Our mission at the University of Auckland (“the University”) is to be a “research-led, international university, recognised for excellence in teaching, learning, research, creative work, and administration, for the significance of its contributions to the advancement of knowledge and its commitment to serve its local, national and international communities”.

We can’t achieve our mission without collecting and processing personal information about our prospective, current and former students, and about our donors and friends. We know that our people will only relinquish control of their personal information if they trust us to use it responsibly and treat it with care and respect.

People from all over the world come to New Zealand to work, research or learn with us, and so we collect and process personal information about people from many countries. For this reason, we have developed a privacy regime that recognises the fundamental privacy concepts that underpin all privacy regimes:

• Data minimisation – we will collect and retain only the personal information we really need to meet our lawful purposes
• Transparency – we will always be open with people about the personal information we collect and how we process it
• Security – we take all reasonable steps to ensure that personal information is protected against loss or unauthorised processing
• Use limitation – we use and share personal information only in the ways we say we will, and only where necessary to meet our lawful purposes
• Rights focused – we will make sure that people can exercise their important privacy rights, including to access and correct their information

This privacy statement explains what information we collect about the people we deal with and how we process it. It is about the practices of the University. We are the data controller, which means that we determine the purposes for, and ways in which, we collect and use personal information. We also use third party data processors.

If you are an employee of the University, read more about how we use your personal information in Employee Privacy.

If you are a participant in a research project being managed by the University, you can read more about how your personal information may be used and shared in the Participant Information Sheet provided to you by the researcher. Please note, however, that the general information in this statement about storage, security and your privacy rights applies.

The personal information we collect and how we process it

• Students
• Alumni and friends
• Donors
• Website

Accessing and controlling your personal information

• Getting a copy of your information
• Correcting or deleting your information
• Managing how we use your information
• Making a complaint

The personal information we collect and how we process it

We collect personal information in a number of ways, depending on where you are in your journey with us. To make this privacy statement easier to follow, we have explained the way we collect, use and share personal information at each phase of the University journey:

• Students – data we collect as part of the application and enrolment processes and during your study or research
• Alumni and friends – data we collect about our former students and friends of the University, which includes current and former employees
• Donors – data we collect about our potential and actual donors
• Website – data we collect about anyone who visits our websites

Students
We collect and process personal information about prospective and current students for the primary purposes of considering applications for admission to the University, enrolling successful applicants and administering programmes of study.

Our lawful bases for collecting and processing personal information in these ways are to meet our obligations to students as their tertiary education provider and to meet our legitimate interests, including making sure our services are fit-for-purpose and are delivered in a way that meets New Zealand’s educational standards and keeps our students and staff safe.

The information we collect about students
We may collect personal information when you provide it to us directly – for example during the pre-application, application and enrolment processes – from third parties (usually with your consent) – for example where we need to verify previous study at other institutions – or when you generate personal information by using our services – for example when you check out a book from the General Library.

If you choose not to provide any of the personal information requested, it may not be possible for the University to consider you for admission, enrol you, or properly deliver the services you have requested from us.

The personal information we collect about you as a student will include:

• biographical details (including name, former name, alias, gender and date of birth)
• contact details (including address, telephone, email, and emergency and alternative contact details)
• education record and academic/research history
• citizenship or residency information
• country of origin and ethnicity
• iwi affiliation (if you are a Māori student)
• National Student Number
• National Health Index
• interactions and communications with us and our systems
• information about your study, including your academic achievement and any research or other assignments you complete
• feedback on courses you provide to us as part of a survey
• information about your suspension from any other New Zealand tertiary education provider
• photograph (for student ID cards), and
• other information that you decide to share with us

In addition, depending on your programme of study or involvement with specific services that we offer, we may also collect:

