1. Purpose
The purpose of this Policy is to set out how Channel Infrastructure NZ Limited and its subsidiaries (together, the Company) collect, use, and disclose Personal Information.
2. What is Personal Information
“Personal Information” is any information about an identifiable individual.
3. Application
This Policy applies to all Personal Information that the Company receives or holds. All individuals who have access to Personal Information held by the Company must comply with this Policy.
The Policy should be read in conjunction with any other applicable terms and conditions relating to an individual’s engagement with the Company, including any employment agreement or supplier or customer contract. By submitting any Personal Information to the Company, and/or performing, accessing or using any of the Company’s services, individuals acknowledge that they have been provided with access to this Policy and have had the opportunity to review it.
4. Key principles
The Company will collect, hold, use and disclose Personal Information in accordance with the Privacy Act 2020 and related regulations and codes of practice (Privacy Legislation) and this Policy.
The Company will only collect Personal Information if it is for a lawful purpose connected with the Company’s activities, and the information is necessary for that purpose.
5. Privacy Officer
The Company has a Privacy Officer who is responsible for all privacy-related matters, including:
- ensuring the Company complies with Privacy Legislation
- dealing with privacy-related requests made to the Company
- monitoring, managing and resolving any Privacy Incidents
- notifying the Privacy Commissioner about any notifiable privacy breaches and working with the Privacy Commissioner in relation to any investigations
The Head of Legal is the Company’s Privacy Officer. The Privacy Officer can be contacted at .
6. Types of Personal Information the Company collects and holds
The Company may collect and hold the following Personal Information, depending on the individual’s relationship with the Company (as an employee, customer, supplier, contractor, or other):
- Identification and contact information, such as full name (including any previous names), date of birth, gender, ethnicity, address, phone number, email address, emergency or next of kin contact details, and identification details (e.g. driver’s licence or passport).
- Employment related information, such as CV, information from nominated references, immigration or visa status (evidence of an individual’s right to work in New Zealand), employment or contractor agreements, remuneration and payroll information (including payslips and deductions), performance and disciplinary records, leave records, trade union membership, and results of any background, criminal history or credit checks.
- Bank and taxation details, such as bank account numbers, IRD numbers, KiwiSaver or superannuation details, and any other information required for tax or statutory deductions.
- Health and safety information, such as details of any disability, medical condition or injury that may affect an individual’s role or workplace health and safety obligations, workplace incident reports, and COVID-19 vaccination status or test results.
- Qualifications and credentials, such as academic or professional qualifications, trade certifications, industry memberships, certifications, licences, and other credentials relevant to an individual’s role or engagement with the Company.
- Training and induction records, such as records of training, onboarding or safety inductions completed.
- Visual or audio recordings, such as photographs, video footage (including CCTV), audio recordings, where collected in connection with security, events or workplace activities.
- Supplier and contractor information, such as contact details of key personnel, proof of insurance, records of safety or compliance audits, conflicts of interest disclosures, and other information required to assess or manage supplier performance, eligibility, or risk.
- Log and usage data, being service-related, diagnostic, usage and performance information the Company’s servers automatically collect when an individual accesses or uses the Company’s website and which the Company records in log files. Depending on how an individual interacts with the Company, this log data may include IP address, device information, browser type and settings and information about the individual’s activity in the website (such as the date/time stamps associated with usage, pages and files viewed, searches and other actions taken such as which features are used), device event information (such as system activity, error reports (sometimes called ‘crash dumps’) and hardware settings).
- Device data, such as information about an individual’s computer, phone, tablet or other device used to access the Company’s website. Depending on the device used, this device data may include information such as IP address (or proxy server), device and application identification numbers, location, browser type, hardware model Internet service provider and/or mobile carrier, operating system and system configuration information.
- Location data, including information about an individual’s device’s location, which can be either precise or imprecise. How much information the Company collects depends on the type and settings of the device used to access the Company’s website. An individual can opt out of allowing the Company to collect this information either by refusing access to the information or by disabling the Location setting on the individual’s device.
7. Embedded content
The Company’s website may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the same way as if the individual has visited the other website. These websites may collect data about an individual, use cookies, embed additional third-party tracking, and monitor an individual’s interaction with that embedded content, including tracking an individual’s interaction with the embedded content if they have an account and are logged into that website.
8. Methods of collection of Personal Information
The Company may collect Personal Information when an individual:
- accesses or uses the Company’s website, through cookies and similar technologies;
- communicates with the Company;
- attends the Company’s site;
- purchases goods or services from the Company;
- performs work at the Company’s direction;
- applies for employment with the Company and through the course of an individual’s employment with the Company.
This information may be collected directly from the individual, their business, through referrals or through CCTV cameras located around Company sites.
