Privacy at Massey University

Why we collect your information

Collection of your personal information is necessary to carry out our operations, functions and activities as a University and as an employer. These are our “purposes” or “legitimate interests” and include:

• our learning, teaching, research, and other educational activities
• our administrative, employment, and management activities
• the services and benefits that we provide (including through third parties)
• communicating with you or with your emergency/alternate contacts
• our legal, regulatory, and contractual obligations
• monitoring, evaluating and improving our performance and effectiveness
• the recruitment, marketing, and fundraising activities that we undertake
• providing a safe, secure, and healthy environment
• providing an appropriate level of student support and pastoral care
• ensuring we can comply with government requirements and expectations (including in relation to emergency and public health measures)
• promoting equity and diversity, and
• maintaining an engaged community of students, staff, alumni, donors, and other persons with a connection to us.

How we collect your information

We collect information about you in three ways:

Information that you or your authorised agents provide to us

This includes information provided:

• as part of our marketing, recruitment, enrolment, conferment and employment processes and operations
• when you register for, enrol at, or use our services and facilities (including our Alumni Shop) or update your details
• when you register or attend events, functions, and conferences
• when you participate in surveys and competitions
• when you participate in contact tracing initiatives for public health purposes
• through your discussions and interactions with us
• when you apply to go on an exchange programme, field trip, or work placement
• when you apply for a scholarship or award, and
• if you complete a donation form and/or make a donation or gift to us.

Information we automatically collect

This includes information collected:

• through your use of websites (including via first party and third party cookies), emails, and other services and systems that we provide to you (including Wi-Fi, access swipe cards and our learning management systems), and
• through CCTV footage and recordings of lectures, tutorials and seminars.

For more information about the cookies we use on our website to understand our visitors and how they use the site, and to provide our users with a better experience, read our specific Website Privacy Statement.

For information about the purposes and processes of our CCTV operations, read our specific CCTV Privacy Statement.

Information we collect from third parties

This includes information collected or provided:

• from publicly available sources (including media articles, social media, company and charity filings, and the internet)
• by relevant government or education agencies and providers such as the New Zealand National Student Index and others with whom we also share information (see below)
• by our recruitment agents
• by service providers contracted by the University to provide services to us or you for purposes related to normal university functions and activities
• through reference or pre-employment checking prior to employment, entry into certain restricted qualifications or programmes or provision of a benefit
• by our photographers and videographers, and
• by other third parties with whom we also share information (see below).

The information we collect

Student | Staff member or Contractor | Alumni | Donor | Other Associations with Us

Student

If you are a student (or prospective student), the information we collect (including verified documentary proof as where applicable) includes your:

• biographical details (including name, former name/s, preferred name, gender, and date of birth)
• contact details (including address (historic, current and future), telephone, email, and emergency and alternative New Zealand contact details)
• main activity or occupation for the 12 months prior to your enrolment, whether you were resident in NZ or overseas and if the former, your post code at the time
• education record and academic/research history
• citizenship or residency information
• ethnicity*
• iwi affiliation (if you are a Māori student)
• National Student Number (or if applicable your International Baccalaureate or Cambridge International Examination Number)
• English language proficiency
• movement through any CCTV monitored areas of campus, or building access details collected from any swipe card issued to you
• interactions and communications with us and our systems, including voice and/or image where a lecture, workshop, tutorial or other presentation is recorded
• location (including whether you are accessing our systems from on or off-campus and your location on-campus)
• device ID and username (when you use a device to connect to our systems)
• whether you have been suspended from another New Zealand tertiary education institute
• photograph (for student ID cards and for accessing relevant catering, and accommodation services)
• programme and course details, and
• other information that you decide to share with us.

