Purpose: 

This purpose of this policy is to:

• Confirm the Mortgage and Insurance New Zealand Limited commitment to the protection of personal information and adherence to the relevant laws and Privacy Principles.
• Outline the ways in which the Mortgage and Insurance New Zealand Limited endeavours to comply with the relevant legislation in the collection, usage, storage, and disclosure of personal information.
• Outline the ability to access Personal information and to correct any false or misleading information; and
• Outline the types of personal information held by us and the purpose for which personal information is collected, used, stored, disclosed, and disposed of.

Scope:
This Policy applies to all staff, directors, representatives, and contractors of Mortgage and Insurance New Zealand Limited.

Governing Laws, Regulations and Principles

This policy has been prepared in consideration of the following laws and regulations:

• Privacy Act 2020 (the ‘Act’) (including amendments of and regulations)
• Privacy Principles issued by the Privacy Commissioner.

Definitions
Personal Information – is information about an identifiable individual as defined in the Privacy Act 2020 (the ‘Act”). This includes information about an individual whose identity is apparent, or can reasonably be ascertained, from the information.

This includes all personal information not publicly available; or information relating to a death that is maintained by the Registrar-General pursuant to the Births Deaths and Marriages Registration Act 1955 or any former Act that a reasonable person would agree should be accessed only on a ‘need to know’ basis.

This includes, but is not limited to:

• employment related information such as contract terms, salary information, performance reviews, date of birth etc.
• information collected for the establishment, administration, and maintenance relevant to the business relationship between Mortgage and Insurance New Zealand Limited and clients
• personal contact details including emergency contact details; and
• employment history.

Mortgage and Insurance New Zealand Limited Commitment
Mortgage and Insurance New Zealand Limited is committed to the safe guardianship and protection of personal information for staff and clients, and is bound by relevant laws in the collection, usage, storage, and disclosure of personal information. We do not sell personal information to any other organisation.

Our business is founded on trust and integrity. This includes being entrusted with sensitive information for staff and clients.

This policy outlines the ways in which Mortgage and Insurance New Zealand Limited endeavours to comply with these laws in the protection and safe keeping of personal information, from the types of personal information held to the purposes which personal information is collected, used, stored, disclosed, and disposed of.

Collection of Information

What Information is Collected?
Personal information is collected in the course of Mortgage and Insurance New Zealand Limited conducting its business. Personal information is collected for those that are employed or work on behalf of Mortgage and Insurance New Zealand Limited along with Information collected from clients for the dominant purposes of the establishment, administration and maintenance of requested products and services.

What Type of General Personal Information is Collected?
Personal identifiable information MUST only be collected where it is ESSENTIAL, NECESSARY and RELEVANT to the services and products Mortgage and Insurance New Zealand Limited offers. If the information is not essential, necessary, or relevant then it should not be collected. The goal is to collect and use the least amount of identifying personal information possible.

This is information such as a person’s name, date of birth, contact details, address, income, asset and liabilities, employment details (including salary), criminal history, credit rating, financial statements, health details and statistical information (where relevant).

How is this Information Collected?
The collection of this information can be received either directly from the individual by way of completing forms, telephone correspondence and electronic or mail correspondence, or where permitted by the individual indirectly from a third party such as a client’s employer, or agent (lawyer, accountant, financial adviser).

Collecting Information from Children or Young People
When collecting identifiable personal information from children or young people we should consider whether the way we collect the information is fair in the circumstances. It may not be fair to collect information from children in the same manner as we would from an adult.

Unique identifiers
Unique identifiers should only be collected where the collecting of that unique identifier is essential. For example, an IRD number for the purpose of calculating tax.

Mortgage and Insurance New Zealand Limited must minimise the risk of any unique identifier being misused, by not using that identifier in any communications or reporting to members unless it is necessary. For example, annual tax statements must include the member’s IRD number. Minimising the use of unique identifiers should also be considered for any internal reporting, including reporting provided to auditors. Where unique identifiers are used, if possible (taking in considering any relevant legislation or otherwise) that identifier should be shown as truncated.

