through the contact channel in section 18.

Te Pupuri me te Mukua

14. Retention and disposal

NZFC keeps personal information only for as long as it needs it for the purpose it was collected for, or for as long as the law requires, then securely disposes of it. NZFC sets retention by category:

Vetting records: kept only as long as needed for the purpose, or as long as the law or a safety requirement demands, then securely disposed of.
General membership and participation records: kept only as long as needed for the purpose, then securely destroyed or anonymised.
Role-applicant records for unsuccessful applicants: kept only as long as needed to run and conclude the recruitment round.
Images and footage: kept for as long as needed for the purpose consented to.
Safety, complaint, and conduct records: kept only as long as needed for the purpose, or as long as the law requires. Any specific schedule for serious child-protection records is set in the Member Safety and Safeguarding Policy.

Some footage from screenings and showcases is kept long term as part of NZFC's archive and history, and is retained on that basis. NZFC also keeps certain records for the minimum periods set by law. NZFC's financial and accounting records are kept for the current accounting period and the last seven completed periods, consistent with the Incorporated Societies Act 2022 and the seven-year record requirement that applies to registered charities under New Zealand tax law. NZFC maintains its register of members as required by the Incorporated Societies Act 2022, and keeps a former member's name and the date they ceased to be a member for seven years. Disposal is by secure deletion for electronic records and physical destruction for paper records, and is documented and reviewed periodically.

Te Ārai Takahi Tūmataiti

15. Data breach response

NZFC treats privacy breaches seriously. The process for any suspected or confirmed breach is set out below.

15.1 Identification and logging

Anyone who suspects a breach reports it to the Privacy Officer immediately. The Privacy Officer logs the incident, including when it was identified, the information involved, and the likely cause.

15.2 Containment and assessment

The Privacy Officer acts promptly to contain the breach, then assesses its severity, including the sensitivity of the information, the number of people affected, and the likelihood and nature of harm.

15.3 Notification

Where a breach is likely to cause serious harm, it is a notifiable breach under section 113 of the Privacy Act 2020. NZFC notifies the affected people and the Office of the Privacy Commissioner as soon as reasonably practicable, and aims to notify the Commissioner within 72 hours of becoming aware, through the NotifyUs tool at privacy.org.nz. A notification to affected people describes the breach, the information involved, the steps NZFC has taken in response, and how to contact the Privacy Officer. Where a breach is not notifiable, the Privacy Officer records the assessment and the reason.

15.4 Remediation and documentation

After any breach, the Privacy Officer documents the incident, the containment actions, the notification decisions, and any steps taken to reduce the chance of it happening again. A summary goes to the board at its next meeting.

Ētahi Atu Pae Tukutuku

16. Other websites we link to

The NZFC website and communications may link to other websites, including social channels and partner organisations. NZFC is not responsible for the privacy practices or content of those sites, and encourages people to read the privacy policy of any site they visit.

Ako me te Arotake

17. Training and review

Every Officer and anyone else who handles personal information for NZFC is briefed on this policy before taking on their role and agrees to keep information confidential as part of onboarding. The policy is reviewed every two years from adoption, or earlier where a legislative change, a breach, or a material change in NZFC's operations calls for it. The Privacy Officer initiates and coordinates each review, and the Chair approves the revised policy before it takes effect.

Te Kawenga me ngā Whakapā

18. Accountability and contact

The Privacy Officer is responsible for this policy, for breach management, and for handling privacy queries, access and correction requests, and complaints.

NZFC's Privacy Officer is Jonathon Davies. Questions, requests, and complaints are made through the contact form on the NZFC website, or by email to kiaora@nzfilmcollaborators.com. NZFC acknowledges complaints and aims to respond within 20 working days before any matter is escalated. If a complaint is not resolved to a person's satisfaction, they can raise it with the Office of the Privacy Commissioner: website privacy.org.nz, phone 0800 803 909, email enquiries@privacy.org.nz. The Commissioner will usually ask a person to raise the matter with NZFC first. An unresolved complaint can be taken to the Human Rights Review Tribunal.

Ngā Panonitanga

19. Changes to this policy

NZFC may update this policy from time to time. The current version is always available on the NZFC website, and the version and date at the top show when it last changed. The policy is reviewed on the cadence set out in section 17.