In addition, depending on your programme of study or involvement with specific services that we offer, we could also collect:

• information about your areas of study interest (if you are a prospective student)
• information about your passport and visa details
• your National Health Number
• information about any significant injury, long term illness, or disability (if any) at the point of enrolment
• your health and disability information (if necessary for certain programmes or work placements), where you have enrolled with our Student Health and Counselling Centre, Disability Services, or signed up to our accommodation, catering, or recreation services, applied for a field trip, student exchange or study abroad programme, or have otherwise consented to us collecting this information*
• your career information (including aspirations and relevant work history/experiences)
• your financial information (including how you will pay for your studies (including whether by scholarship, government funding agencies or other funding arrangements), bank account details, where you have provided these to us)
• information about your criminal convictions, or outcomes of a Children's Act safety check*
• information about you provided through reference checking processes e.g. for accommodation, entry into certain restricted qualifications or programmes or for provision of other benefits
• information about your health and travel insurance arrangements (if, for example, you are an international student or going on a field trip or student exchange), and
• information about your vehicle usage including your registration number if you pay for car parking while staying within the halls of residence and/or incur any parking infringements issued by us.

Staff member or Contractor

If you are a staff member, the information we collect includes your:

• biographical details (including name, former name, preferred name, gender, and date of birth)
• contact details (including address, telephone, email, and emergency contact details)
• education record and academic/research history
• professional affiliations
• previous employment history (e.g. your CV)
• bank account and tax information
• citizenship and passport details, and (where relevant) information on your entitlement to work for us in New Zealand
• criminal convictions, credit history and other pre-employment vetting and verification information*
• country of origin and ethnicity*
• iwi affiliation (if you are a Māori staff member)
• health and disability information*
• contract type i.e. are you full time, fixed term, contractor, part-time with flexible work arrangements etc.
• interactions and communications with us and our systems, including personal development and disciplinary records (if applicable)
• your location (including whether you are accessing our systems from on or off-campus and your location on-campus)
• device ID and username (when you use a device to connect to our systems)
• your voice and/or image where a lecture, workshop, tutorial, or other presentation is recorded
• credit card details (where you have provided these to us)
• photograph (for staff ID cards and the staff directory)
• information provided through reference checking processes
• trade union membership*
• movement through any CCTV monitored areas of campus, or building access details collected from any swipe card issued to you
• vehicle usage including your registration number if you pay for car parking on-campus and/or incur any parking infringements issued by us, and
• other information that you have decided to share with us.

If you are a prospective staff member applying for a position with us, or a contractor engaged (or seeking to be engaged) to provide services to us, the information we collect about you will include the categories of information described above that are necessary for us to consider and decide upon your application for employment, or to decide and manage your terms of engagement with us.

Alumni

If you are an alumni the information we collect includes your:

• biographical details (including title, marital status, name, former name/s, preferred name, gender, date of birth, and where applicable your date of death)
• contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences)
• education record and academic history (including academic awards or scholarships received)
• other associations with us when you were a student – such as other awards received, your hall of residence, and club membership)
• country of origin and ethnicity (if we were required to collect this under New Zealand law from when you were a student*
• iwi affiliation (if you were a Māori student)
• interactions and communications with us and our systems (including your use of alumni benefits and services such as library or gym membership)
• device ID and user credentials (when you use a device to connect to our systems)
• responses to our electronic communications (including what you open, any comments you make, and your location), and
• events you have been invited to, whether or not you have responded or attended, and any dietary or mobility requirements you may have provided.

In addition, we could also collect:

• information about your family details, including spouse/partner and children
• information about your links with the University and with other organisations and individuals (including alumni, supporters and potential supporters)
• information about your business details including positions, organisation, professional memberships, and qualifications
• information about your career highlights and other lifetime achievements
• information about your outside interests and membership of groups
• information about your wealth and philanthropic interests
• media such as articles about or photos of you, and
• other information that you have decided to share with us.

Donor

If you are a donor, or a person we have identified as a potential donor, the information we collect includes your:

• biographical details (including title, marital status, name, former name/s, preferred name, gender, date of birth, and where applicable your date of death)
• contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences)
• credit card details (where you have provided these to us)
• interactions and communications with us and our systems, and
• device ID and user credentials (when you use a device to connect to our systems).

