No8HR is committed to protecting personal information and handling it in accordance with the Privacy Act 2020. This policy explains how we collect, use, share, store and protect personal information when providing recruitment, human resources, training and related services.

In this policy, No8HR, we, us and our mean No8 People Ltd, trading as No8HR.

Personal information we collect

The information we collect depends on how you deal with us. It may include:

• identity and contact details;

• curriculum vitae, work history, qualifications, licences, professional memberships, eligibility to work and other information relevant to recruitment;

• application forms, interview and assessment information, reference information and the results of role-relevant checks;

• information relating to workplace advice, employment processes, complaints, investigations, performance, conduct, health, wellbeing, injuries, health and safety or employee relations where we provide HR services;

• information about clients, suppliers, course participants and other business contacts;

• communications, enquiries, feedback and information you choose to provide; and

• technical information about use of our website and online services, such as IP address, browser, device and pages viewed.

We aim to collect only personal information that is reasonably necessary for a lawful purpose connected with our work.

How we collect personal information

We usually collect information directly from you, including through our website, candidate portal, applications, interviews, forms, email, telephone calls, meetings, training and the services we provide.

Where permitted by law, we may also collect information from:

• referees, former employers and recruitment or assessment providers;

• our clients and their employees, managers, advisers or service providers;

• background-check, qualification, licence or right-to-work providers;

• publicly available and professional sources; and

• another person or organisation authorised by you or permitted by law.

When we collect personal information about you from someone else, we will take reasonable steps to provide you with the information required by the Privacy Act, generally as soon as reasonably practicable after collection, unless you have already been made aware or another legal exception applies. This may include telling you that the information has been collected, where it came from, why we need it, who may receive it, who collected and holds it, and how you can access or correct it.

How we use personal information

We use personal information for purposes connected with our recruitment, HR consulting, training and related services. Depending on the nature of our relationship with you, this may include to:

• provide recruitment, HR consulting, training and related services;

• assess candidates and manage recruitment processes;

• communicate about applications, employment opportunities, services, events or training;

• provide advice and operational support to clients;

• manage client, candidate, supplier and other business relationships;

• operate, secure and improve our business, website, systems and services;

• respond to enquiries, complaints, disputes or legal proceedings; and

• meet our legal, regulatory, contractual and professional obligations.

We may use information for another purpose where you authorise us or where otherwise permitted by law.

Recruitment information

When we provide recruitment services, No8HR may hold candidate information for a particular vacancy and, where appropriate, for future employment opportunities.

We will ordinarily discuss an opportunity with you before identifying you to a prospective employer or providing your curriculum vitae. Information supplied to a client will be limited to what is reasonably relevant to the recruitment process.

Reference checks and criminal record, credit, qualification, licence, right-to-work or other checks will be undertaken only where lawful, genuinely relevant and reasonably necessary for the role. We will explain the proposed checks and obtain any authorisation required by law or reasonably appropriate in the circumstances.

Information handled while providing HR services

When providing HR or related services, we may collect, access or hold personal information for a client. In many cases, the client determines why and how the information is used, and No8HR handles it to provide the agreed services. In other cases, No8HR may hold information for its own lawful business, professional or legal purposes.

If you make a privacy request concerning client-related information, we will identify who holds the relevant information and either respond to the request or work with, or refer the request to, the appropriate client.

Who we may share information with

We do not sell personal information. Where reasonably necessary for the purposes described in this policy, or otherwise permitted by law, we may share information with:

• prospective employers and other clients;

• referees and people involved in a recruitment or employment process;

• technology, candidate-management, assessment, background-check, training and other service providers;

• professional advisers, insurers and auditors;

• government agencies, regulators, courts or law-enforcement bodies where permitted or required; and

• another person or organisation authorised by you.

Marketing communications

We may send you information about No8HR services, events, training or resources where you have asked to receive it or where otherwise permitted. You can unsubscribe from marketing communications at any time using the unsubscribe facility in the message or by contacting us. We may still send operational communications relating to services you have requested.

Website use, cookies and analytics

We use cookies and similar technologies to support website functionality, process enquiries, support candidate services and understand how visitors use our website. We may use website analytics and related tools to improve website performance, content and user experience.

Overseas providers

Some of our technology and service providers may store or process personal information outside New Zealand. Where a provider acts only on our behalf, we take reasonable steps to ensure appropriate contractual, technical and organisational safeguards apply. Where we disclose personal information to an overseas person or organisation for its own purposes, we will comply with Information Privacy Principle 12.

Security and retention

We take reasonable steps to protect personal information against loss, misuse and unauthorised access, use, modification or disclosure. These steps include limiting access to people who need the information and using appropriate systems, confidentiality requirements and security controls.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, complete recruitment or employment processes, consider future opportunities where appropriate, meet legal or contractual requirements and respond to disputes. When information is no longer required, we take reasonable steps to securely delete, destroy or de-identify it.

Access and correction

You may ask whether we hold personal information about you and request access to or correction of that information. We may need to verify your identity and may withhold information only where permitted by law. If we do not make a requested correction, you may ask us to attach a statement of correction to the information.

We will respond as soon as reasonably practicable and within the timeframe required by the Privacy Act, normally within 20 working days. In limited circumstances, we may extend that timeframe and will tell you if we do so.

Some evaluative material, such as information supplied under a promise that it or its source would be kept confidential, may be withheld where the Privacy Act permits. This is assessed case by case.

Privacy breaches

If a privacy breach occurs, we will promptly take steps to contain it, assess its impact, preserve relevant information and reduce the risk of harm. If the breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, unless an exception applies.

Contact and complaints

If you have a question, wish to access or correct your information, or want to make a privacy complaint, please contact our Privacy Officer Toni Trusler, No8HR, 303 Alexandra Street,Te Awamutu. Email: toni@no8hr.com  Phone: 07 870 4901

We will consider and respond to privacy complaints within a reasonable time. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

 Changes to this policy

We may update this policy when our practices, systems or legal obligations change. The current version will be available on our website.