Privacy at the University of Otago

Our Privacy Statement

At University of Otago Ōtākou Whakaihu Waka we care about your privacy. We need to collect and use personal information about the people we deal with – students (including prospective students and students visiting from other institutions), alumni, donors, and users of our websites and applications – in order to meet our purposes. However, we know that we have a duty to care for that information, and use it lawfully, fairly and respectfully.

This Privacy Statement explains how we collect, store, use and share personal information and the rights you have in relation to your information. It operates in conjunction with any specific privacy notice or declaration made in connection with the collection by, or supply to, the University of individual items of information.

This Privacy Statement applies generally to our activities in all the countries we operate but, where necessary, we may expressly address the specific requirements of some overseas privacy laws, including the EU General Data Protection Regulation (GDPR) and the China Personal Information Protection Law (PIPL).

This Privacy Statement may be updated from time to time to reflect internal and external changes.

Collection of personal information

We collect personal information in the following ways:

• When you provide it to us directly (either yourself or via your nominated agent), for example during the pre-application, application and enrolment processes.
• We may collect personal information from third parties, for example where we need to verify previous study at other institutions.
• Personal information will be generated when you use our services, for example when you use our Wi-Fi network.

If you choose not to provide any of the personal information we ask for, it may not be possible for us to deliver the services you request from us. In some cases, the collection of personal information is required by law, such as the Education and Training Act 2020.

The personal information we collect about you will depend on your relationship with the University.

Information we collect about students

The personal information we collect about students includes:

• general details and identifiers (including name, former name, alias, gender identity, date of birth, and National Student Number or equivalent)
• contact details (including address, telephone, email, and emergency and alternative contact details)
• ethnicity information (including country of origin, ethnicity, and iwi affiliation)
• information about citizenship and residency status
• education record and academic/research history
• interactions and communications with us and our systems
• information about your study, including your programme and course details, academic achievement and any research or other assignments you complete
• feedback on courses you provide to us as part of a survey
• information about your suspension from any other New Zealand tertiary education provider
• photograph (for student ID cards), and
• any other information that you decide to share with us.

Depending on your programme of study, or use of specific services we offer, we may also collect:

• information about your areas of study interest
• passport and visa details
• information about your English language proficiency
• information about external scholarships or sponsorships
• health and disability information (if necessary to deliver services)
• career information (including your aspirations and relevant work history or experience)
• financial information (including information about payment for study, such as credit/debit card or bank account details, and in some cases creditworthiness information from credit reporters)
• social security information, including social security numbers
• criminal convictions (if necessary for certain programmes or work placements)
• information provided to us by organisations which you attend for the purpose of workplace learning (including in respect of your performance on your placement or practicum, and any health and safety incidents or other issues that occur during your placement or practicum)
• information provided through reference checking processes for accommodation or other benefits
• information about guardians and guarantors for the purposes of accommodation services
• health and travel insurance arrangements (including where you are an international student, or you are participating in field trips or student exchanges), and
• information generated by your use of services (including audio or video recordings of lectures, CCTV footage on our campuses, or information about your use of our Wi-Fi network).

Information we collect about alumni

The personal information we collect about alumni includes:

• general details and identifiers (including name, former name, alias, gender identity, date of birth, and National Student Number or equivalent)
• contact details (including address, telephone, and email)
• ethnicity information (if collected when you were a student)
• education record and academic history
• your associations with us if you were a student (including your hall of residence and club membership)
• interactions and communications with us and our systems
• responses to our electronic communications (including what you open or click on, any comments you make, and your location)
• events you have been invited to and whether or not you have responded or attended
• any people we link to you (including your spouse, partner or adult children, who are also alumni)
• links with other organisations and individuals
• employment and business details including positions, organisation, professional memberships and qualifications
• career highlights and other lifetime achievements
• outside interests and membership of groups
• media articles, and
• any other information that you decide to share with us.