In addition, we could also collect information about

• your education record and academic history (including academic awards or scholarships received)
• your other associations with us if you were a student – such as other awards received, your hall of residence and club membership)
• your country of origin and ethnicity*
• your responses to our electronic communications (including what you open, any comments you make, and your location)
• events you have been invited to, whether or not you have responded or attended, and any dietary or mobility requirements you may have provided
• your family details, including spouse/partner and children
• your links with the University (if any) and other organisations and individuals (including alumni, supporters, and potential supporters)
• your business details including positions, organisation, professional memberships, and qualifications
• your career highlights and other lifetime achievements
• your outside interests and membership of groups
• your wealth and philanthropic interests
• media such as articles about or photos of you
• your donations of time, expertise, or money (including to organisations other than us), and
• other information that you have decided to share with us.

Other Associations with Us

If you have had an association with us (you may have studied here short term, taken part in an exchange, attended an event, or have some other association with us including with regard to other services we provide direct to the public), the information we collect could include your:

• biographical details (including name, former name/s, preferred name, gender, and date of birth)
• contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences)
• interactions and communications with us and our systems, including buildings entered while visiting the campus (where relevant for contact tracing purposes)
• device ID and user credentials (when you use a device to connect to our systems)
• links with other organisations and individuals (including alumni, supporters and potential supporters)
• business details including positions, organisation, professional memberships, and qualifications
• credit card details (where you have provided these to us)
• career highlights and other lifetime achievements
• outside interests and membership of groups
• media articles
• events you have been invited to and whether or not you have responded or attended
• donations of time, expertise, or money (including to organisations other than us), and
• other information that you have decided to share with us.

Collection of this information is necessary for our Purposes and Legitimate Interests (which we outlined for you above) and, in some instances, is required under New Zealand law (including the Education Act 1980). Without it, we may not be able to enrol you as a student, employ you as a staff member, process your donation or provide services or benefits to you.

Where our collection of personal information about you from a third party falls outside the scope of information we are entitled to collect without consent under the Privacy Act 1993, and other New Zealand laws and regulations, your consent will be obtained prior to the collection if this information.

* Please refer to 'Sensitive information' in the 'Additional information' section below.

Who has access to your information

Our staff will have access to your personal information only where they have a genuine need to do so for our purposes and legitimate interests (see “Why we collect your information?” above). Wherever possible, we anonymise information so that you are not identifiable.

There are circumstances where we share some specific categories of personal information with external people and organisations. However, we only do this where it is strictly necessary for our

Purposes and Legitimate Interests (see above) or it is permitted or required by law (including the Privacy Act 1993 and Education Act 1989). We do not pass on all information we collect – only the absolute minimum required in the particular context.

We also take all reasonable steps to ensure that any information we share is used by the external person or organisation only for the purpose for which we shared it and, if possible, we anonymise information so that you are not identifiable.

We will not sell your information to anyone.

Who we share information with

People and organisations we share specific categories of information with include:

• New Zealand Government departments and agencies – including the Ministry of Education, the Tertiary Education commission, the Ministry of Social Development (including Work and Income and StudyLink), Te Puni Kōkiri, the Inland Revenue Department, Audit New Zealand, the Ministry of Business, Innovation and Employment, the Ministry of Foreign Affairs and Trade, the Ministry of Health and Primary Health Organisations (PHOs), Statistics New Zealand, Immigration New Zealand, the Accident Compensation Corporation, the Education Review Office, New Zealand Vice-Chancellors Committee, Education New Zealand, the Privacy Commission, and the New Zealand Qualifications Authority
• Other education providers (including tertiary education institutions and exchange partners, schools and English language testing services)
• Service providers contracted to the University (such as third party accommodation providers, recruiters, banks or other financial institutions, mailing houses, research, media agencies, data service providers, fundraising service providers, logistics, and IT service providers)
• Nominated financial institutions for payment of salary; kiwisaver or other superannuation scheme providers
• Organisations that provide services related to your status as a student or a staff member (including public transport providers, academic dress hire providers, trade unions, and organisations that provide discounts or benefits)
• Law enforcement agencies and emergency services
• Professional registration agencies (e.g. the Education Council of Aotearoa New Zealand and New Zealand Law Society, Veterinary Council of NZ, Social Workers Registration Board, Civil Aviation Authority, Nursing Council of New Zealand, NZ Psychologists Board)
• Organisations and individuals responsible for course moderation, accreditation, or quality assurance
• Ranking and benchmarking agencies
• Employers and internship providers (only where you are undertaking a work placement as part of your programme of study)
• Massey University Alumni groups, societies, and organisations
• Scholarship or prize providers and sponsors (only if you have applied for, or been awarded a scholarship or prize)
• Social media – including Facebook (in order to provide targeted information on University programmes and events) - see Marketing and Communication section
• Our iwi partners (only where you have identified an affiliation with a particular iwi)
• Providers of StudentSafe insurance (only if you are an international student or are studying with us on an exchange)
• Vehicle owners or their authorised agents, to pursue compensation or damages claims related to incidents occurring on campus (including at halls of residence managed by the University located outside of the physical campus) that may have been captured by our CCTV system
• Student associations and clubs
• Organisations and individuals involved in hosting events that you attend
• Our subsidiaries, controlled, or related entities (including the Massey University Foundation)
• Where you are a donor, our Partner institutions or associated entities who may be the beneficiaries of your donation although if you wish your donation to be anonymous we will ensure your gift is not acknowledged publicly (see also Donor Activities section below)
• Our insurers, professional advisors, and auditors.