What type of sensitive personal information is collected?
This is information such as health records, insurance details, information about memberships with professional/trade associations, criminal records etc. The ways in which tax file numbers are used and stored are also restricted by law.

Like general personal information, sensitive personal information can be collected directly from the individual or indirectly from a third party. The individual will be informed if a third-party request is required and made aware if sensitive personal information is received and collected from a third-party source.

Sensitive information is treated with greater restrictions and with a higher degree of confidentiality. Sensitive information is required for the processing of death/sickness and disability insurance and to manage claims on these products. Sensitive information is used and disclosed for the purpose provided unless the customer agrees otherwise.

Use of Personal Information:

Personal information may be used to (amongst other things):

• establish member accounts.
• process contributions to member accounts.
• assess insurance claims.
• apply for lending and insurance products.
• maintain correspondence with a client regarding queries, benefits, and options.
• develop and establish products and services for members by undertaking statistical analysis and research.
• detect and prevent fraud through prudential risk management.
• fulfil legal requirements and compliance with necessary government statutory bodies such as the Inland Revenue (IR), Financial Markets Authority (FMA) and Reserve Bank of New Zealand (RBNZ); and
• perform certain checks before employment and/or during employment.

Disclosure of Personal Information:
Mortgage and Insurance New Zealand Limited has a duty to protect the confidentiality of the affairs of client and staff alike, which includes personal information. This duty applies except where disclosure of this personal information is by consent or compelled by law.

• Potential third parties whose personal information may be disclosed to are:
• outsource companies such as mailing companies and information technology companies.
• subsidiaries or affiliated companies to us (NZFSG, supervisors, trustees and custodians).
• auditors performing audits on Mortgage and Insurance New Zealand Limited or any of its affiliates.
• appointed representatives (such as lawyers, accountants, financial advisers, power of attorney, supervisors etc).
• insurance brokers, insurers, and reinsurers.
• banks and lenders
• any medical practitioners who are assisting Mortgage and Insurance New Zealand Limited in relation to any claims; and
• by court order

Property (Relationships) Act 1976
By the above law we are required to release information about a member’s interest in a superannuation fund in relation to the grounds of splitting superannuation due to the breakdown of marriage. For disclosure of this information all requests must be in writing and supplied with the correct form/documentation.

Identification of Callers
From time to time the rules that Mortgage and Insurance New Zealand Limited uses to determine the identity of a caller will change. It is essential that all Employees are made aware of the related procedures to ensure proper identification is made before:

1. Information is released to the caller.
2. We act on the caller’s request.

Outsourcing and Cross-Border Disclosures
Personal information will be disclosed when certain functions are outsourced such as bulk mailing, statement production, and information technology support. Mortgage and Insurance New Zealand Limited has existing confidentiality agreements in place with all outsourcing parties.

Where information is sent to an organisation overseas, consistent with privacy principal 12 identifiable personal information can only be disclosed to that overseas organisation where the country of that organisation has similar legislative protections to the NZ Act. Whilst organisations can still choose to deal with overseas organisations that do not have similar legislative protections to the NZ Act, Mortgage and Insurance New Zealand Limited ’s policy is that it will only deal with overseas organisations that have similar legislative protections to the NZ Act.

Integrity of Personal Information
Mortgage and Insurance New Zealand Limited has a duty to protect the integrity of personal information and must take reasonable steps to ensure the personal information that Mortgage and Insurance New Zealand Limited collects, uses or discloses is, having regards to the use of the information and purpose of original disclosure, accurate, up to date, complete and relevant.

Correction of personal information
If Mortgage and Insurance New Zealand Limited holds personal information about an individual and:

1. Mortgage and Insurance New Zealand Limited is satisfied that, having regard to the purpose for which the information is held, the information is inaccurate, out of date, incomplete, irrelevant, or misleading; or
2. the individual request Mortgage and Insurance New Zealand Limited to correct the information.

Mortgage and Insurance New Zealand Limited must take such steps (if any) as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up to date, complete, relevant, and not misleading.

