Privacy Policy | D7 PEOPLE

1. Purpose of this Policy

This Privacy Policy outlines how Design Seven Ltd t/a D7 People collects, stores, uses and protects personal information in accordance with the Privacy Act 2020 (NZ). We are committed to respecting the privacy of individuals and ensuring personal information is managed responsibly and transparently.

2. What Information We Collect

We may collect personal information about:

Programme participants (including names, contact details, demographics, goals and progress)
Employees, contractors and facilitators
Clients and partners
Website users and mailing list subscribers

This information may include:

Full name, date of birth and contact details
Demographic data
Employment, education or referral background
Programme-related responses, feedback and attendance records
Audio, visual, or written content from training sessions (with consent)
Health or wellbeing disclosures, if relevant to programme support
Criminal history information voluntarily provided by the participant (e.g. conviction history, pending charges)
Drug and alcohol history, including rehabilitation or treatment records voluntarily provided by the participant
Any other data required for contractual or safety purposes

3. How We Collect Information

Information is collected through:

Online and paper registration forms and onboarding
Referrals from MSD or other partners (with consent)
Programme participation and assessments
Surveys, feedback and evaluation tools
Emails, phone calls, online meetings and in-person conversations
Our digital platforms - website, mailing lists. CRM or social media (where applicable)

Where possible, we collect information directly from the individual. We may also receive information from third parties (e.g. MSD or referring agencies) with your consent.

4. Why We Collect Personal Information

We collect this information to:

Deliver programmes and support services effectively
Report anonymised data to funding partners (e.g. MSD)
Measure, track and report outcomes and continuously improve
Meet contractual, legal or safeguarding obligations
Communicate relevant updates or offers (opt-in only)
Support safe, trauma-informed and appropriate programme delivery
Identify individual support needs and tailor pathways into employment or training
Refer or connect participants to specialist support services (with consent)
Support employment outcomes by connecting participants with suitable job opportunities through our trusted employer network
Share relevant information (such as CVs, employment preferences or work-readiness indicators) with the participant’s full consent only

5. Disposal of Information and E-Waste

Physical documents are destroyed by shredding. Digital records are permanently deleted using secure data destruction protocols. Old devices are wiped and disposed of using certified e-waste services in line with privacy and sustainability standards.

6. Staff Awareness and Training

All staff and contractors receive training during onboarding to understand privacy expectations, data handling, and security practices. The Privacy Policy is reviewed annually and all updates are communicated clearly to the team.

7. Privacy Officer

D7 People has appointed a Privacy Officer to oversee data protection compliance. This person handles internal training, data access requests, and ensures our processes align with the Privacy Act 2020.

8. Storage and Security

We store information securely in password-protected systems (e.g. secure CRM, cloud storage) and limit access to authorised team members only. Physical files are locked in our secure records room accessible only to authorised staff, as requires pinpad entry.

We take reasonable steps to protect personal information from loss, misuse or unauthorised access and review our data protection practices regularly.

Sensitive information (such as criminal or drug history) is stored with additional security safeguards, accessible only to authorised personnel directly involved in programme delivery. It is never shared beyond the programme unless required by law or with the participant’s written consent.

9. Use and Disclosure of Information

We only use personal information for the purpose it was collected, unless:

You have given consent for another use
It is required or authorised by law (e.g. risk of harm, safeguarding concern)
It is part of anonymised and aggregated reporting

We will never sell or share personal information with third parties for marketing purposes.

In some cases, and only with the participant’s consent, we may share personal information (such as work history, CVs or job suitability details) with trusted employers or partners as part of their employment journey.

Consent will be clearly obtained before any information is shared and participants can choose what is disclosed and to whom. No personal data will be shared with any third party without informed and voluntary consent.

10. Your Rights

Under the NZ Privacy Act, you have the right to:

Access the personal information we hold about you
Request corrections to that information
Withdraw consent for any optional data use
Lodge a complaint with the Privacy Commissioner if you believe your data has been mishandled

To request access or correction, email: kiaora@d7people.co.nz

11. Data Retention

We retain personal information only as long as necessary to fulfil the purpose it was collected for, or to meet legal and contractual obligations. After that time, data will be securely deleted or anonymised.

12. Website & Digital Privacy

If you interact with our website or digital tools:

We may collect standard usage data (e.g. cookies, IP address, page views)
This is used for website performance, not personal profiling
You can opt out of cookies via your browser settings

13. Policy Updates

This policy may be updated from time to time to reflect legal or operational changes.

If you have any questions, concerns, or requests related to this policy or your personal information, please contact us.