• information about your areas of study interest
• passport and visa details
• information about your English language proficiency
• health and disability information (including where you use student health, counselling, disability, accommodation, or recreation services, or where you have applied for a field trip, student exchange or study abroad programme). Find out more about privacy at University Health and Counselling Service
• career information (including your aspirations and relevant work history/experience)
• financial information (including information about payment for study, such as credit/debit card or bank account details)
• criminal convictions (if necessary for certain programmes or work placements)
• information provided through reference checking processes for accommodation or other benefits
• health and travel insurance arrangements (including where you are an international student, or you are participating in field trips or student exchanges), and
• information about your child provided by you to our Early Childhood Centres (if you have enrolled your child in one of these Centres)

We may also collect personal information about you as you use our services and participate in campus life. Find out more about the collection of personal information.

How we use your information
In order to meet the primary purposes set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law.

We will use your personal information to:

• correspond with you
• inform you about your courses and other aspects of admission, enrolment and study
• inform you of the availability of scholarships
• enable you to apply for special entry consideration
• inform you about opportunities to engage with and support the University
• facilitate and enable programmes relevant to your enrolment (such as cross institutional study, student exchanges, student placements, voluntary workplace activities, internships, and industry experience)
• facilitate and allow you to participate in activities relevant to your enrolment that support your academic achievement
• facilitate and enable community engagement, work-integrated learning activities and student-to-student learning
• facilitate and enable international experiences and perspectives through study abroad
• facilitate and enable scholarship programmes for which you may be eligible
• provide associated services such as security, parking, information technology and (where used by you) residential or sport and recreation services
• on programme completion, place your details on the University’s alumni database so that you may be kept informed of alumni news, events and activities
• assist you in the event of an emergency
• conduct benchmarking, analyses, quality assurance and planning in respect of the products and services we offer
• support our academic integrity and discipline processes, and the overall integrity of the tertiary education system
• comply with contractual or legislative reporting and recordkeeping requirements
• conduct ethics committee approved research, the reporting or publication of which is in an aggregate non-identifiable form, or to seek your consent to participate in ethics committee approved research conducted on another basis, and
• after your enrolment with University ceases, contact you for the purpose of seeking your feedback in relation to benchmarking, analyses, quality assurance and planning activities

Data analytics and automated processing

We analyse data, including personal information, to drive and improve many of our processes and services. We also use automated processing tools to assist us to make better decisions on some services (often driven by data analytics), and to manage some course administration processes. Find out more about our data analytics and automated processing activities.

How we share your information

We may need to share information to deliver the services you have requested from us, to meet our legitimate interests, or to comply with contractual, government or regulatory requests or reporting requirements. Where we need to share information with an agency we have not anticipated here, we will only do so if required or permitted by law.

We may share your information with:

• government agencies, such as the Ministry of Education, the Tertiary Education Commission, Studylink, Inland Revenue, the Ministry of Social Development, the Ministry of Foreign Affairs and Trade, and the Ministry of Business, Innovation and Employment (including Immigration New Zealand)
• other tertiary education providers, with which the University has entered into a joint venture or other contractual arrangement, such as a conjoint teaching arrangement, including where required to enable other providers to meet their legislative obligations
• other tertiary education providers where we believe that you may have engaged in dishonest activity, such as providing false or falsified admission documents
• tribal trusts and scholarship providers
• professional registration agencies, such as the New Zealand Education Council and the Medical Council of New Zealand
• agencies involved in quality assurance and planning for higher education, such as the Academic Quality Agency for New Zealand Universities
• external agencies, such as former employers, secondary schools, other tertiary education providers, tertiary admission centres, and English language testing verification services, to verify your qualifications or experience
• contracted service providers which the University uses to perform services on its behalf (such as application, recruitment and course administration, banking, mailing house services, advertising agencies, logistics and IT service providers), within and outside New Zealand (see more on this below)
• University owned or related entities, such as Auckland UniServices Limited where you use the services they provide
• affiliated agencies, such as clubs or associations, in order to meet the purposes set out above
• other students (for example, where we share lecture recordings with the other students who attended the lecture)
• the University’s legal advisers or other professional advisers and consultants engaged by the University, and
• in the event of an emergency, police, medical or hospital personnel, civil emergency services, your legal representative or nominated emergency contact person, or any other person assessed as necessary to respond to the emergency

Your name, date of birth, and residency will be included in the New Zealand National Student Index, and will be used in an Authorised Information Matching programme with the New Zealand Birth Register.

