Your information

D7 People Privacy Policy

Last updated: 29 October 2026

1. Purpose of this policy

This policy explains how Design Seven Ltd trading as D7 People collects, holds, uses, shares and protects personal information under the Privacy Act 2020 (New Zealand). It applies to our programmes, coaching, advisory and other services, employment relationships, website and digital tools. We respect individual privacy and aim to manage personal information responsibly and transparently.

2. What information we collect

We may collect information about programme participants, clients, partners, employees, contractors, facilitators, website users and mailing list subscribers. We collect only information necessary for a lawful purpose connected with our work. Depending on the service or relationship, this may include:

• Names, contact details, date of birth and relevant demographic information.
• Organisation, position, employment, education and referral background.
• Goals, personal development roadmaps, programme responses, attendance, feedback, progress and outcomes.
• Audio, visual or written material from training or coaching, where recording or use has been agreed.
• Health or wellbeing information relevant to support or safe participation.
• Criminal history, pending charges, or drug and alcohol history, including treatment information, where relevant and voluntarily provided or otherwise lawfully obtained.
• Information necessary for employment, contracting, safety, funding or other lawful contractual requirements.
• Website enquiries, subscription preferences and technical information needed to operate and secure our digital services.

We do not routinely require sensitive histories or treatment records from everyone. We explain why any sensitive information is needed and how it will be handled. Please avoid including sensitive personal information in a general website enquiry.

3. How we collect information

We collect information through registration and onboarding forms, referrals, programme participation and assessments, surveys and evaluation tools, emails, calls, online meetings, in-person conversations, and our website, CRM and other digital platforms.

Where practicable, we collect information directly from you. We may receive relevant information from MSD, employers or other referring or delivery partners with your authorisation or where the law otherwise permits. Where we collect personal information indirectly, we take reasonable steps to tell you about the collection, its purpose, intended recipients, who holds the information, and your access and correction rights, as required by the Privacy Act, unless an exception applies.

At collection, we explain what is required, what is optional and the consequences of not supplying information. You can choose not to provide information, although this may limit the services or support we can offer.

4. Why we collect personal information

We use personal information to:

• Deliver programmes, coaching, advisory and support services and respond to enquiries.
• Understand individual needs, tailor support and support safe, appropriate, trauma-informed delivery.
• Develop employment or training pathways and, with your authorisation, connect you with suitable employers or specialist support.
• Measure progress and outcomes, improve our services, and meet lawful reporting requirements.
• Manage employment, contractor and partner relationships and meet legal, contractual and safeguarding obligations.
• Send relevant insights, programme news and offers when you choose to subscribe.

We use anonymised or aggregated reporting where appropriate. If identifiable reporting is needed for a funded programme, we explain what information is shared, with whom and on what basis. We do not assume that a funding agreement alone authorises every disclosure.

5. Disposal of information and e-waste

When information is no longer needed, we securely destroy or anonymise it, subject to lawful retention requirements. Paper records are shredded or securely destroyed. Digital records and storage devices are securely deleted or wiped using methods appropriate to the system or device. Devices are disposed of through appropriate e-waste services. Where information remains in backups, it is protected and removed in line with the relevant backup retention cycle.

6. Staff awareness and training

Staff and contractors receive privacy and information-handling guidance appropriate to their roles during onboarding. Access is limited to what they need for their work. We review this policy at least annually and communicate relevant changes and privacy expectations to the team.

7. Privacy responsibility and contact

D7 People is responsible for the personal information it holds and maintains responsibility for privacy compliance, staff guidance, access and correction requests, and privacy concerns. You do not need to identify or contact a named individual to raise a privacy matter. Please use the contact details at the end of this policy and mark your message “Privacy”.

8. Storage and security

We hold information in password-protected CRM, cloud storage and other business systems, with access restricted to authorised people who need it for their roles. Any physical records are kept in secure storage with restricted access. We take reasonable steps to protect information from loss, misuse, unauthorised access, alteration or disclosure, and review our safeguards regularly.

Sensitive information receives additional care and access restrictions appropriate to its nature. It is shared only where necessary for the agreed purpose, with your authorisation, or where permitted or required by law.

We use service providers, including Wix for our website, forms and contact management. Providers may process or store information outside New Zealand. We remain responsible for information held on our behalf and take reasonable steps to ensure appropriate safeguards. If a disclosure to an overseas recipient is subject to information privacy principle 12, we ensure a permitted basis applies, such as comparable safeguards or your informed authorisation.

9. Use and disclosure of information

We use and disclose information for the purposes explained when it was collected, or for another purpose where you authorise it or the Privacy Act or another law permits or requires it. For example, the law may permit disclosure to prevent or lessen a serious threat to health or safety.

With your informed and voluntary consent, we may share relevant CVs, employment preferences, work history or readiness information with agreed employers or support partners. We explain what will be disclosed and to whom, and you can choose what optional information to share.

We may use trusted providers to process information on our behalf and authorised advisers or auditors where necessary and lawful. We do not sell personal information or provide it to third parties for their own marketing. Information used for public testimonials, photographs or recordings requires a separate agreed basis; participation alone is not permission for publicity.

10. Your rights and privacy concerns

You can ask whether we hold personal information about you, request access, and ask us to correct information you believe is wrong. We may need to verify your identity. We respond as soon as reasonably practicable and within the timeframes required by law, generally within 20 working days. If an extension or refusal is permitted, we explain the reason and your options. If we do not make a requested correction, you can ask for a statement of the correction sought to be attached to the information.

You can withdraw consent for optional uses, including marketing, and discuss the effect on any ongoing service. Withdrawal does not undo lawful past use or override information we must retain. To make a request or raise a concern, email belinda@d7people.co.nz. If we cannot resolve your concern, you can complain to the Office of the Privacy Commissioner.

11. Data retention

We keep personal information only for as long as needed for its lawful purpose, including applicable legal, funding, contractual, employment and recordkeeping requirements. We review retention needs and securely dispose of or anonymise information when it is no longer needed. You can ask us about the retention requirements that apply to your information.

12. Website, forms and digital privacy

Website enquiry and mailing list forms submit directly to Wix Forms. Submitted information is held in Wix Forms and relevant contact fields are stored in Wix Contacts so D7 People can respond, manage relationships and administer subscriptions. An enquiry does not automatically subscribe you to marketing. Marketing updates are sent only when you opt in, and you can unsubscribe using the link in our emails or by contacting us.

Wix and other digital providers may process technical information, such as IP addresses, device or browser details, cookies and usage records, to operate, secure and support the website. Where optional analytics or marketing cookies are used, available consent controls apply. Browser settings can also manage cookies, although blocking some cookies may affect functionality.

External websites or platforms linked from this site have their own privacy practices. This policy explains D7 People’s handling of information; you should also check the relevant platform’s privacy information.

13. Privacy incidents

We assess suspected privacy incidents, take steps to contain them and reduce harm, and review what needs to change. If a breach has caused or is likely to cause serious harm, we notify the Privacy Commissioner and affected individuals as soon as practicable, unless a lawful exception applies. Please contact us promptly if you suspect personal information has been lost, accessed or disclosed inappropriately.

14. Policy updates

We review this policy annually and when legal, operational or technology changes require it. The current policy is available at d7people.co.nz/privacy-policy or on request. The date above records the latest update.

Contact us

For questions, access or correction requests, or privacy concerns, contact Design Seven Ltd trading as D7 People and mark your enquiry “Privacy”.

Email: belinda@d7people.co.nz