Privacy notice

Te Herenga Waka—Victoria University of Wellington cares about your privacy and wants to be open with you about what we do with your personal information.

On this page:

Purpose of this notice

Victoria University of Wellington (“we”, “us”, “our”) cares about your privacy and wants to be open with you about what we do with your personal information. This Privacy Notice describes how we collect, use, and share personal information and explains your rights in relation to those activities.

We must comply with the Privacy Act 2020, the Public Records Act 2005 and, if you are in the European Union, the General Data Protection Regulation (GDPR).

If you would like to get in contact with us, you can email us at privacy@vuw.ac.nz or call 0800 04 04 04.

COVID-19

Despite anything in this Privacy Notice, information collected in relation to contact tracing and vaccine verification will only be collected, held, used and disclosed in accordance with sections 34A and 34B of the COVID-19 Public Health Response Act 2020 We can not, and will not, collect, hold, use or disclose it for any other purpose.

Why do we collect your information?

We need to collect and process your personal information so that we can carry out our operations, functions and activities as a University and as an employer. These are our “purposes” or “legitimate interests” and include:

our learning, teaching, research and other educational activities;
our administrative, employment, and management activities;
the services and benefits that we provide (including through third parties);
communicating with you or with your emergency/alternative contacts;
our legal, regulatory and contractual obligations;
administering and delivering contracts you have with us (including Student Agreements, employment agreements and contracts for service);
monitoring, evaluating and improving our performance and effectiveness;
the recruitment, marketing and fundraising activities that we undertake;
providing a safe, secure and healthy environment;
providing an appropriate level of student support and pastoral care (including under the Education (Pastoral Care of Tertiary and International Learners) Code of Practice 2021;
sharing information with our staff and, where necessary, with third parties (see who will have access to your information? below);
ensuring we can comply with government requirements and expectations (including as to societal and other outcomes and in relation to emergency and public health measures);
promoting equity and diversity; and
maintaining an engaged community of students, staff, alumni, donors and other persons with a connection to us.

In some cases, collection of your personal information is required under New Zealand law (including the Education and Training Act 2020). Without your personal information, we may not be able to enrol you as a student, employ you as a staff member or provide services, benefits, and care to you.

How do we collect information?

We collect information about you in three ways:

Information that you provide to us

This includes information provided:

as part of our marketing, recruitment, enrolment, conferment and employment processes and operations;
when you register for, enrol at, or use our services and facilities;
when you register or attend events, functions and conferences;
when you participate in surveys and competitions;
through your discussions and interactions with us;
through your interactions, activities and communications on our systems;
when you apply to go on an exchange programme, field trip or work placement;
when you apply for a scholarship or award; and
if you make a donation or gift to us.

Information we automatically collect

This includes information collected:

through your use of our websites (including via cookies), emails, and other services and systems that we provide to you (including Wi-Fi, swipe card and our learning management systems); and
through CCTV footage and recording of lectures and seminars.

Information we collect from third parties

This includes information collected or provided:

from publicly available sources (including media articles, social media, company and charity filings, and the internet);
by relevant government or education agencies and providers (including the New Zealand National Student Index and the National Health Index);
by our recruitment agents;
by third parties that provide services to us or you (including employers, exchange partners, scholarship providers, and accommodation providers);
through reference or other pre-employment checking prior to employment or provision of a benefit;
by fellow students, family members, staff members, visitors to the University and other people who may provide us with information about you if and when they contact us (or vice versa);
by our photographers and videographers; and
by third parties with whom we also share information (see below).

What information do we collect?

Student

If you are a student (or prospective student), the information we collect includes your:

biographical details (including name, former name, alias, gender, gender identity and date of birth);
contact details (including address, telephone, email, and contact details for your next of kin or emergency/alternative contact);
education record and academic/research history;
citizenship or residency information;
country of origin and ethnicity (see Sensitive Information below);
iwi affiliation (if you are a Māori student);
National Student Number;
National Health Number;
COVID-19 vaccination status and any other information necessary for us to verify your COVID-19 vaccination status or the application of, or compliance with, a relevant health order, vaccine requirement, or vaccine exemption;
Health and wellbeing information (including as required under the Education (Pastoral Care of Tertiary and International Learners) Code of Practice 2021);
interactions and communications on our systems, or with us;
your location (including whether you are accessing our systems from on or off-campus and your location on campus);
device ID (when you use a device to connect to our systems);
whether you have been suspended from another New Zealand tertiary education institute;
your image (for example, through CCTV footage and for student ID cards);
your voice (through recording of lectures/seminars); and
other information that we request (for example, on our forms) or that you have decided to share with us.

