Privacy Statement

Our commitment

TuuTika Limited is committed to protecting the privacy of everyone we work with. We comply with the Privacy Act 2020 and the Information Privacy Principles (IPPs) it contains, in particular Information Privacy Principle 3A (IPP3A).

We collect only the personal information we need, we hold it securely, and we do not share it without telling you first, unless a specific legal exception applies. Where an exception applies, we will tell you what it is before we receive any information from you.

Information Privacy Principle 3A, your obligations as a client

IPP3A sits with the collector of personal information. When you engage TuuTika, you remain the collector of any personal information you hold about your employees, board members, or other individuals. TuuTika is not the collector of that information, you are.

This means that before you share any personal information about another person with us, you must first:

• Advise that person that you intend to share their information with a third party
• Tell them who that third party is, in this case, TuuTika Limited
• Tell them the purpose, for example, to obtain employment relations or governance advice
• Tell them what information you intend to share

You do not need to seek that person's consent, but you must notify them before sharing. There are exceptions to this obligation, and we will advise you of any applicable exception before we receive information from you. Do not assume an exception applies without checking with us first.

TuuTika will only become a collector of personal information where we specifically request it directly from an individual, for example, in the course of an independent investigation. In that situation, we will fulfil the IPP3A obligations directly with that individual before collecting anything.

What information we collect and why

The personal information we collect depends on the nature of the engagement. It may include:

• Contact information, name, email address, phone number, organisation, and role, collected to respond to your enquiry and manage the engagement
• Billing information, organisation name and billing address, collected to issue invoices and manage payment
• Employment matter information, details of employees, contractors, or other individuals relevant to the matter we are advising on, collected only as specifically requested and for the stated purpose
• Governance information, board composition, meeting records, or organisational documents, collected only as required for the specific advisory engagement

We do not collect personal information speculatively or in excess of what is required for the specific purpose.

How we use personal information

Personal information collected by TuuTika is used only for the purpose for which it was collected, unless:

• You have consented to a different use
• The different use is directly related to the original purpose
• We are required by law to use or disclose it
• A specific exception under the Privacy Act 2020 applies

We will not use personal information provided in the course of an advisory engagement for marketing, research, or any purpose unrelated to that engagement.

Who we share information with

TuuTika does not share personal information with third parties except in the following circumstances:

• With your consent, where you have specifically agreed to us sharing information with a named party for a stated purpose
• As required by law, where we are legally obligated to disclose information
• Professional referrals, where we refer you to another professional (such as a lawyer), we will confirm with you before sharing any identifying information

We will always tell you who we intend to share your information with, and why, before we share it, unless a legal exception applies, in which case we will advise you of that exception.

Storage and security

We take reasonable steps to protect personal information from unauthorised access, disclosure, or loss. Information is stored securely using password-protected systems. Physical documents containing personal information are held securely and disposed of appropriately when no longer required.

Personal information is retained only for as long as it is needed for the purpose for which it was collected, or as required by law. When information is no longer required, it is securely deleted or destroyed.

Your rights

Under the Privacy Act 2020, you have the right to:

• Ask whether we hold personal information about you
• Request access to personal information we hold about you
• Request correction of any personal information that is inaccurate or out of date
• Ask us to stop using personal information in a way that causes you harm
• Make a complaint to the Privacy Commissioner if you believe we have breached the Privacy Act 2020

To exercise any of these rights, contact us directly. We will respond within 20 working days as required by the Act.

Complaints

If you have a concern about how we have handled your personal information, please contact us in the first instance. We take privacy complaints seriously and will respond promptly.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:

• Website: privacycommissioner.govt.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz

Contact us about privacy

If you have questions about this statement or how we handle personal information, contact us directly:

• Contact us at tuutika.nz/contact