How long we keep personal information

We retain your personal information for as long as is necessary for our Purposes and Legitimate Interests (which we outlined for you above) and for us to comply with our contractual and legal obligations, which include the requirement to retain information in accordance with the Public Records Act 2005.

If you are in the European Union, please note that in some situations, this may conflict with your rights under the GDPR.

Additional information

Profiling and automated decision making | Communications and marketing | Graduation information | Career development advice | Research activities | Donor activities | Alumni activities | Talent pool | Expertise database | Sensitive information | ID numbers

Profiling and Automated Decision Making

We may carry out profiling, analytics, or tracking activities (including by automated means) to:

• improve the quality of our teaching and learning activities
• tailor support services and pastoral care for you
• support you in your learning and academic achievement
• evaluate network performance and usage data and to assist with contact tracing only where necessary for emergency and public health measures, and
• personalise our communications with you.

We do not engage in any form of profiling that would give rise to a claim of discrimination (including as defined in the Human Rights Act 1993).

We do not use solely automated processes to make any decisions that would affect you in any way.

Communications and Marketing

We will use your information to communicate with you and carry out our marketing activities. Generally, these communications would be by email, post, or telephone.

You can unsubscribe from an electronic mailing list by clicking on the “unsubscribe” link in an email itself or by emailing contact@massey.ac.nz or phoning 0800Massey. If you wish to be removed from any other (or all) email, post or telephone lists please contact us via 0800 MASSEY (+64 6 350 5701) or contact@massey.ac.nz.

We do not pass on your information to other organisations for their own communications and marketing purposes. We may however provide your name and email address to a social media agency to enable us to provide targeted information on University programmes and events (including for the creation of look-a-like-audiences), or to exclude you from marketing campaigns for programmes, courses or events for which you have already enrolled. If you would not like us to carry out the above activities in relation to you, please contact us via 0800 MASSEY (+64 6 350 5701) or contact@massey.ac.nz.

Graduation Information

We will publish your name, qualification, and year of graduation on our online roll of graduates, in our Council papers and in our graduation programme if you attend a ceremony.

You also have access to digital versions of academic documents ((graduation certificates (scrolls), academic records (transcripts) and completion letters)) which you can share with employers, universities or other parties evidencing your academic achievements. We enable this information to be accessed through a third party cloud-based service in which your personal information is protected through a contractual agreement we maintain. If you wish to have your personal academic achievements removed from this cloud-based service please email contact@massey.ac.nz or call 0800 MASSEY (+64 6 350 5701).

Career development advice

The Massey Career Centre offers optional services to students and alumni via our third-party platform provider Abintegro Ltd, located in the United Kingdom. If you wish access these services you will need to agree to a terms of service agreement directly with Abintegro, we will need to share certain personal registration details of yours with them, they will collect personal information directly from you as you use the services, and they will share a limited amount of data with us regarding your use of the system. Further details about this collection, use, sharing and other processing of your data can be found at myhub.massey.ac.nz

Research activities

We may use information collected in order to conduct approved research activities and publish the outcomes. Where this includes personal information, any collection and use of this information will be in accordance with our Human Ethics Policy and Guidelines.