Notification of correction to third parties
If Mortgage and Insurance New Zealand Limited corrects personal information about an individual that Mortgage and Insurance New Zealand Limited previously disclosed to another organisation and the individual requests Mortgage and Insurance New Zealand Limited to notify the other organisation of the correction, Mortgage and Insurance New Zealand Limited must take such steps (if any) as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

Refusal to correct information.
If Mortgage and Insurance New Zealand Limited refuses to correct the personal information as requested by the individual, Mortgage and Insurance New Zealand Limited must give the individual a written notice that sets out:

1. the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and
2. the mechanisms available to complain about the refusal; and
3. any other matter prescribed by the regulations.

Refusal to associate a statement.
If Mortgage and Insurance New Zealand Limited refuses to correct the personal information as requested by the individual and the individual requests Mortgage and Insurance New Zealand Limited to associate with the information a statement that the information is inaccurate, out of date, incomplete, irrelevant or misleading, Andre Paul Stokes must take steps as are reasonable in the circumstances to associate the statement in such a way that will make the statement apparent to users of the information.

Dealing with these requests
If a request is made Mortgage and Insurance New Zealand Limited must respond to the request within a reasonable period after the request is made and must not charge the individual for making this request, for correcting the personal information or for associating the statement with the personal information (as the case may be).

Storage of Personal Information

Personal information received may be stored in the form of:

• hard copy documents (paper-based files and other records)
• electronic data (interaction via electronic means of internet, phone and fax)
• in Mortgage and Insurance New Zealand Limited computer systems or software

Mortgage and Insurance New Zealand Limited is committed to the protection of any personal information held and must take such steps as are reasonable in the circumstances from misuse, interference, loss, unauthorised access, modification, or disclosure, illegally altered or destroyed.

If Mortgage and Insurance New Zealand Limited:

• holds personal information about an individual and.
• Mortgage and Insurance New Zealand Limited no longer needs the information for any purpose for which the information may be used or disclosed by the group and.
• the entity is not contained in a Commonwealth record and.
• Mortgage and Insurance New Zealand Limited is not required by law, or court/tribunal order, to retain the information.

Mortgage and Insurance New Zealand Limited must take such steps as are reasonable in the circumstances to destroy the information or ensure that the information is de-identified.

To ensure the safe storage of Personal Information, Mortgage and Insurance New Zealand Limited may apply the following principles:

• confidentiality requirements on Mortgage and Insurance New Zealand Limited employees.
• training of staff to recognise and deal with personal information and particularly sensitive personal information.
• policies for document storage/maintenance and destruction.
• provision of information once adequate security/ID checks have been given.
• website/technology protection – in designing Mortgage and Insurance New Zealand Limited websites security procedures consistent with industry practice are considered; and
• secure access to Mortgage and Insurance New Zealand Limited premises and dwellings where personal information is held, or the assurance from any document management/archiving organisation that the personal information is securely held.

Mortgage and Insurance New Zealand Limited may be required to hold personal information for a specific period of time in accordance with applicable legislation and regulations. However, where it is considered that this information is no longer needed; all information will be removed and securely destroyed.

Irrespective of the access controls over Personal Information, no such information should be shared with or provided to unauthorised persons unless specific authority to access the information is provided.

Access requests for personal information
Individuals have the right to access their information to verify its accuracy, completeness and if it is up to date.

In addition to access, an individual has the right to have their personal details correct and/or updated.

Things that might affect an individual’s right to access their information may include:

1. access would pose a serious threat to the life or health of any individual: or
2. the request is frivolous or vexatious; or
3. access would cause unreasonable impact on the privacy of others: or
4. access would relate to information being used for commercially sensitive decision-making processes: or
5. access would be unlawful/ infringing privilege/ prejudice court proceedings and law enforcement agencies and other breaches of law: or
6. access would reveal intentions of Mortgage and Insurance New Zealand Limited in relation to negotiations with the individual in such a way as to prejudice those negotiations: or
7. the information relates to an existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings; or
8. denying access is required or authorised by or under New Zealand Law or a court/tribunal order; or
9. Mortgage and Insurance New Zealand Limited has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to Mortgage and Insurance New Zealand Limited functions, or activities has been, is being or maybe engaged in or
10. giving access would be likely to prejudice the taking of appropriate action in the relation to the matter; or
11. access would likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body: or
12. access would reveal evaluative information generated within Mortgage and Insurance New Zealand Limited in connection with commercially sensitive decision-making process.