The Company may also collect Personal Information from other third parties, such as:
- related companies of the Company;
- publicly available sources of information;
- service providers who collect information on the Company’s behalf, including recruitment or temporary staffing agencies, background check providers, nominated referees;
- an individual’s authorised representatives or legal advisors;
- government agencies, including but not limited to the Accident Compensation Corporation, Ministry of Justice, and Ministry of Social Development.
An individual may choose not to share their Personal Information with the Company. In such cases, the Company may be unable to progress an individual’s application for employment, carry out business with the individual, or the Company may be delayed or prevented from fulfilling contractual or legal obligations.
If a person or organisation provides Personal Information about another individual, they are responsible for ensuring that they have the authority and consent of that individual to provide the Company with that Personal Information.
9. Use of Personal Information
The Company may use and disclose Personal Information for the following purposes:
- the specific purpose for which the Personal Information was collected;
- to assess an individual’s eligibility for employment at the Company;
- appointing, doing business with and using the services of third parties (including contractors, consultants, advisers, auditors and customers);
- processing business transactions, including sales and payments;
- managing its corporate strategies, including the sale or transfer of any the Company’s business or assets;
- employment related matters;
- internal administrative purposes (including internal investigations or disciplinary action);
- to maintain the security and operation of the Company’s website, and for internal analytics and reporting purposes;
- to monitor security at the Company’s sites;
- law enforcement and court proceedings;
- for statistical purposes, including for reporting on diversity, equity and inclusion;
- any other purpose required or permitted by Privacy Legislation or other applicable law.
Personal Information collected for a particular purpose will not be used for any other purpose unless permitted by law or one of the exceptions in Privacy Legislation applies.
The Company will take reasonable steps to check before using Personal Information that it is accurate, up to date, complete, relevant and not misleading.
10. Disclosure of Personal Information
The Company may disclose Personal Information if the disclosure is for one of the purposes for which it was originally collected or obtained, or the disclosure is directly related to the purposes in connection with which the information was collected or obtained. The Company may also disclose Personal Information in the following circumstances:
- the person concerned authorises the disclosure;
- the information is to be used in a way that does not identify the person concerned;
- disclosure is necessary to protect, or avoid endangering, someone’s health or safety;
- disclosure is necessary to uphold or enforce the law;
- as otherwise permitted by Privacy Legislation.
We may disclose Personal Information to:
- our staff and related companies for business and administrative purposes;
- Government agencies such as Accident Compensation Corporation, Inland Revenue Department and Ministry of Social Development;
- any service providers we have engaged to provide a service to us or on our behalf, including but not limited to IT service providers, payment processors, marketing and communications advisors, background check providers, and nominated referees;
- our professional advisors, including accountants, insurers, and lawyers;
- any other person or organisation to which we are authorised to disclose Personal Information.
The Company will take reasonable steps to check before disclosing Personal Information that it is accurate, up to date, complete, relevant and not misleading.
11. Storage of Personal Information
The Company will ensure that there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse or disclosure of Personal Information it holds. These include technical and organisational controls and tools such as access controls, encryption, monitoring systems, and firewall infrastructure.
Any person who deals with Personal Information held by the Company must ensure it is adequately protected at all times.
Personal Information will not be kept for longer than is required for the purposes for which it was collected. When the Company no longer requires Personal Information, it may permanently delete, destroy or dispose of it in a secure manner or permanently de-identify it.
12. Access and/or correction to Personal Information
If Personal Information held by the Company about an individual is not accurate, complete and up to date, the Company will take reasonable steps to correct the information.
Any individual may submit a request to the Company to access, correct or update their Personal Information. Company employees should contact their People Leader in the first instance for requests regarding their Personal Information.
Requests relating to Personal Information may also be directed to the Privacy Officer at .
The Company will respond to any such request within the timeframes specified in Privacy Legislation. The Company will provide a reason if it refuses a request for access to or correction of Personal Information. If the Company is not willing to correct errors that an individual has identified in their Personal Information, the individual may request that the Company take reasonable steps to attach a statement to the Personal Information noting the correction sought.
13. Complaints
Personal Information is collected and held by Channel Infrastructure NZ Limited, Marsden Point, Whangarei, New Zealand.
Any complaints about a breach by the Company of Privacy Legislation or concerns regarding this Privacy Policy should be directed to the Privacy Officer at .
If an individual is unhappy with the way the Company handles a complaint or a request to access information, that individual may contact the New Zealand Privacy Commissioner whose contact details are available at www.privacy.org.nz.
14. Updates
The Company may revise or update this Privacy Policy from time to time. Any changes will apply from the date the Company posts the updated Policy on its website. This Policy was last updated in August 2025.