In addition, depending on your programme of study or involvement with specific services that we offer, we could also collect information about your:

areas of study interest (if you are a prospective student);
passport and visa details;
English language proficiency;
health and disability information (where you have enrolled with Mauri Ora (our Student Health and Student Counselling Services), Disability Services, Accommodation Services or our recreation services, applied for a field trip, student exchange or study abroad programme, or you have otherwise consented to us collecting this information - see Sensitive Information below);
career information (including aspirations and relevant work history/experience);
financial information (including how you will pay for your studies, credit/debit card or bank account details, where you have provided these to us);
criminal convictions (if necessary for certain programmes or work placements – see Sensitive Information below);
information provided through reference checking processes for accommodation or other benefits;
health and travel insurance arrangements (if, for example, you are an international student or going on a field trip or student exchange); and
information about your child provided by you to our Early Childhood Centres (if you have enrolled your child in one of these Centres).

Staff member or Contractor

If you are a staff member, the information we collect includes your:

biographical details (including name, former name, alias, gender, gender identity and date of birth);
contact details (including address, telephone, email, and emergency contact details);
education record and academic/research history;
professional affiliations;
previous employment history (e.g. your CV);
bank account and tax information;
citizenship and passport details, and (where relevant) information on your entitlement to work for us in New Zealand;
criminal convictions, credit history and other pre-employment vetting and verification information (see Sensitive Information below);
country of origin and ethnicity (see Sensitive Information below);
iwi affiliation (if you are a Māori staff member);
health and disability information (see Sensitive Information below);
COVID-19 vaccination status and any other information necessary for us to verify your COVID-19 vaccination status or the application of, or compliance with, a relevant health order, vaccine requirement, or vaccine exemption;
interactions and communications on our systems, or with us;
your location (including whether you are accessing our systems from on or off-campus and your location on campus);
device ID (when you use a device to connect to our systems);
credit card details (where you have provided these to us);
your image (for example, through CCTV footage, and for staff ID cards and the staff directory);
your voice (through recording of lectures/seminars);
photograph (for staff ID cards and the staff directory);
information provided through reference checking processes;
Information about your child provided by you to our Early Childhood Centres (if you have enrolled your child in one of these Centres);
trade union membership (see Sensitive Information below); and
other information that we request (for example, on our forms) or you have decided to share with us.

If you are a prospective staff member applying for a position with us, or a contractor engaged (or seeking to be engaged) to provide services to us, the information we collect about you will include the categories of information described above that are necessary for us to consider and decide upon your application for employment, or to decide and manage your terms of engagement with us.

Alumni

If you are an alumni the information we collect includes your:

biographical details (including name, former name, alias, gender, gender identity and date of birth);
contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences);
education record and academic history (including your associations with us if you were a student – such as your hall of residence and club membership);
ethnicity (if we were required to collect this under New Zealand law from when you were a student – see Sensitive Information below);
COVID-19 vaccination status and any other information necessary for us to verify your COVID-19 vaccination status or the application of, or compliance with, a relevant health order, vaccine requirement, or vaccine exemption (only if we have requested this information and if you have provided it to us – for example, if you attend an event associated with us);
interactions and communications on our systems, or with us;
device ID (when you use a device to connect to our systems);
responses to our electronic communications (including what you open, any comments you make, and your location); and
events you have been invited to and whether or not you have responded or attended.

In addition, we could also collect information about your:

family details, including spouse/partner and children;
links with other organisations and individuals (including alumni, supporters and potential supporters);
business details including positions, organisation, professional memberships and qualifications;
career highlights and other lifetime achievements;
outside interests and membership of groups;
media articles; and
other information that we request (for example, on our forms) or you have decided to share with us.

Donor

If you are a donor, or a person we have identified as a potential donor, the information we collect includes your:

biographical details (including name, former name, alias, gender, gender identity and date of birth);
contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences);
COVID-19 vaccination status and any other information necessary for us to verify your COVID-19 vaccination status or the application of, or compliance with, a relevant health order, vaccine requirement, or vaccine exemption (only if we have requested this information and if you have provided it to us – for example, if you attend an event associated with us);
credit card details (if you have provided these to us);
interactions and communications on our systems, or with us; and
device ID (when you use a device to connect to our systems).