Refusal to give access
If access to personal information is denied Mortgage and Insurance New Zealand Limited must give the individual written notice that sets out:

1. the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and
2. the mechanisms available to complain about the refusal; and
3. any other matter prescribed by the regulations; or
4. the reasons for the refusal may include an explanation for the commercially sensitive decision.

All attempts will be made to respond to an access request as soon as possible. Mortgage and Insurance New Zealand Limited aims to comply with a request within 30 days of receiving the request. Where exceptional circumstances arise, a request will be dealt with within a reasonable period after the request is made and allow access to the information in a manner requested by the individual, if it is reasonable and practicable to do so.

Anonymity
Wherever lawful and practicable, an individual has the option of dealing with Mortgage and Insurance New Zealand Limited anonymously (i.e., general inquiries about the products and services Mortgage and Insurance New Zealand Limited can provide).

Privacy Breaches and Notifiable Privacy Breaches

1. When there is a privacy breach we must:
   1. Contain the breach.
   2. Assess the breach.
   3. Notify the breach.
   4. Consider the breach.
2. All privacy breaches by Mortgage and Insurance New Zealand Limited must be reported to Andre-Paul Stokes immediately for assessment and an incident report must be prepared.
3. If there has been a privacy breach that may have caused serious harm to someone (or is likely to do so):
   1. Andre-Paul Stokes should consider guidance on whether serious harm has occurred which will make the breach ‘notifiable’, as set out below; and
   2. If it has been determined that the breach is notifiable, it will need to be reported to the Office of the Privacy Commissioner as soon as practicably possible after becoming aware that a notifiable breach has occurred. It is an offence to fail to notify the Privacy Commissioner of a notifiable privacy breach.
   3. Only Andre-Paul Stokes is authorised to report the breach to the Office of the Privacy Commissioner.
4. If a notifiable privacy breach occurs the affected people should be notified immediately.
   1. in order to determine whether serious harm is likely, section 113 of the Act should be considered and guidance on the Privacy Commissioner website, including:
   2. any action taken by the agency to reduce the risk of harm following the breach:
      1. a ‘harm’ can include loss, damage, or disadvantage; loss of benefit or right; emotional harm, such as significant humiliation or loss of dignity.
         1. whether the personal information is sensitive in nature.
         2. the nature of the harm that may be caused to affected individuals.
         3. the person or body that has obtained or may obtain personal information as a result of the breach (if known).
         4. whether the personal information is protected by a security measure; and
         5. any other relevant matters

Criminal offenses

Under the Act it is a criminal offence, resulting in a fine up to $10,000, to:

1. mislead a business or organisation by impersonating someone, or pretending to act with that person’s authority, to gain access to their personal information or to have it altered or destroyed.
2. destroy a document containing personal information, knowing that a request has been made for that information.
3. to fail to notify the Privacy Officer of a notifiable privacy breach.

Complaints

Where an individual considers their privacy has been breached in any way, or that any actions taken by Mortgage and Insurance New Zealand Limited breach this privacy policy or the applicable laws or regulations, a complaint may be made to Andre-Paul Stokes within the organisation. All complaints are handled with the strictest confidence and importance.

To assist in a prompt resolution of a dispute, it is recommended to supply all supporting documents concerning the matter of dispute, any questions that need to be addressed, as well as the favourable outcome desired.

If not satisfied with Mortgage and Insurance New Zealand Limited reply to a complaint, an individual can contact:

Privacy Commissioner on 0800 803 909 or email to enquiries@privacy.org.nz or www.privacy.org.nz

Non-Compliance
Failure by any employee, authorised representative, or contractor to comply with this policy will be treated as misconduct. Misconduct can result in a verbal warning through to instant dismissal/ revocation of nomination depending upon the seriousness of the situation.