Information we collect about donors

The personal information we collect about donors includes:

• general details and identifiers (including name, former name, alias, gender identity, and date of birth)
• contact details (including address, telephone, and email)
• ethnicity
• credit card details (if you have provided these to us)
• interactions and communications with us and our systems
• education record and academic history
• your associations with us if you were a student (including your hall of residence and club membership)
• responses to our electronic communications (including what you open or click on, any comments you make, and your location)
• events you have been invited to and whether or not you have responded or attended
• any people we link to you (including your spouse, partner or adult children, who are also alumni)
• links with other organisations and individuals
• employment and business details including positions, organisation, professional memberships and qualifications
• career highlights and other lifetime achievements
• outside interests and membership of groups
• wealth and philanthropic interests
• media articles
• donations of time, expertise or money (including to organisations other than us), and
• any other information that you decide to share with us.

Information we collect about users of our websites and applications

The personal information we may collect about users of our websites and applications includes:

• your IP and/or MAC address
• your domain name
• the address of your server
• type of browser and operating system you are using
• the date and time of your visit to our websites or applications
• the pages you access and documents you download
• the site you visited immediately before you visited our website, that linked you to our website
• access details for restricted websites
• information generated by cookies (see more below), and
• any information you choose to provide via online forms, surveys or other functionality.

A cookie is a small text file that is sent to your browser from our web server and stored on your computer hard drive. The cookie is sent back to the server each time the browser requests a page from the server. We rely on our own (first-party) cookies and third-party cookies, such as the Google Analytics cookie, to improve our services, enhance your online experience with us, maintain the secure connection between your browser and our servers while you are using our websites, and for marketing purposes.

We use Google Analytics Advertising Features, and information about users of our websites and applications – other than information provided in forms or surveys – may be provided to Google (as our data processor) for analytics, marketing and advertising purposes. See the section below on “Profiling, automated decision-making and marketing” for more information about this.

It is possible to disable the acceptance of cookies by your web browser. However, doing so may restrict your ability to access some web pages. You can also opt out of Google's use of cookies by installing the Google Analytics Opt-out Browser Add-on. Alternatively, you can opt out of cookies by visiting the Network Advertising Initiative opt out page.

Our purposes for collecting personal information

We collect the personal information outlined above for the purposes of carrying out our operations, functions and activities as a university – outlined below – and University staff and contractors will have access to personal information where reasonably required to achieve these purposes.

Profiling, automated decision-making and marketing

We analyse data, including personal information, to drive and improve many of our processes and services. We also use profiling and automated processing tools to assist us to make better decisions on some services (often driven by data analytics). However, we do not rely solely on automated tools to make any significant decisions about people.

We also use your information for marketing purposes, including to send you advertising, including online, via social media, mail, email or text message, and to provide you with ads that are more relevant to you.

• We use automated tools to target our advertising, using Google Analytics Advertising Features such as Google Adwords, Google Analytics, Google Signals (for users who have signed in using their Google accounts and enabled Ad Personalisation), and Google Display Network. This allows us to provide a better online experience and connect with visitors, based on their past interactions with the University’s social and digital platforms. You can opt out of many of these tools by installing the Google Analytics Opt-out Browser Add-on.
• With your consent, we use your email address to generate a Unified Identifier that allows us to target our advertising across the various devices you use, including connected TVs. Unified identifiers are used in advertising to help marketers and advertisers identify users across different devices and platforms. A Unified Identifier is a hashed unique identifier that is assigned to an individual user and can be used to track their behaviour across multiple devices, such as smartphones, tablets, laptops, and desktops. This allows advertisers to create a more complete picture of a user's interests and preferences, which can be used to deliver more relevant and personalised ads. Unified Identifiers also allow us to generate aggregated insights about our audiences, including in relation to their location and demographics, but these will not identify individuals.

Sharing of personal information

To meet the purposes outlined above, we may need to share personal information with third parties (external people or organisations). However:

• We will only share personal information with third parties where it is necessary for our purposes, or it is permitted or required by law (including the Privacy Act and Education and Training Act).
• We will only ever share the minimum amount of personal information needed to meet our purposes.
• Where the purposes permit, we will share only aggregated information (such as data about cohorts of students, not identifiable individuals).
• We will always ensure that appropriate privacy protections are in place for any personal information shared.