In addition, we could also collect information about your:

education record and academic history (including your associations with us if you were a student – such as your hall of residence and club memberships);
ethnicity – (see Sensitive Information below);
responses to our electronic communications (including what you open, any comments you make, and your location); and
events you have been invited to and whether or not you have responded or attended;
family details, including spouse/partner and children;
links with other organisations and individuals (including alumni, supporters and potential supporters);
business details including positions, organisation, professional memberships and qualifications;
career highlights and other lifetime achievements;
outside interests and membership of groups;
wealth and philanthropic interests;
media articles;
donations of time, expertise or money (including to organisations other than us); and
other information that we request (for example, on our forms) or you have decided to share with us.

Other Association with Us

If you have had an association with us (you may have studied here short term, taken part in an exchange, attended an event, enrolled your child in one of our Early Childhood Centres, or have some other association with us), the information we collect could include your:

biographical details (including name, former name, alias, gender, gender identity and date of birth);
contact details (including location, address, former addresses, telephone, email, social media and website links, contact preferences);
COVID-19 vaccination status and any other information necessary for us to verify your COVID-19 vaccination status or the application of, or compliance with, a relevant health order, vaccine requirement, or vaccine exemption (only if we have requested this information and if you have provided it to us - for example, if you attend an event associated with us);
information about your child provided by you to our Early Childhood Centres (if you have enrolled your child in one of these Centres);
interactions and communications on our systems, or with us;
device ID (when you use a device to connect to our systems);
links with organisations and individuals (including alumni, supporters and potential supporters);
business details including positions, organisation, professional memberships and qualifications;
credit card details (where you have provided these to us);
career highlights and other lifetime achievements;
outside interests and membership of groups;
media articles;
events you have been invited to and whether or not you have responded or attended;
donations of time, expertise or money (including to organisations other than us); and
other information that we request (for example, on our forms) or you have decided to share with us.

Who will have access to your information?

Our staff

Our relevant staff will have access to your personal information where they have a genuine need to do so for our purposes and legitimate interests (see Why do we collect your information? above). Wherever possible, we anonymise information so that you are not identifiable.

If you are a student, we will share your information (including information relating to your health and wellbeing) with appropriate staff members if we are concerned about your engagement, academic progress, behaviour, safety, security or wellbeing (or the safety, security or wellbeing of others) or under the Education (Pastoral Care of Tertiary and International Learners) Code of Practice 2021. Appropriate staff members could include, for example, student academic advisers, staff at Mauri Ora, Disability Services, Student Accommodation (including staff employed in our halls of residence), Student Interest & Conflict Resolution, specialist student support teams, and staff involved in issue and risk management.

Sometimes we may also need to share these concerns with appropriate third parties (for example, your next of kin or emergency contact person, police, law enforcement agencies or emergency services, or other relevant external support agencies (such as critical or emergency mental health services)). However, unless an emergency or other critical incident has occurred, we would usually only do this as a last resort (for example, if we were unable to contact you after a reasonable number of attempts or if our concerns were sufficiently serious to warrant it).

Third parties

Sometimes we will share specific categories of personal information with external people and organisations. However, we only do this where it is strictly necessary for our Purposes (see above) or it is permitted or required by law (including the Privacy Act 2020 and Education and Training Act 2020). We do not pass on all information that we collect – only the absolute minimum required in the particular context.

We also ensure that any information we share is used by the external person or organisation only for the purpose for which we shared it and, if possible, we anonymise information so that you are not identifiable.

We will not sell your information to anyone.

People and organisations we share specific categories of information with include:

New Zealand Government departments and agencies – including the Ministry of Education, the Tertiary Education Commission, the Ministry of Social Development (including Work and Income and StudyLink), the Ministry of Business, Innovation and Employment, the Inland Revenue Department, the Ministry of Foreign Affairs and Trade, the Ministry of Health and Primary Health Organisations (PHOs), Statistics New Zealand, Immigration New Zealand, the Accident Compensation Corporation, the Education Review Office, and the New Zealand Qualifications Authority;
Organisations responsible for public health requirements or responses;
My eQuals;
Local authorities – including the Greater Wellington Regional Council and the Wellington City Council;
Other education providers in New Zealand and overseas (including tertiary education institutions, schools and English language testing services);
Service providers contracted to the University (including third party accommodation providers);
Organisations that provide services related to your status as a student or staff member (including public transport providers, academic dress hire providers and organisations that provide discounts or benefits);
Law enforcement agencies and emergency services;
Professional registration agencies (e.g. the Education Council of Aotearoa New Zealand and New Zealand Law Society);
Organisations and individuals responsible for course moderation, accreditation or quality assurance;
Ranking and benchmarking agencies;
Employers and internship providers (only where you are undertaking a work placement as part of your programme of study);
Alumni groups, societies and organisations;
Scholarship or prize providers and sponsors (only if you have applied for, or been awarded, a scholarship or prize);
Social media – including Facebook (in order to provide targeted information on University programmes and events);
Our Iwi partners (only where you have identified an affiliation with a particular iwi);
Providers of StudentSafe insurance (only if you are an international student or are studying with us on an exchange);
Student associations and clubs;
Organisations and individuals involved in hosting events that you attend;
Your next of kin or emergency contacts (in an emergency or critical incident situation or if our concerns about your engagement, academic progress, behaviour, safety, security or wellbeing (or the safety, security or wellbeing of others) are sufficiently serious to warrant it;
Relevant support agencies (if our concerns about your engagement, academic progress, behaviour, safety, security or wellbeing (or the safety, security or wellbeing of others) are sufficiently serious to warrant it;
The agents and service providers that we have appointed to enable us to operate effectively (for example, organisations that provide us with IT or data hosting services);
Our subsidiaries, controlled or related entities (including the Victoria University of Wellington Foundation, the U.S. Friends of Victoria University of Wellington, and the UK Friends of Victoria University of Wellington, Victoria Link Limited (trading as Wellington Uni-Ventures), Wellington Uni-Professional Limited, and the Research Trust of Victoria University of Wellington); and
Our insurers, professional advisers and auditors; and
Other people or organisations with whom you have authorised us to share your information.

Sometimes, we may need to share information with a third party outside New Zealand (for example, if you are going on an exchange and we need to share information with your host university or you are studying under a joint programme arrangement with an overseas university). Where we do this, we comply with the requirements in the Privacy Act 2020 for cross border transfer of personal information.

How long do we keep personal information?

We retain your personal information for as long as is necessary for our Purposes and Legitimate Interests and for us to comply with our legal obligations and perform our contracts with you.

We are required under New Zealand law to retain information in accordance with the Public Records Act 2005. If you are in the European Union, please note that in some situations, this may conflict with your rights under the GDPR.

Additional Information

Profiling and Automated Decision Making

We may carry out profiling, analytics or tracking activities (including by automated means) to:

improve the quality of our teaching and learning activities;
measure space utilisation on campus, traffic flows, and attendance at our activities (including lectures and tutorials);
tailor support services and pastoral care for you;
support you in your learning and academic achievement; and
personalise our communications with you.

We do not engage in any form of profiling that would give rise to a claim of discrimination (including as defined in the Human Rights Act 1993).

We do not use solely automated processes to make any decisions that would affect you in any way.

Communications and Marketing

We will use your information to communicate with you and carry out our marketing activities. Generally, these communications would be by email, text message, post or telephone. You can unsubscribe from these communications at any time by clicking on the “unsubscribe” link in an email or by emailing privacy@vuw.ac.nz or phoning 0800 04 04 04.

We do not pass on your information to other organisations for their own communications and marketing purposes.

Graduation and Degree Information

We will publish your name, degree and year of graduation on our online roll of graduates, in our Council papers and in our graduation programme (where appropriate). We will also provide graduation and degree information to My eQuals.

If you do not want to be included in the online roll of graduates, please email graduation@vuw.ac.nz or call 0800 04 04 04.

Research activities

We may use information collected in order to conduct approved research activities (including surveys) and publish the outcomes. Where this includes personal information, any collection and use of this information will be in accordance with our Human Ethics Policy and Guidelines.

If you are asked to participate in a research project involving personal information, we will obtain your consent to any collection and use of that information. The information you provide will be used by the University strictly in accordance with your consent and any ethics approval.

Donor activities

We may carry out research to assess your likely ability and willingness to make donations or gifts to the University so that we can better tailor our fundraising approaches or requests. This research, which is sometimes known as prospect research, may include collecting and storing information about you that is publicly available as well as information that you have provided to us. We may carry out this research ourselves or we may use a third party. If we use a third party, we will ensure that your information is held confidentially, with appropriate security safeguards and only used in accordance with our strict instructions.

If you would not like us to carry out the above activities in relation to you, please email development-office@vuw.ac.nz or call 0800 04 04 04.