Find out more about how we may share your health information, which we recognise should be treated a little differently.

If we need to share your information with a third party that is overseas, such as another tertiary education provider, we will ensure that this complies with principle 12 of the Privacy Act. If the third party is not located in a country that has comparable privacy laws to ours, we will require them to agree to protect your information to New Zealand standards.

Alumni and friends

We collect and process personal information about our alumni (former students and employees) and friends (anyone, including employees, who has a direct interest or relationship with us, or the potential to develop one) for the primary purpose of connecting you with the University and other alumni.

Our lawful basis for collecting and processing personal information in this way is to meet our legitimate interests, including in making sure we can maintain our community, communicate with our alumni and friends and promote University services and events. We do not rely on consent to communicate with our alumni and friends, as we believe this community is integral to the success of the University. However, you can opt out of these communications at any time by following the steps set out in Managing the way we use your personal information.

The information we collect about alumni and friends

We may collect personal information when you provide it to us directly – for example when you update your details, connect with us on social media or register to attend events – or from third parties (usually with your consent) – for example from publicly available sources such as LinkedIn or other agencies that support the University.

If you choose not to provide any of the personal information requested, it may not be possible for the University to keep you connected with us and other alumni.

The personal information we collect about you as an alumnus or friend is initially that which you provided as a student and may include:

• biographical details (including name, former name, alias, gender and date of birth)
• contact details (including location, address, former addresses, telephone, email, social media and website links, and contact preferences)
• education record and academic history (including your associations with us if you were a student – such as your hall of residence and club membership)
• ethnicity (if we were required to collect this under NZ law from when you were a student)
• iwi affiliation (if you were a Māori student)
• interactions and communications with us and our systems
• responses to our electronic communications (including what you open or click on, any comments you make, and your location), and
• events you have been invited to and whether or not you have responded or attended

In addition, we may also collect the following information about you:

• any people we link to you, including your spouse, partner or adult children, who are also alumni or friends
• links with other organisations and individuals (including alumni, friends or donors)
• employment and business details including positions, organisation, professional memberships and qualifications
• career highlights and other lifetime achievements
• outside interests and membership of groups
• media articles, and
• any other information that you have decided to share with us

How we use your information

In order to meet the purpose set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law.

We will use your personal information to:

• correspond with you, including re-establishing contact when we appear to have lost touch
• provide you with any services you have requested from us, including events or sport and recreation services
• inform you about University courses or events
• inform you about, and provide, alumni and friends benefits
• inform you about opportunities to engage with and support the University
• conduct benchmarking, analyses, quality assurance, and planning to improve alumni and friend services
• assist you in the event of an emergency
• comply with contractual or legislative reporting and recordkeeping requirements

How we share your information

We may need to share information to deliver the services you have requested from us, to meet our legitimate interests, or to comply with government or regulatory requests or reporting requirements. Where we need to share information with an agency we have not anticipated here, we will only do so if required or permitted by law.

We may share your information with:

• University owned or related entities
• contracted service providers which the University uses to perform services on its behalf (such as mailing house services, logistics and IT service providers), within and outside New Zealand (see more on this below)
• affiliated agencies, such as clubs or associations, in order to meet the purposes set out above
• in the event of an emergency, police, medical or hospital personnel, civil emergency services, your legal representative, or any other person assessed as necessary to respond to the emergency
• the University’s legal advisers or other professional advisers and consultants engaged by the University, and
• government agencies, where permitted or required by law

If we need to share your information with a third party that is overseas, we will ensure that this complies with principle 12 of the Privacy Act. If the third party is not located in a country that has comparable privacy laws to ours, we will require them to agree to protect your information to New Zealand standards.

