Privacy at the University of Auckland

Our mission at the University of Auckland (“the University”) is to be a “research-led, international university, recognised for excellence in teaching, learning, research, creative work, and administration, for the significance of its contributions to the advancement of knowledge and its commitment to serve its local, national and international communities”.

We can’t achieve our mission without collecting and processing personal information about our prospective, current and former students, and about our donors and friends. We know that our people will only relinquish control of their personal information if they trust us to use it responsibly and treat it with care and respect. This privacy statement explains what information we collect about the people we deal with and how we process it.

If you are an employee of the University, read more about how we use your personal information in Employee Privacy.

People from all over the world come to New Zealand to work, research or learn with us, and so we collect and process personal information about people from many countries. For this reason, we have developed a privacy regime that recognises the fundamental privacy concepts that underpin all privacy regimes:

  • Data minimisation – we will collect and retain only the personal information we really need to meet our lawful purposes
  • Transparency – we will always be open with people about the personal information we collect and how we process it
  • Security – we take all reasonable steps to ensure that personal information is protected against loss or unauthorised processing
  • Use limitation – we use and share personal information only in the ways we say we will, and only where necessary to meet our lawful purposes
  • Rights focused – we will make sure that people can exercise their important privacy rights, including to access and correct their information

This privacy statement is about the practices of the University. We are the data controller, which means that we determine the purposes for, and ways in which, we collect and use personal information. We also use third party data processors. 
 

The personal information we collect and how we process it

  • Students
  • Alumni and friends
  • Donors
  • Website

How we store and protect your personal information

  • Storage and retention
  • Security

Accessing and controlling your personal information

  • Getting a copy of your information
  • Correcting or deleting your information
  • Managing how we use your information
  • Making a complaint

The personal information we collect and how we process it

We collect personal information in a number of ways, depending on where you are in your journey with us. To make this privacy statement easier to follow, we have explained the way we collect, use and share personal information at each phase of the University journey:

  • Students – data we collect as part of the application and enrolment processes and during your study or research
  • Alumni and friends – data we collect about our former students and friends of the University, which includes current and former employees
  • Donors – data we collect about our potential and actual donors
  • Website – data we collect about anyone who visits our websites

     

Students


We collect and process personal information about prospective and current students for the primary purposes of considering applications for admission to the University, enrolling successful applicants and administering programmes of study.

Our lawful bases for collecting and processing personal information in these ways are to meet our obligations to students as their tertiary education provider and to meet our legitimate interests, including making sure our services are fit-for-purpose and are delivered in a way that meets New Zealand’s educational standards and keeps our students and staff safe.

The information we collect about students

We may collect personal information when you provide it to us directly – for example during the pre-application, application and enrolment processes – from third parties (usually with your consent) – for example where we need to verify previous study at other institutions – or when you generate personal information by using our services – for example when you check out a book from the General Library.

If you choose not to provide any of the personal information requested, it may not be possible for the University to consider you for admission, enrol you, or properly deliver the services you have requested from us.

The personal information we collect about you as a student will include:

  • Biographical details (including name, former name, alias, gender and date of birth)
  • Contact details (including address, telephone, email, and emergency and alternative contact details)
  • Education record and academic/research history
  • Citizenship or residency information
  • Country of origin and ethnicity
  • Iwi affiliation (if you are a Māori student)
  • National Student Number
  • National Health Index
  • Interactions and communications with us and our systems
  • Information about your study, including your academic achievement and any research or other assignments you complete
  • Feedback on courses you provide to us as part of a survey
  • Information about your suspension from any other New Zealand tertiary education provider
  • Photograph (for student ID cards)
  • Other information that you decide to share with us

In addition, depending on your programme of study or involvement with specific services that we offer, we may also collect:

  • Information about your areas of study interest
  • Passport and visa details
  • Information about your English language proficiency
  • Health and disability information (including where you use student health, counselling, disability, accommodation, or recreation services, or where you have applied for a field trip, student exchange or study abroad programme)
  • Career information (including your aspirations and relevant work history/experience)
  • Financial information (including information about payment for study, such as credit/debit card or bank account details)
  • Criminal convictions (if necessary for certain programmes or work placements)
  • Information provided through reference checking processes for accommodation or other benefits
  • Health and travel insurance arrangements (including where you are an international student, or you are participating in field trips or student exchanges), and
  • Information about your child provided by you to our Early Childhood Centres (if you have enrolled your child in one of these Centres)

