Purpose
We know that how we collect, use, disclose and protect your information is important to you, and
we value your trust. That’s why protecting your information and being clear
about what we do
with it is a vital part of our relationship with you.
The purpose of this Privacy Policy is to inform our
clients and any users of our digital platforms (i.e. our website,
Facebook) about how we comply with the requirements of the Privacy Act
2020 (“the Privacy Act”) in managing personal information.
Consent to Privacy Policy
Please note that when you contact us through our website and
Facebook page you are agreeing to this Privacy Policy. If you do not agree with
this Privacy Policy, please do not contact us through any of our digital
platforms, but call us at 06 344 8884.
Collection of personal
information
Personal Information is defined in the Privacy Act as
information about an identifiable individual (a natural person as opposed to a
company or other legal entity).
Types of personal information we collect
The types of personal information we collect will vary
depending on the nature of your dealings with us. We only collect personal
information that is necessary. Where reasonable and practicable, we will
collect your personal information directly from you and inform you that we are
collecting it.
We mainly collect personal information directly from you,
for example:
- Over
the telephone or a video call (such as over Microsoft Teams, Zoom or
Skype) e.g. when you contact our staff;
- Through
one of our digital platforms like our website, Facebook
- When
you email or write to us; or
- When
you participate in a marketing campaign, competition or promotion (or a
similar event) administered by us or our representatives.
If it is not obvious that we are collecting personal
information from you, we will do our best to make it clear to you so that you
are always aware when information is being collected.
Generally, the types of personal information we collect and
hold include your:
- Name
- Date
of birth
- Contact
details (such as your email address, postal address, phone number)
- Details
relating to your use of any product and/or service offered by us
- Details
of your enquiry
- Details
of any preferences you tell us about (such as subscription preferences).
When we collect information about you from other sources
We may collect personal information about you from someone
else, rather than directly from you.
This may include information received from:
- Publicly
available sources e.g. via the internet;
- Equifax
credit reporting agency
Our Indirect Collection Source Schedule sets out the common
third parties we collect from, the information involved, the purpose of
collection, and who the information may be shared with.
You can access the current schedule at Indirect Collective Agreement or request a copy from admin@wanganuifinance.co.nz
We also use service providers to store or process personal
information on our behalf. Those provider arrangements are managed separately
from our indirect collection practices.
What we will tell you if we collect your information from
someone else
If we
collect personal information about you from another person or organisation, we
will take reasonable steps to let you know, unless an exception applies.
When we do
this, we will tell you, in a clear and reasonable way:
- The
fact of collection — that we have collected, or will collect,
personal information about you from someone else.
- Purpose —
why we collected your information and how we plan to use it. The purpose
will be specific enough to be meaningful.
- Intended
recipients — who your information may be shared with. We will name
specific organisations where practicable. Our Indirect Collection Source
Schedule lists those organisations.
- Who
we are — the identity of the organisation collecting and holding your
information, and our contact details.
- Legal basis — where collection of
your information is authorised or required by a particular law, we will
name that law.
- Your access and correction rights —
that you can request access to your information and ask for it to be
corrected.
Where
possible, we will provide this notice before or at the time we collect your
information. Where that is not practicable, we will let you know as soon as
reasonably possible afterwards.
When we may not notify you
In some limited situations, we may not be able to tell you
that we have collected your information from another source.
This may happen if:
- Letting you
know would be impossible or not reasonably practicable.
- We are
legally required, or permitted by law, to collect the information without
notifying you.
- Telling you
would create a serious risk to someone’s safety or national security.
- The
information is publicly available.
These exceptions are narrow and we will always notify you
wherever it is reasonably possible to do so. In all cases, we will continue to
handle your personal information in line with this Privacy Policy. In
situations involving anti-money laundering reporting obligations, we may be
legally prevented from notifying you; we will handle those situations in
accordance with our legal obligations.
Consent when information is collected from others
Where required, we will only collect personal information
from other people or organisations with your consent.
We are not responsible for the privacy and security
practices of third parties who provide information to us. Their handling of
your information is not covered by this Privacy Policy.
Online device information and cookies
If you are visiting us through our website or Facebook, then
we collect information about your use and experience on these by using
cookies. Cookies are small pieces of information stored on your hard drive
or on your mobile browser. They can record information about your visit to the
site, allowing it to remember you the next time you visit and provide a more
meaningful experience.
The cookies we send to your computer, mobile phone or other
device cannot read your hard drive, obtain any information from your browser or
command your device to perform any action. They are designed so that they
cannot be sent to another site or be retrieved by any non-Wanganui Finance
Limited website.