Alumni activities

We use your information to help us plan our alumni and donor activities and determine whether or not we should contact you in relation to particular communications or activities. This assists with ensuring that our communications and activities are relevant and of interest to you and ensuring our alumni are connected with the University.

If you would not like us to carry out the above activities, please email alumni@vuw.ac.nz or call 0800 04 04 04.

Sensitive Information

Under the GDPR, information relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, health, sex life, sexual orientation and criminal convictions is considered sensitive information.

Health information held by Mauri Ora (our Student Health and Student Counselling services) or Disability Services is managed in accordance with the Health Information Privacy Code and any specific Privacy Notice relating to that information. This Privacy Notice does not apply to that information.

We are required under New Zealand law to collect information relating to:

your racial or ethnic origin, as part of our admission and enrolment processes;
your criminal convictions, if you are being employed in a role covered by the Children's Act 2014;
COVID-19 vaccination status and any other information necessary for us to verify your COVID-19 vaccination status or the application of, or compliance with, a relevant health order, vaccine requirement, or vaccine exemption.

We also collect information relating to:

your racial or ethnic origin, for statistical purposes, the promotion of equity and diversity and to tailor support services;
your criminal convictions, as part of our pre-employment vetting processes and where you have applied for certain programmes (e.g. education and health);
your trade union membership information, to ensure that you are employed on the correct employment agreement; and
your health information, as part of our employment processes, where you have enrolled with Mauri Ora (our Student Health and Student Counselling services), Disability Services, Accommodation Services or our recreation services, applied for a field trip, student exchange or study abroad programme, or otherwise as required by the New Zealand Government (for example, for public health reasons). This helps us ensure we can provide a safe and healthy environment.

We do not collect any other form of sensitive information. However, if you or others have provided it to us, we may hold it in our systems.

If you are in the European Union, please note that some New Zealand law requirements regarding our collection of sensitive information may conflict with your rights under the GDPR and we are required to comply with New Zealand law. If you have any concerns about our collection of sensitive information, please email privacy@vuw.ac.nz or phone 0800 04 04 04.

ID numbers

If you are a student, alumni or a staff member, a unique identifier (in the form of a Student or Staff ID number) will be assigned so that we can carry out our purposes effectively and efficiently.

How do we keep your information secure?

We take all reasonable steps to keep your information safe and secure. In some instances, your personal information may be transferred, and held, by service providers in New Zealand and overseas (for example, where it is stored using a cloud-based service). Where this occurs, we do everything reasonably within our power to ensure that the service provider also has reasonable security and data protection measures in place. Like most organisations, we use a range of IT providers to provide services. We take reasonable care to select reputable IT providers to store and manage personal information.

We will not transfer your information to an overseas-based service provider or organisation unless we are satisfied that the service provider has obligations to protect your information in a way that is comparable to the protections afforded by New Zealand privacy law or you expressly consent to the transfer.

What are your rights?

You have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong (and you are unable to update it yourself through a relevant online service). If you would like to do this, please email privacy@vuw.ac.nz. You may need to provide specific details about the nature of your relationship with the University and the information you are seeking so that we can easily locate it for you.

We'll respond to your request as soon as reasonably practicable and no later than 20 working days after we receive it.

You also have the right to make a complaint to us, or the Office of the Privacy Commissioner if you think we have breached, or may have breached, your privacy. You can make a complaint to us by emailing privacy@vuw.ac.nz, or you can contact the Office of the Privacy Commissioner at www.privacy.org.nz.

In addition, the GDPR gives you the right to:

withdraw consent, where consent is the legal basis for our processing of your information;
be forgotten, that is request your information be removed from systems that we use to process your personal information. However, under New Zealand law, we are required to retain certain information under the Public Records Act 2005;
request copies of your personal information in a structured, commonly used and machine-readable format and/or request us to transmit this information to another person (where this is technically feasible);
restrict our processing in certain ways;
object to certain processing activities by us; and
make a complaint to a supervisory authority.

Other privacy notices

On occasions, we may supplement this privacy notice with other specific privacy notices. Those specific privacy notices apply in addition to this privacy notice.

We may also make available to you services provided by third parties. For example, the Office 365 suite and Blackboard. When you use these services, the service provider may collect personal information from you in accordance with its own privacy notice. The service provider may share some or all of that information with us; we will hold personal information shared with us in accordance with this privacy notice but otherwise the service provider’s privacy notice applies to personal information collected by these third party services.

Last updated 14 December 2021