We may also collect personal information about you as you use our services and participate in campus life. For example, we may audio and/or video record the lectures you attend (your lecturer will usually advise you of this beforehand). Where CCTV cameras are in use at a University campus, we may collect still or video footage of your activities for safety and security purposes. We also use sensors on many University desks to assist us to operate sustainably (the sensors tell us if a desk is occupied, so we can allocate resources efficiently and manage lighting and heating requirements), however the data collected from these sensors will not identify you unless you are using an assigned desk.

How we use your information

In order to meet the primary purposes set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law.

We will use your personal information to:

  • Correspond with you
  • Inform you about your courses and other aspects of admission, enrolment and study
  • Inform you of the availability of scholarships
  • Enable you to apply for special entry consideration
  • Inform you about opportunities to engage with and support the University
  • Facilitate and enable programmes relevant to your enrolment (such as cross institutional study, student exchanges, student placements, voluntary workplace activities, internships, and industry experience)
  • Facilitate and allow you to participate in activities relevant to your enrolment that support your academic achievement
  • Facilitate and enable community engagement, work-integrated learning activities and student-to-student learning
  • Facilitate and enable international experiences and perspectives through study abroad
  • Facilitate and enable scholarship programmes for which you may be eligible
  • Provide associated services such as security, parking, information technology and (where used by you) residential or sport and recreation services
  • On programme completion, place your details on the University's alumni database so that you may be kept informed of alumni news, events and activities
  • Assist you in the event of an emergency
  • Conduct benchmarking, analyses, quality assurance and planning in respect of the products and services we offer
  • Support our academic integrity and discipline processes
  • Comply with legislative reporting and recordkeeping requirements
  • Conduct ethics committee approved research, the reporting or publication of which is in an aggregate non-identifiable form, or to seek your consent to participate in ethics committee approved research conducted on another basis
  • After your enrolment with University ceases, contacting you for the purpose of seeking your feedback in relation to benchmarking, analyses, quality assurance and planning activities

Automated processing

We use automated processing tools to assist us to determine your eligibility for programmes of study, scholarships or other services. We may also use automated tools to assist us with the marking of multiple choice assessments. In most cases where we use automated processing as part of our admissions or course administration processes, the outcomes are reviewed by our employees.

How we share your information

We may need to share information to deliver the services you have requested from us, to meet our legitimate interests, or to comply with government or regulatory requests or reporting requirements. Where we need to share information with an agency we have not anticipated here, we will only do so if required or permitted by law.

We may share your information with:

  • Government agencies, such as the:
    • Ministry of Education
    • Tertiary Education Commission
    • Studylink
    • Inland Revenue
    • Ministry of Social Development
    • Ministry of Foreign Affairs and Trade
    • Ministry of Business, Innovation and Employment (including Immigration New Zealand)
  • Other tertiary education providers that you transfer to or from, with which the University has entered into a joint venture or other contractual arrangement, such as a conjoint teaching arrangement
  • Tribal trusts and scholarship providers
  • Professional registration agencies, such as the New Zealand Education Council and the Medical Council of New Zealand
  • Agencies involved in quality assurance and planning for higher education, such as the Academic Quality Agency for New Zealand Universities
  • External agencies, such as former employers, secondary schools, other tertiary education providers, tertiary admission centres, and English language testing verification services, to verify your qualifications or experience
  • Contracted service providers which the University uses to perform services on its behalf (such as application, recruitment and course administration, banking, mailing house services, logistics and IT service providers), within and outside New Zealand (see more on this below)
  • University owned or related entities, such as Auckland UniServices Limited where you use the services they provide
  • Other students (for example, where we share lecture recordings with the other students who attended the lecture)
  • The University's legal advisers or other professional advisers and consultants engaged by the University
  • In the event of an emergency, police, medical or hospital personnel, civil emergency services, your legal representative or nominated emergency contact person, or any other person assessed as necessary to respond to the emergency

Your name, date of birth, and residency will be included in the New Zealand National Student Index, and will be used in an Authorised Information Matching programme with the New Zealand Birth Register.