Sometimes, we may need to share information with a third party outside New Zealand (for example, for the purposes of assessment, moderation or supervision, or to facilitate a student exchange). We may also use third party service providers to store and process information in other countries (see “Storage and protection of personal information” below). When we do this, we take reasonable steps to ensure personal information is subject to protections equivalent to those required by the privacy laws we are subject to.

The third parties we may share personal information with include (note, many disclosures listed below relate only to students):

• the Ministry of Education (which will record information on the National Student Index, share information with the New Zealand Birth Register as part of an authorised information matching programme, and may share information with Stats NZ)
• other government agencies, including the Tertiary Education Commission, Inland Revenue, the Ministry of Social Development (including Work and Income New Zealand and StudyLink), Te Puni Kōkiri, Immigration New Zealand, the Ministry of Trade and Enterprise, Education New Zealand, and the New Zealand Qualifications Authority
• overseas government agencies, where required for student exchange or Study Abroad programmes or to facilitate a contractual arrangement, including the US Department of Education
• other tertiary education providers in New Zealand and overseas, including for the verification of academic records, to facilitate a joint venture or other contractual arrangement, or to facilitate a student exchange, Study Abroad, or short term placement
• relevant professional bodies, such as the New Zealand Education Council and the Medical Council of New Zealand
• agencies involved in quality assurance, course moderation or accreditation
• ranking and benchmarking agencies
• external agencies, such as former employers, secondary schools, other tertiary education providers, tertiary admission centres, and English language testing verification services, to verify your qualifications or experience
• agencies where you may be placed for workplace educational or vocational training or experience, such as student placements, voluntary workplace activities, internships, and industry experience
• service providers, including IT or data hosting providers (within and outside New Zealand)
• marketing service providers, such as Facebook, Google and The Trade Desk, so we can deliver personalised ads to you on various platforms and devices. This helps you see ads about things we think you will be interested in
• agencies that provide services related to your study, including Study Abroad providers, sponsors and scholarship providers, public transport operators, local government agencies, and agencies that provide discounts or benefits
• student associations and clubs, or alumni groups and societies
• on your graduation, the public via our online graduate database (which lists your name, qualification, and graduation date) and My eQuals
• the University's insurers, legal advisers or other professional advisers, and auditors
• the University’s subsidiaries and related entities, including University of Otago Holdings Limited, Otago Innovation Limited, University Union Limited, and Otago Foundation Trust
• where we have concerns about your health or wellbeing or the health or wellbeing of others as part of our pastoral care role we may share your personal information with your nominated emergency contact person, your family/whanau, your healthcare provider or other organisations we believe need to know to keep you and/or others safe, and
• in the event of an emergency (or if we have serious concerns about your wellbeing), police, medical or hospital personnel, civil emergency services, your legal representative or nominated emergency contact person, your embassy or consulate if you are a visiting student, or any other person assessed as necessary to respond to the emergency

Storage and protection of personal information

Personal information is held by (or on behalf of) the University of Otago. We store information electronically on University systems and, less often, in hard copy on University files. The University retains personal information only for as long as is necessary for the purposes outlined above, including in order to comply with the requirements of the Public Records Act 2005 and associated General Disposal Authority for New Zealand Universities.

In relation to both electronic and hard copy information, the University takes all reasonable steps to keep personal information safe and secure, and to protect it against loss or unauthorised access, modification, use or disclosure.

In some cases, personal information may be transferred, and held, by service providers (also referred to as “data processors”) in New Zealand and overseas (including for example, where it is stored using a cloud-based service). Where this occurs, the University will do everything reasonably within its power to ensure that the service provider also has reasonable security measures in place to protect the information.

Your rights in relation to your personal information

You have some important privacy rights, which are set out in the table below according to the region you are located at the time we collect personal information from you. To exercise any of these rights, please email the Privacy Officer at registrar@otago.ac.nz. We’ll respond to your request as soon as is reasonably practicable and no later than 20 working days after we receive it.