If you are asked to participate in a research project involving personal information, we will obtain your consent to any collection and use of that information. The information you provide will be used by the University strictly in accordance with your consent and any ethics approval.

Donor Activities

We may carry out research to assess your likely ability and willingness to make donations or gifts to the University so that we can better tailor our fundraising approaches or requests. This research, which is sometimes known as prospect research may include collecting and storing information about you that is publicly available as well as information that you have provided to us. We may carry out this research ourselves or we may use a third party. If we use a third party, we will ensure that your information is held confidentially, with appropriate security safeguards and only used in accordance with our strict instructions.

If you are a staff member, the Massey University Foundation may also collect your staff ID from internal databases for contacting you regarding the Salary Giving Initiative.

If you would not like us to carry out the above activities in relation to you, please email massey.foundation@massey.ac.nz or call 0800Massey (+64 6 350 5701).

Alumni activities

We use your information to help us plan our alumni and donor activities and determine whether or not we should contact you in relation to particular communications or activities. This assists with ensuring that our communications and activities are relevant and of interest to you and ensuring our alumni are connected with the University.

If you would not like us to carry out the above activities in regards to you, please email alumni@massey.ac.nz or call +64 6 951 6361

Talent Pool

If you have joined our talent pool for casual or temporary work your uploaded documents including your personal contact information will be available to managers and our people and culture staff via talent pool searches.

If you would like to withdraw from our talent pool, please email Recruitment@massey.ac.nz or call +64 6 951 9000.

Expertise Database

If you are a staff member your name, contact details (telephone and email address), department and role will be displayed in in the Massey Expertise database on the Massey public website. In many instances your Academic, Research and/or Professional expertise profile may also be displayed.

If you have any concerns about these details being available on our website you can opt out of having your profile publicly available by selecting this option on the update your staff profile" page or if you need assistance you can call the ITS Service Desk on Ext. 82111 or log a request online with AskUs Self Service.

Sensitive Information

Under the GDPR, information relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, sex life, sexual orientation, and criminal convictions is considered sensitive information.

Health information held by our Student Health and Counselling Centre or Disability Services is managed in accordance with the Health Information Privacy Code and any specific Privacy Notice relating to that information. This Privacy Notice does not apply to that information.

We are required under New Zealand law to collect information relating to:

• your racial or ethnic origin, as part of our admission and enrolment processes
• your criminal convictions, if you are being employed in a role covered by the Children's Act 2014.

We also collect information relating to:

• your racial or ethnic origin, for statistical purposes and promotion of equity and diversity
• your criminal convictions, as part of our pre-employment vetting processes and where you have applied for certain programmes (e.g. social work, psychology, education and health)
• any behaviours of concern observed during your enrolment with us that could impact on your wellbeing or our ability to provide a safe and healthy environment, some of which may be considered sensitive information
• your trade union membership information, to ensure that you are employed on the correct employment agreement
• your disabilities (if any) at the point of enrolment if you are an International Student, and
• your health information, as part of our employment processes, where you enrolled with Student Health and Counselling Centre, Disability Services, signed up to our accommodation, catering, or recreation services, or applied for a field trip, student exchange or study abroad programme, or otherwise as required by the New Zealand Government (for example, for public health reasons). This helps us ensure we can provide a safe and healthy environment.

We do not collect any other form of sensitive information. However, if you or others have provided it to us, we may hold it in our systems.

If you are in the European Union, please note that some New Zealand law requirements regarding our collection of sensitive information may conflict with your rights under the GDPR and we are required to comply with New Zealand law. If you have any concerns about our collection of sensitive information, please email privacy.officer@massey.ac.nz or phoning 0800Massey (+64 6 350 5701).

ID Numbers

If you are a student, alumni, or a staff member, a unique identifier (in the form of a Student or Staff ID number) will be assigned so that we can carry out our purposes effectively and efficiently.