Donors

Donations from our alumni and friends make a real impact on our ability to retain our excellence in teaching, learning and research. We collect and process personal information about potential and actual donors for the primary purpose of soliciting and processing donations and to stay in touch with donors.

Our lawful basis for collecting and processing personal information in this way is to meet our legitimate interests, including in making sure we can maintain our funding and our high educational standards. We do not rely on consent to communicate with our donors, as we believe this community is integral to the success of the University. However, you can opt out of donor communications at any time by following the steps set out in Managing the way we use your personal information.

The information we collect about donors

We may collect personal information when you provide it to us directly – for example when you complete a donation form – or from third parties – for example from publicly available sources or other agencies that support the University.

If you choose not to provide any of the personal information requested, it may not be possible for the University to process your donation or provide you with current information about events we think you may be interested in.

Please note: If you wish for your donation to be anonymous then please let us know and your gift will not be acknowledged publicly.

The personal information we collect about you as a potential or actual donor will include:

• biographical details (including name, former name, alias, gender and date of birth)
• contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences)
• credit card details (if you have provided these to us)
• interactions and communications with us and our systems

In addition, we may also collect information about your:

• education record and academic history (including your associations with us if you were a student – such as your hall of residence and club memberships)
• ethnicity
• iwi affiliation (if you were a Māori student)
• responses to our electronic communications (including what you open or click on, any comments you make, and your location)
• events you have been invited to and whether or not you have responded or attended
• any people we link to you, including your spouse, partner or adult children, who are also alumni or friends
• links with other organisations and individuals (including alumni, supporters and potential supporters)
• employment and business details including positions, organisation, professional memberships and qualifications
• career highlights and other lifetime achievements
• outside interests and membership of groups
• wealth and philanthropic interests (see more on this below)
• media articles
• donations of time, expertise or money (including to organisations other than us), and
• other information that you have decided to share with us

Whether you are an existing or a potential donor, we may carry out research to assess your likely ability and willingness to make a gift to the University. Find out more about our donor research activities.

How we use your information

In order to meet the purposes set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law.

We will use your personal information to:

• correspond with you
• process your donation, or provide any other services you have requested from us
• inform you about University courses or events
• inform you about, and provide, friends benefits
• inform you about opportunities to engage with and support the University
• assist you in the event of an emergency, and
• comply with contractual or legislative reporting and record keeping requirements

How we share your information

We may need to share information to deliver the services you have requested from us, or to meet our legitimate interests, or to comply with government or regulatory requests or reporting requirements. Where we need to share information with an agency we have not anticipated here, we will only do so if required or permitted by law.

We may share your information with:

• your nominated financial institution for processing your donation
• the public, where we publicly identify you as a donor
• University owned or related entities
• contracted service providers which the University uses to perform services on its behalf (such as mailing house services, logistics and IT service providers), within and outside New Zealand (see more on this below)
• in the event of an emergency, police, medical or hospital personnel, civil emergency services, your legal representative or any other person assessed as necessary to respond to the emergency
• the University’s legal advisers or other professional advisers and consultants engaged by the University, and
• government agencies, where permitted or required by law

If we need to share your information with a third party that is overseas, we will ensure that this complies with principle 12 of the Privacy Act. If the third party is not located in a country that has comparable privacy laws to ours, we will require them to agree to protect your information to New Zealand standards.

Website

We collect and process personal information about users of our websites for the primary purposes of delivering any services or functionality requested by users and for improving the online experience for our users.

Our lawful basis for collecting and processing personal information in this way is to meet our legitimate interests, including making sure we can properly deliver online services.