When you interact with us through our website or Facebook
the information collected through the cookies may include:
- The
date and time of visits;
- Website
page (or pages) viewed;
- The
website or Facebook from which you accessed the internet and our website
or other digital platform;
- How
you navigate through the website and interact with pages (including any
fields completed in forms and applications completed (where applicable));
- Information
about your location;
- Information
about the device used to visit our digital platform; and
- IP
address (or addresses), and the type of web browser used.
We will not ask you to supply personal information publicly
over Facebook. Sometimes we may invite you to send your details to us through a
private message, for example, to answer a question. You may also be invited to
share your personal information through secure channels to participate in other
activities, such as competitions, but we would require your express consent
prior to us including you in such activities.
Purpose of collection and use of personal information
Any personal information you provide to us may be used to:
- Check
whether you are eligible for the product or services offered by us;
- Facilitate
those services;
- Provide
information that you request; and/or
- Provide
you with further information about our other products and services.
We also have an obligation to maintain personal information
to disclose to regulatory and similar bodies - see “Disclosure
of your personal information” below. These bodies have a legal
right to such information.
Storage and protection of your
personal information
We may electronically record and store personal information
which we collect from you. When we do so, we will take all reasonable steps to
keep it secure and prevent unauthorised disclosure.
However, we cannot promise that your personal information
will not be accessed by an unauthorised person (e.g. a hacker) or that
unauthorised disclosures will not occur. If we provide you with any passwords
or other security devices, it is important that you keep these confidential and
do not allow them to be used by any other person. You should notify us
immediately if the security of your password or security device is
breached, this will help prevent the unauthorised disclosure of your personal information.
Some information we hold about you will be stored in paper
files, but most of your information will be stored electronically on physical
hard drives.
We use a range of physical and electronic security measures
to protect the security of the personal information we hold, including:
- Access to
information systems is controlled through identity and access management;
- Our
buildings are secured with a combination of locks, monitored alarms and cameras
to prevent unauthorised access;
- Employees
are bound by internal information security policies and are required to keep
information secure;
- Employees
are required to complete training about information security and privacy;
- When we
send information overseas or use service providers to process or store
information, we put arrangements in place to protect your information;
- We
regularly monitor and review our compliance (and our service providers’
compliance) with internal policies and industry best practice.
- We only
keep information for as long as we need it, or as long as the law requires us
to. We have a records management policy that governs how we manage our
information and records to make sure we destroy any information that is
outdated, irrelevant or unnecessary.
Timeframes for keeping personal information
We take reasonable steps to destroy or permanently
de-identify any personal information as soon as practicable after the date of
which it has no legal or regulatory purpose, or we have no legitimate business
purpose with it.
In the case of information that relates to our advice
services or products or services we have provided, we are required by law to
hold this information for seven years. After this time, provided that the
personal information is no longer relevant to any service we are providing you,
we will take reasonable steps to safely destroy or de-identify any personal
information.
We have a records management policy that governs how we
manage our information and records to enable us to destroy any information that
is outdated, irrelevant or no longer necessary.
If there is a privacy breach
We work hard to keep your personal information safe.
However, despite applying strict security measures and following industry
standards to protect your personal information, there is still a possibility
that our security could be breached. If we experience a privacy breach, where
there is a loss or unauthorised access or disclosure of your personal
information that is likely to cause you serious harm, we will, as soon as we
become aware of the breach:
- Seek
to quickly identify and secure the breach to prevent any further breaches
and reduce the harm caused;
- Assess
the nature and severity of the breach, including the type of personal
information involved and the risk of harm to affected individuals;
- Advise
and involve the appropriate authorities where criminal activity is
suspected;
- Where
appropriate, notify any individuals who are affected by the breach (where
possible, directly);
- Where
appropriate, put a notice on our website advising our clients of the
breach; and
- Notify the
Privacy Commissioner.
Disclosure
of your personal information
We may disclose your personal information to others outside
Wanganui Finance Limited where:
- It
is necessary to enable us to achieve the purpose that we collected the
information for;
- We
are required or authorised by law or where we have a public duty to do so;
- You
have expressly consented to the disclosure or your consent can be
reasonably inferred from the circumstances; or
- We
are permitted to disclose the information under the Privacy Act 2020.