Alumni and friends


We collect and process personal information about our alumni (former students and employees) and friends (anyone, including employees, who has a direct interest or relationship with us, or the potential to develop one) for the primary purpose of connecting you with the University and other alumni

Our lawful basis for collecting and processing personal information in this way is to meet our legitimate interests, including in making sure we can maintain our community, communicate with our alumni and friends and promote University services and events. We do not rely on consent to communicate with our alumni and friends, as we believe this community is integral to the success of the University. However, you can opt out of these communications at any time by following the steps set out in Managing the way we use your personal information.

The information we collect about alumni and friends

We may collect personal information when you provide it to us directly – for example when you update your details, connect with us on social media or register to attend events – or from third parties (usually with your consent) – for example from publicly available sources such as LinkedIn or other agencies that support the University

If you choose not to provide any of the personal information requested, it may not be possible for the University to keep you connected with us and other alumni

The personal information we collect about you as an alumnus or friend is initially that which you provided as a student and may include:

  • Biographical details (including name, former name, alias, gender and date of birth)
  • Contact details (including location, address, former addresses, telephone, email, social media and website links, and contact preferences)
  • Education record and academic history (including your associations with us if you were a student – such as your hall of residence and club membership)
  • Ethnicity (if we were required to collect this under NZ law from when you were a student)
  • Iwi affiliation (if you were a Māori student)
  • Interactions and communications with us and our systems
  • Responses to our electronic communications (including what you open or click on, any comments you make, and your location)
  • Events you have been invited to and whether or not you have responded or attended

In addition, we may also collect the following information about you:

  • Any people we link to you, including your spouse, partner or adult children, who are also alumni or friends
  • Links with other organisations and individuals (including alumni, friends or donors)
  • Employment and business details including positions, organisation, professional memberships and qualifications
  • Career highlights and other lifetime achievements
  • Outside interests and membership of groups
  • Media articles
  • Any other information that you have decided to share with us

How we use your information

In order to meet the purpose set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law

We will use your personal information to:

  • Correspond with you, including re-establishing contact when we appear to have lost touch
  • Provide you with any services you have requested from us, including events or sport and recreation services
  • Inform you about University courses or events
  • Inform you about, and provide, alumni and friends benefits
  • Inform you about opportunities to engage with and support the University
  • Conduct benchmarking, analyses, quality assurance, and planning to improve alumni and friend services
  • Assist you in the event of an emergency
  • Comply with legislative reporting and recordkeeping requirements

How we share your information

We may need to share information to deliver the services you have requested from us, to meet our legitimate interests, or to comply with government or regulatory requests or reporting requirements. Where we need to share information with an agency we have not anticipated here, we will only do so if required or permitted by law

We may share your information with:

  • University owned or related entities
  • Contracted service providers which the University uses to perform services on its behalf (such as mailing house services, logistics and IT service providers), within and outside New Zealand (see more on this below)
  • In the event of an emergency, police, medical or hospital personnel, civil emergency services, your legal representative, or any other person assessed as necessary to respond to the emergency
  • The University's legal advisers or other professional advisers and consultants engaged by the University
  • Government agencies, where permitted or required by law

Donors


Donations from our alumni and friends make a real impact on our ability to retain our excellence in teaching, learning and research. We collect and process personal information about potential and actual donors for the primary purpose of soliciting and processing donations and to stay in touch with donors.

Our lawful basis for collecting and processing personal information in this way is to meet our legitimate interests, including in making sure we can maintain our funding and our high educational standards. We do not rely on consent to communicate with our donors, as we believe this community is integral to the success of the University. However, you can opt out of donor communications at any time by following the steps set out in Managing the way we use your personal information.