The information we collect about website users

When you visit our websites and use any of our web-based services, the personal information we collect about you includes:

• computer’s internet (IP) address
• your domain name
• the date and time of your visit to the site
• the pages you accessed and documents you downloaded, including on third-party sites that are affiliated with us
• the site you visited immediately before you visited our site, that linked you to our site
• the type of browser and operating system you are using, and
• the username entered if accessing a restricted site

We may use “cookies” to show you advertisements related to the University as you visit third party sites across the internet. Find out more about cookies.

How we use your information

In order to meet the purposes set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law.

We will use the information we collect about your use of our websites or web-based services to:

• provide you with a personalised online experience without requiring you to remind us of your preferences each time you return to our websites
• target our advertising using services such as Google Adwords and Google Analytics (this is a way for us to connect with visitors, based on their past interactions with the University’s websites)
• aggregate your interactions with us across the devices that you use to access our services, and
• analyse and optimise University websites and systems use and perform system administration tasks

We share the personal information we collect about website users only with the third-party service providers – such as Google – that provide us with advertising and other online services.

We may use third-party service providers to store your personal information and provide us with services. This means that we may transfer personal information, or access it from, countries other than New Zealand.

We recognise that we are accountable for your personal information wherever it is in the world. Where we can, we will send personal information only to countries that have adequate privacy laws in place (such as New Zealand, Australia or the EU). However, where we cannot do this, we take reasonable steps to ensure that any third-party service providers we use can meet our privacy and security expectations.

We retain your personal information only for as long we need it to perform our contractual obligations or meet our legitimate interests, or comply with our legal obligations, including the requirement to retain information in accordance with the Public Records Act 2005.

Wherever your personal information is stored, we take reasonable steps to ensure that it is protected against loss or unauthorised access, modification, use or disclosure.

More information about our security safeguards.

Accessing and controlling your personal information

You have some important privacy rights, including the right to know what information we hold about you and the right to correct it. Sometimes, you can also ask us to delete or stop using your personal information in a particular way. You can exercise any of these rights by:

• calling us on +64 9 373 7999
• emailing us at privacy@auckland.ac.nz
• writing to us at Privacy Officer, The University of Auckland, Private Bag 92019, Auckland 1142, New Zealand

Please note that we need to take steps to make sure you are authorised to make requests about personal information, so we may need to verify your identity or authority before responding to your request. Once we’ve verified who you are, we’ll try to respond to your request or query as soon as possible, and no later than 20 working days after we receive it.

Getting a copy of your information

You have the right to request a copy of your personal information. We’ll be as open as we can with you but sometimes we might need to withhold personal information, for example where the information is legally privileged, commercially sensitive or includes personal information about other people. If we need to withhold information, we’ll tell you why.

Correcting or deleting your information

If you think any of the personal information we hold about you is wrong, you can ask us to correct it. Where we’ve retained your personal information for purposes that are not directly related to the performance of a contract or to our legitimate interests, you may be able to ask us to delete it, but note that we must retain certain information under the Public Records Act 2005.

If we can’t correct or delete your information (for example, where we don’t agree that it’s wrong, or we need the information for a lawful purpose), we’ll tell you why. You can ask us to attach your correction request to the information as a statement of correction.

Managing how we use your information

Where we’re processing your personal information on the basis of consent, you can revoke your consent at any time. Where we’re processing your personal information on the basis of our legitimate interests (such as improving our services), including automated processing, you can object to this. If you believe we’re using your personal information in ways that are unlawful, or if we’re continuing to use information that you think is inaccurate, you can ask us to restrict this processing.

Making a complaint

If you have any concerns about the way we’ve collected or processed your personal information, let us know, so we can try to put the matter right. If we can’t resolve your concerns, you can also make a complaint to the Office of the NZ Privacy Commissioner by:

• completing the online complaint form at www.privacy.org.nz or
• writing to the Office of the Privacy Commissioner, PO Box 10-094, The Terrace, Wellington 6143, New Zealand