Privacy Statement

Direct collection from you

We may collect your personal information (as set out below) directly from you in a number of situations, for example when you fill in a form, phone or email us, come into or within the vicinity of an NZ Post store or delivery site, interact with our social media, or provide services to us. The table below sets out the main situations in which this may occur, the personal information we may collect, and the purpose for which it is collected:

The table above summarises the main circumstances in which NZ Post collects personal information directly from you and the purposes for which that information is used. NZ Post may also use the information set out above for customer support, quality assurance, staff training, investigations, safety and security activities, operational maintenance and improvements, development or improvement of products, processes and services, legal compliance and related business purposes as described elsewhere in this Privacy Statement.

Information collected indirectly

While we will usually collect your personal information directly from you, there are circumstances where we may collect personal information about you from third parties. The table below sets out the third parties from whom we may collect information about you, the personal information we may collect, and the purpose for which it is collected.

Note: The table above summarises the main circumstances in which NZ Post may collect personal information about you from a third party rather than directly from you. NZ Post may also use the information collected indirectly, for other purposes such as customer support, quality assurance, staff training, investigations, safety and security activities, operational improvements, product and service development, legal compliance and related business purposes as described elsewhere in this Privacy Statement.

In order to provide our products and services to you or provide our services generally, we may need to disclose your personal information to third parties, which includes organisations outside New Zealand (for example, when we deliver an international parcel for or to you).

We will only disclose information as authorised by law, such as:

• required for the purpose for which we collected the information (as set out in the section "Personal Information we collect and what we use it for" and those directly related
• to the extent we have notified you in this Privacy Statement of the relevant disclosure
• with your consent – your consent may be implied or express, written or verbal
• where required or authorised by law (e.g. disclosure to various government agencies such as the Inland Revenue Department, NZ Customs or disclosure to courts under subpoena)
• as a matter of contractual obligation for supplying services or products to you
• in the public interest (e.g. where a crime, fraud, or other illegal activity is committed or suspected and disclosure in the circumstances is justified)
• to third parties as required for the purposes set out in this Statement.

Third party disclosure

We make your personal information available to companies who perform services for us - such as specialist information technology companies, cloud service providers, mail houses or other contractors to NZ Post. In these circumstances, we require those companies to protect your personal information diligently. Strict contractual and other quality assurance measures are used to protect your personal information.

Some of these third parties will also be collecting your personal information from us, for their own purposes under their governing law e.g. Customs for maintenance of border protection, to produce anonymized or aggregated data.

Overseas use and disclosure

We may facilitate the transfer of personal information to countries outside New Zealand (for example when you send mail or parcels overseas). We will only do so in compliance with all applicable New Zealand privacy laws. If you engage in interactions in foreign jurisdictions (for example, purchase items overseas), resulting in the delivery of articles within New Zealand, our delivery of that item from the border to your address will comply with New Zealand privacy law.

In some instances, information (including personal information about you) may be transferred to, and held by, our service providers overseas.

Some administrative functions are provided to us by a third party service provider in the Philippines.

We will take reasonable steps to protect your personal information no matter what country it is stored or used in or transferred to. We have procedures and data transfer arrangements in place as appropriate to help ensure this. We do everything we reasonably can within our power to require that the service provider has reasonable security and data protection measures in place.

You have the right to access your personal information held by NZ Post, other than where there is an exception at law. You can request your personal information as set out below under ‘How to Contact Us’ at any time. Please identify, as clearly as possible, the type (or types) of information requested. The Privacy Officer will deal with your request within 20 working days (or otherwise in accordance with legislation). We reserve the right to charge you a fee for supplying this information to you.

Exceptions

Your right to access your personal information is not absolute. In some circumstances, the law permits us to refuse your request to provide you with access to your personal information. For example, where giving access to your information would have an unreasonable impact on the privacy of other individuals, or would pose a serious threat to the life, health or safety of any individual or to public health or public safety.

Updating your information

It is inevitable that some personal information which we hold will become out of date. We will take reasonable steps to ensure that the personal information which we hold remains accurate and, if you advise us of a change of details, we will amend our records accordingly.

Where your information has been disclosed to a third party, NZ Post will take reasonable steps to notify the third party of the correction.

Where we are unable to update your information, we will use reasonable endeavours to provide an explanation in writing as to why the information cannot be corrected, and (where possible) to note against your uncorrected personal information your request for correction.

We have responsibilities under New Zealand laws relating to privacy and information that governs how we collect, store, secure, correct, use and share your information. These laws include:

• The Information Privacy Principles contained in the Privacy Act
• Official Information Act
• Public Records Act

Storing your Personal Information

We use third party providers to store and process our data, as well as our own on-premise databases. We store most of the personal information we collect and generate electronically on Cloud Services for Government Services in New Zealand (DCSG), AWS Cloud or Azure Cloud (both located in Sydney, Australia).

We also use Microsoft Office 365 for our email and other office productivity applications. This means that the personal information we hold may be transferred to, or accessed from, countries other than New Zealand.

Most records we create are public records for the purposes of the Public Records Act 2005. We retain personal information in compliance with the requirements of the Public Records Act until we are authorised to dispose of it under the relevant disposal authority.

Information security

At NZ Post, we are committed to protecting and securing your personal information. We aim to store your information securely and in compliance with our obligations under the Privacy Act 2020. 

We understand that you may be concerned about the security of the personal information we collect from you online. Accordingly, we have systems in place which seek to ensure our online dealings with you are as secure as your dealings with us in person, or on the phone.

Our services are generally aimed at adults over 18 years of age but in the circumstances where children can access services, we aim to ensure that our privacy policies are written so that their caregivers can understand their charges’ rights.

See under ‘Personal Information we collect and what we use it for’ for specific information relating to the types of personal information collected for our Letters to Santa service and the purposes for which that information is used.

NZ Post is committed to working with our customers to ensure fair resolution of any privacy requests, concerns or complaints.

You can contact us about any privacy issue by emailing [email protected] or by writing to us at Private Bag 39990, Wellington Mail Centre, Lower Hutt 5045, New Zealand.

If your query relates to your information for your PO Box service, you can contact that team directly at the Box/Bag Services Centre, PO Box 39990, Wellington Mail Centre, Lower Hutt 5045, New Zealand.

Despite our every effort to protect your personal information, there remains the possibility that a privacy related incident could occur. In the event of loss or unauthorised disclosure or use of personal information, NZ Post will:

• seek to rapidly identify and secure the breach to prevent any ongoing breaches
• assess the nature and severity of the breach including the type of personal information involved and the risk of serious harm to affected individuals
• notify the affected individuals directly (if appropriate and possible)
• follow the Mandatory Breach Notification Process (if appropriate)
• engage the appropriate authorities where criminal activity is suspected
• put a notice on our website advising our customers of the breach (if appropriate).