We may collect personal information when you provide it to us directly – for example when you complete a donation form – or from third parties – for example from publicly available sources or other agencies that support the University

If you choose not to provide any of the personal information requested, it may not be possible for the University to process your donation or provide you with current information about events we think you may be interested in

Please note: If you wish for your donation to be anonymous then please let us know and your gift will not be acknowledged publicly

The personal information we collect about you as a potential or actual donor will include:

  • Biographical details (including name, former name, alias, gender and date of birth)
  • Contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences)
  • Credit card details (if you have provided these to us)
  • Interactions and communications with us and our systems

In addition, we may also collect information about your:

  • Education record and academic history (including your associations with us if you were a student – such as your hall of residence and club memberships)
  • Ethnicity
  • Iwi affiliation (if you were a Māori student)
  • Responses to our electronic communications (including what you open or click on, any comments you make, and your location)
  • Events you have been invited to and whether or not you have responded or attended;
  • Any people we link to you, including your spouse, partner or adult children, who are also alumni or friends
  • Links with other organisations and individuals (including alumni, supporters and potential supporters)
  • Employment and business details including positions, organisation, professional memberships and qualifications
  • Career highlights and other lifetime achievements
  • Outside interests and membership of groups
  • Wealth and philanthropic interests (see more on this below)
  • Media articles
  • Donations of time, expertise or money (including to organisations other than us)
  • Other information that you have decided to share with us

Whether you are an existing or a potential donor, we may carry out research to assess your likely ability and willingness to make a gift to the University.  We do this so, should we wish to approach you to make a gift, we can do so respectfully and with an understanding of your interests and capacity to make a gift. This research may include collecting and processing information about you that is publicly available as well as information that you have provided to us.  We may carry out this research ourselves or we may use a third party (see more about this below). If you do not want to be subject to this type of research, you can opt out of this at any time by following the steps set out in Managing the way we use your personal information.

How we use your information

In order to meet the purposes set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law

We will use your personal information to:

  • Correspond with you
  • Process your donation, or provide any other services you have requested from us
  • Inform you about University courses or events
  • Inform you about, and provide, friends benefits
  • Inform you about opportunities to engage with and support the University
  • Assist you in the event of an emergency
  • Comply with legislative reporting and recordkeeping requirements

How we share your information

We may need to share information to deliver the services you have requested from us, or to meet our legitimate interests, or to comply with government or regulatory requests or reporting requirements. Where we need to share information with an agency we have not anticipated here, we will only do so if required or permitted by law.

We may share your information with:

  • Your nominated financial institution for processing your donation
  • The public, where we publicly identify you as a donor
  • University owned or related entities
  • Contracted service providers which the University uses to perform services on its behalf (such as mailing house services, logistics and IT service providers), within and outside New Zealand (see more on this below)
  • In the event of an emergency, police, medical or hospital personnel, civil emergency services, your legal representative or any other person assessed as necessary to respond to the emergency
  • The University's legal advisers or other professional advisers and consultants engaged by the University
  • Government agencies, where permitted or required by law

Website


We collect and process personal information about users of our websites for the primary purposes of delivering any services or functionality requested by users and for improving the online experience for our users.

Our lawful basis for collecting and processing personal information in this way is to meet our legitimate interests, including making sure we can properly deliver online services.

The information we collect about website users

When you visit our websites and use any of our web-based services, the personal information we collect about you includes:

  • Computer's internet (IP) address
  • Your domain name
  • The date and time of your visit to the site
  • The pages you accessed and documents you downloaded, including on third-party sites that are affiliated with us
  • The site you visited immediately before you visited our site, that linked you to our site
  • The type of browser and operating system you are using
  • The username entered if accessing a restricted site

Cookies: We may use “cookies” to show you advertisements related to the University as you visit third party sites across the internet. A cookie is a very small piece of data that is sent to your browser from our web server and stored on your computer hard drive. The cookie is sent back to the server each time the browser requests a page from the server. The University does not collect any personally identifiable information through the use of cookies. Cookies cannot damage files, nor can they read information from the hard drive of a computer.

We rely on our own cookies and those of third parties such as Google. It is possible to disable the acceptance of cookies by your web browser. However, doing so may restrict your ability to access some web pages. You can also opt out of Google's use of cookies by visiting the Google advertising opt out page. Alternatively, you can opt out of cookies by visiting the Network Advertising Initiative opt out page.