Parties we may disclose your information to
Your personal information may be used by us for the purpose
of providing advice and services to you and may also be used by agencies such
as, but not limited to:
- Any
out-sourced service provider who assists in the services we are required
to carry out such as auditors and external compliance reviewers;
- Our
external dispute resolution service;
- The
Regulator;
- Credit
reporting and debt collecting organisations;
- Wanganui
Finance Limited’s related companies, such as Bartley Group Holdings.
Our Indirect Collection Source Schedule sets out the
specific information about common third parties to whom we may disclose your
information.
If we don’t need to share your information with a third
party in order to provide advice and services to you, we will not pass on your
information to them without your consent. Under no circumstances will we sell
or receive payment for disclosing your personal information.
Sending your information overseas
We may send your personal information outside New Zealand,
including to overseas members of Wanganui Finance Limited’s related companies
and overseas service providers or other third parties who process or store our
information, or provide certain services to us.
Where we do this, it does not change any of our commitments
to you to safeguard your privacy. We make sure that appropriate security and
information handling arrangements are in place and the information remains
subject to confidentiality obligations.
All countries have different privacy laws and information
protection standards. If we need to send your personal information to a country
that has lower standards of information protection than in New Zealand, we will
take appropriate measures to protect your personal information. Where it is not
possible to ensure that appropriate security and information handling
arrangements are in place, we will let you know and gain your consent prior to
sending your personal information overseas.
Third party websites
Through our website or our other social media pages, you may
be able to link to other websites which are not under our
control. We are not responsible for the privacy or security
practices of those third-party websites and the sites are not covered by this
Privacy Policy. Third party websites should have their own privacy and security
policies and we encourage you to read them.
In addition, we have no knowledge of (or control over) the
nature, content, and availability of those websites. We do not sponsor,
recommend, or endorse anything contained on these linked websites. We do not
accept any liability of any description for any loss suffered by you by relying
on anything contained or not contained on these linked websites.
Right to access, correct and
delete personal information
You have the right to request access to, correct and, in
some circumstances, delete your personal information. You can do so by
contacting us at:
21 Gilberd Street, Castlecliff, Whanganui
Or via email at admin@wanganuifinance.co.nz
When you contact us with such a request, we will take steps
to update or delete your personal information, provide you with access to your
personal information and/or otherwise address your query within a reasonable
period after we receive your request. To protect the security of your personal
information, you may be required to provide identification before we update or
provide you with access to your personal information.
We are only able to delete your personal information to the
extent that it is not required to be held by us to satisfy any legal,
regulatory, or similar requirements.
There is no fee for requesting that your personal
information is corrected or deleted or for us to make corrections or deletions.
In processing your request for access to your personal information, a
reasonable cost may be charged. This charge covers such things as locating the
information and supplying it to you.
There are some circumstances in which we are not required to
give you access to your personal information. If we refuse to give you access
or to correct or delete your personal information, we will let you know our
reasons, except if the law prevents us from doing so.
If we refuse your request to correct or delete your personal
information, you also have the right to request that a statement be associated
with your personal information noting that you disagree with its accuracy.
If we refuse your request to access, correct or delete your
personal information, we will also provide you with information on how you can
complain about the refusal.
What happens if you do not
provide us your information?
If you do not provide information we have requested, you may
be unable to obtain or access our services for which the information is
required. Please ask us if you are unsure what information is important and how
this might affect you.
Changes to this Privacy Policy
We review this Privacy Policy periodically to keep it
current and available on our website. If the changes are significant, we
may advise you directly. You may also obtain a copy of the latest version
by calling us at 06 344 8884.
Privacy Policy queries and
concerns
If you are concerned about how your personal information is
being handled or if you feel that we have compromised your privacy in some way,
please contact us at:
21 Gilberd Street, Castlecliff, Wanganui
Email: admin@wanganuifinance.co.nz
Phone: 06 344 8884
We will acknowledge your complaint within three working days
of its receipt. We will let you know if we need any further information from
you to investigate your complaint.
We aim to resolve complaints as quickly as possible. We
strive to resolve complaints within five working days, but some complaints take
longer to resolve. If your complaint is taking longer, we will let you know
what is happening and a date by which you can reasonably expect a
response.
If you are not satisfied with our response to any privacy
related concern you may lodge a complaint on the Privacy Office website (www.privacy.org.nz) or send a complaint
form to the Privacy Commissioner at:
Office of the Privacy Commissioner
P O Box 10-094
Wellington 6140, New Zealand
Fax: 04- 474 7595
Email: enquiries@privacy.org.nz
Telephone: 0800 803 909
Website: www.privacy.org.nz