How we keep your information secure

We take all reasonable steps to ensure the personal information we collect is protected against loss, unauthorised access and disclosure or any misuse. In some instances, your personal information may be transferred, and held, by service providers in New Zealand and overseas (for example, where it is stored using a cloud-based service). Where this occurs, we take all reasonable steps to ensure our service providers have adequate security and privacy safeguards in place to protect the information they hold on our behalf.

Your rights in relation to your information

You have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong (and you are unable to update it yourself through a relevant online service). If you would like us to do this, please email privacy.officer@massey.ac.nz.

We’ll respond to your request as soon as is reasonably practicable and no later than 20 working days after we receive it.

You also have the right to make a complaint to the Office of the Privacy Commissioner if you think we have breached, or may have breached, your privacy. You can contact the Office of the Privacy Commissioner at www.privacy.org.nz.

In addition, the GDPR gives you the right, under certain circumstances, to:

• withdraw consent, where consent is the legal basis for our processing of your information
• request that your personal data be erased i.e. for your information to be removed from systems that we use to process your personal information. However, under New Zealand law, we are required to retain certain information under the Public Records Act 2005
• request copies of your personal information in a structured, commonly used and machine-readable format and/or request us to transmit this information to another person (where this is technically feasible)
• restrict our processing in certain ways
• object to certain processing activities by us, and
• make a complaint to a supervisory authority.

CCTV Privacy Statement

Massey University (the “University”) operates CCTV on its campuses (which for the purposes of this statement include any halls of residence managed by the University located outside of the physical campus). This means information about what individuals are doing on a University campus may be collected and held by the University.

Information will be stored on University files and database(s) or those of its service providers and all reasonable security measures will be maintained. Where a service provider is located outside of New Zealand, personal information held by the University may be transferred outside of New Zealand.

Purposes of CCTV Operation

The purpose of collecting information is to:

• Deter criminal activity;
• Increase personal safety of staff, students, and other members of the public;
• Protect University property and the property of staff, students and members of the public;
• Assist the University investigate student and/or staff incidents or those involving members of the public; and
• Assist the University manage the campuses and any halls of residence that may located outside of the physical campuses.

Disclosure of Information Held

Information collected may be disclosed to, and published by the NZ Police, if they decide that is desirable in the circumstances. The information collected may be accessed by University staff and used for the purposes specified in this statement. Limited information may also be provided to vehicle owners or their authorised agents, to pursue compensation or damages claims (where applicable).

Access to CCTV Information

Individuals identified on CCTV have the right to ask for access to footage about them. The University will make information held about an individual available to them upon request and in accordance with the Privacy Act 1993, which also describes the conditions under which information may be withheld. Individuals have the right to request correction of personal information held in accordance with the provisions of the Privacy Act 1993. If an individual wishes to seek access to their personal information, or inquire about the handling of their personal information, contact the Privacy Officer by email at privacy.officer@massey.ac.nz

Website Privacy Statement

Massey University (the “University”) uses a number of tools and mechanisms to record the following non-identifying information in relation to website users:

• The internet address of the browser being used;
• The user’s internet server address;
• The user’s domain name;
• The IP address of the user;
• The date, time and duration of the user’s visit to our web site;
• The pages accessed and the documents the user downloaded;
• The previous site the user visited; and
• The type of web browser software used.

The University uses this information to: aggregate website statistics and measure traffic patterns to, from, and within this site; help it better understand its website audience; improve services to students (including prospective students, graduates and alumni where the context applies), staff and members of the public and; for targeted marketing recruitment purposes.

A cookie is a small text file which has a limited lifetime. Information supplied by cookies helps the University to understand its visitors and how they use the site, and provides users with a better experience. The University website uses first-party and third-party cookies in the following ways:

• To personalise a user’s visit to the University website;
• To provide information about the University to a user throughout their browsing experience to obtain non-identifying information about a user’s demographic group and general interests;
• To serve ads based on a user’s past visits to a University site;
• For statistical purposes and system administration tasks;
• For purposes relevant to other normal University functions and activities and as otherwise permitted or required by the Privacy Act 1993.

Users’ can choose to opt out of Google Analytics for at any time by changing their ad settings. They can also use the Google Analytics opt-out browser add-on so their visits are not tracked into Google Analytics.