How we use your information

In order to meet the purposes set out above, we will use your personal information in the ways set out below. We will generally only use personal information in these ways. Where we need to use information in a way we have not anticipated here, we will only do so if required or permitted by law.

We will use the information we collect about your use of our websites or web-based services to:

  • Provide you with a personalised online experience without requiring you to remind us of your preferences each time you return to our websites
  • Target our advertising using services such as Google Adwords and Google Analytics (this is a way for us to connect with visitors, based on their past interactions with the University’s websites)
  • Aggregate your interactions with us across the devices that you use to access our services, and
  • Analyse and optimise University websites and systems use and perform system administration tasks

We share the personal information we collect about website users only with the third-party service providers – such as Google – that provide us with advertising and other online services.

 

How we store and protect your personal information


Storage and retention

We may use third-party service providers to store your personal information and provide us with services. This means that we may transfer personal information, or access it from, countries other than New Zealand

We recognise that we are accountable for your personal information wherever it is in the world. Where we can, we will send personal information only to countries that have adequate privacy laws in place (such as New Zealand, Australia or the EU). However, where we cannot do this, we take reasonable steps to ensure that any third-party service providers we use can meet our privacy and security expectations

We retain your personal information only for as long we need it to perform our contractual obligations or meet our legitimate interests, or comply with our legal obligations, including the requirement to retain information in accordance with the Public Records Act 2005

Security

Wherever your personal information is stored, we take reasonable steps to ensure that it is protected against loss or unauthorised access, modification, use or disclosure. For example:

  • University systems are protected by firewalls and modern encryption standards
  • University systems are password protected, and access is monitored and audited
  • Credit card details for recurring payments or donations in a secure, encrypted format within a PCI compliant system
  • All employees are required to adhere to the University’s IT and Security related suite of policies
  • Access to the personal information we store is limited to those staff members who have a legitimate business requirement to use it
  • We make privacy and information security training available to employees
  • We have a data breach management procedure in place
  • Information is backed up regularly, and backups are encrypted ad held in secure storage facilities

Read the Information Technology Security polices.

Read the Information Technolgy policies.

Accessing and controlling your personal information


You have some important privacy rights, including the right to know what information we hold about you and the right to correct it. Sometimes, you can also ask us to delete or stop using your personal information in a particular way. You can exercise any of these rights by:

  • Calling us on +64 9 373 7999
  • Emailing us at privacy@auckland.ac.nz
  • Writing to us at Privacy Officer, The University of Auckland, Private Bag 92019, Auckland 1142, New Zealand

Please note that we need to take steps to make sure you are authorised to make requests about personal information, so we may need to verify your identity or authority before responding to your request. Once we’ve verified who you are, we’ll try to respond to your request or query as soon as possible, and no later than 20 working days after we receive it.

 

Getting a copy of your information


You have the right to request a copy of your personal information. We’ll be as open as we can with you but sometimes we might need to withhold personal information, for example where the information is legally privileged, commercially sensitive or includes personal information about other people. If we need to withhold information, we’ll tell you why.

Correcting or deleting your information


If you think any of the personal information we hold about you is wrong, you can ask us to correct it. Where we’ve retained your personal information for purposes that are not directly related to the performance of a contract or to our legitimate interests, you may be able to ask us to delete it, but note that we must retain certain information under the Public Records Act 2005.

If we can’t correct or delete your information (for example, where we don’t agree that it’s wrong, or we need the information for a lawful purpose), we’ll tell you why. You can ask us to attach your correction request to the information as a statement of correction.

Managing how we use your information


Where we’re processing your personal information on the basis of consent, you can revoke your consent at any time. Where we’re processing your personal information on the basis of our legitimate interests (such as improving our services), including automated processing, you can object to this. If you believe we’re using your personal information in ways that are unlawful, or if we’re continuing to use information that you think is inaccurate, you can ask us to restrict this processing.

Making a complaint


If you have any concerns about the way we’ve collected or processed your personal information, let us know, so we can try to put the matter right. If we can’t resolve your concerns, you can also make a complaint to the Office of the NZ Privacy Commissioner by: