Privacy Matatapu

Purpose

The purpose of this privacy statement is to let users of this website know when we collect personal information and what we may do with it. We do not use, share or disclose personal information collected or received through this website except as set out in this statement.

Scope

This privacy statement applies to personal information collected through the NZRIS website as well as personal information held, stored and/or presented on the NZRIS website provided by our data providers.

Voluntary disclosure of personal information

You may choose to voluntarily provide personal information through this website (for example, in the feedback form or when subscribing to news and updates). This information may be viewable by site administrators, our staff (as appropriate) and third-party contractors who may administer or work on the site.

Electronic alerts and newsletters

When you subscribe to one of our alerts or newsletters or submit a query or complaint, the details you provide may be stored in a secure third-party database (for example, Campaign Monitor). You will be asked to provide your name and email address so we can send you future electronic newsletters. When you unsubscribe to our alert or newsletter, your details will be deleted from the database.

Collection and use of personal information

You can use this website without disclosing any personal information, however we may ask or require you to provide some personal information when you complete an online form (for example, the site feedback form or when subscribing to news or updates).

We will only use personal information provided to us through this website for the purpose you provided it (eg, to administer, evaluate and improve the site, to improve our services, or to action or respond to the information provided). We may also use personal information provided to us through this website for other reasons permitted under the Privacy Act (for example, with your consent, for a directly related purpose, or where the law permits or requires it).

NZRIS may also collect personal information about you indirectly as part of data submitted by your associated research organisation or funding provider. We will use that information to link you to your funding and outputs of your research.

Holding of information

When you provide personal information, unless otherwise indicated, it will be held by us. It may be stored or accessed on behalf of us by authorised third parties (such as third-party contractors) to the extent that is necessary, for example for them to administrate or work on the site. We will store and keep your personal information secure in accordance with the Privacy Act 2020 and any agents will be subject to our information security and privacy requirements.

Disclosure of information Part 1 — website data

We will generally not share personal information that is collected through this website, unless it is necessary to do so for the purpose for which the information was provided (for example, to investigate a complaint) or where you consent. We will not otherwise disclose personal information provided or collected through this website unless required or otherwise permitted by law.

We do not generally provide any personal information about users of our website to third parties or other users. However, we may disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of NZRIS, or others.

Disclosure of information Part 2 — third party data

Personal data or information held in NZRIS that has been provided through its data providers with protection applied will not be shared or provided to third parties. In the event personal or protected information is requested or required under these circumstances NZRIS will refer the requestor to the provider of the data.

Records and retention of personal information

We will only retain personal information gathered through this website as long as it is required for the purposes for which the information may lawfully be used.

Personal information provided to NZRIS through its data providers will be held in line with the NZRIS data retention and disposal policy unless otherwise disputed by the owner of that data.

Withdrawing consent for holding personal information

By viewing and accessing the NZRIS website you consent to the collection of personal information as outlined in this privacy notice.

Where consent has been used as the lawful basis for processing your information, you have the right to withdraw this consent.

You can do this, by contacting the MBIE Privacy Officer using the details in the 'Your rights of access and correction' section of this privacy notice.

Alternatively, you can contact us at nzris@mbie.govt.nz.

Public records

Where any information provided (which may include personal information) to, or through, this site constitutes public records, it will be retained to the extent required by the Public Records Act 2005.

We may also be required to disclose information under the Official Information Act 1982 or to a Parliamentary Select Committee or Parliament in response to a Parliamentary Question.

Security

Our websites have security measures in place to prevent the loss, misuse and alteration of information under our control. To maintain the cyber security of our systems and information, our systems are subject to ongoing monitoring (including activity logging), analysis and auditing.

We may use information about your use of our websites and other IT systems to prevent unauthorised access or attacks on these systems or to resolve such events. We may use this information even if you are not involved in such activity.

We may use services from one or more third party suppliers to monitor or maintain the cyber security of our systems and information. These third party suppliers will have access to monitoring and logging information as well as information processed on our websites and other IT systems.

Security measures have been implemented to secure your personal information such as access control to prevent more employees than necessary accessing your personal information. All registrations are logged and we carry out security testing and quality testing of registered data systems.

Your rights of access and correction

With regard to personal information collected through the NZRIS website you have the right to:

• find out from us whether we hold personal information about you
• access that information; and, if applicable
• request corrections of that information.

With regard to personal information that is displayed on the NZRIS website which has been supplied through our data providers you have the right to:

• find out from us whether we hold personal information about you, and
• request corrections of information.

Corrections of personal information supplied through our data providers will need to be actioned by our data providers. Therefore, any approved corrections may take several working days to appear as amended on the NZRIS website.

Incorrect data held in datasets downloaded and stored offline by users will not be able to be corrected however will be amended if applicable in the live dataset versions

You may request a suppression of personal and/or sensitive information, if applicable. Under this occasion, NZRIS will direct you to (or facilitate communication between you and) the supplier of the data in order to address your request.

If we have a good reason for refusing a request for correction, you are entitled to request that a statement be attached to the information of the correction that was sought but not made.

If you want to check personal information that we hold, write to:

Privacy Officer
Ministry of Business, Innovation and Employment
PO Box 5488 Wellington 6011.

Alternatively, you can email your request.

Email: nzris@mbie.govt.nz

For more information on the privacy laws in New Zealand and contact details for the Office of the Privacy Commissioner, visit the Privacy Commissioner's website.

Collecting statistical information using cookies via Google Analytics

We may use cookies to gather data about trends in website usage using a tool called Google Analytics. This data will be viewable by website administrators and certain other staff. It may also be shared with other government agencies. This information is aggregated and it does not identify you personally.

Cookies

Browser or ‘web’ cookies are small text files that are sent by a website and stored on your computer's hard drive to collect information about how you browse the website.

Cookies are used to measure how you use the website so it can be updated and improved based on your needs remember the notifications you have seen so that we do not show them to you again.

You can read Google’s privacy statement at the Google Safety Centre.

You can manually disable cookies at any time. Check your browser's 'Help' to find out how (disabling cookies will not affect your ability to use this website).

Data collected may include:

• your IP address
• the search terms you used on this site
• the pages you accessed on this site and the links you clicked on
• the date and time you visited this site the referring site (if any) from which you clicked to reach this site
• the device you used to access this site
  your operating system, for example, Windows 10, Mac OS X
• the type of web browser you used to access this site, for example Internet Explorer, Google Chrome
• other things like your screen resolution, the release of your installed Flash version and the language setting of your browser.

Changes to this privacy notice

NZRIS reserves the right to make changes to this privacy notice at any time. You are encouraged to review new versions as they are published.

Current version: V.01

To obtain previous privacy note versions contact nzris@mbie.govt.nz. 

How to remove or change data about you

If you would like to request changes to data held in NZRIS or remove data held about you, email nzris@mbie.govt.nz.

Where is data stored

NZRIS data is stored within the NZRIS platform, which is delivered for the Ministry of Business, Innovation and Employment (MBIE) using the Symplectic Elements research information management system. The platform acts as the system of record for NZRIS data and supports the storage, management, and publication of research funding and activity information.

Data storage and hosting arrangements are managed as part of MBIE’s contractual and operational governance of the NZRIS service and are required to meet New Zealand Government information security and privacy requirements.

Statement about classification and security

NZRIS information is managed in accordance with the New Zealand Government Information Security Classification System and the New Zealand Information Security Manual (NZISM).

Data is classified based on the potential impact of unauthorised access, use, or disclosure, and appropriate controls are applied to protect confidentiality, integrity, and availability.

Protection settings applied to NZRIS data reflect both government security classifications and NZRIS specific protection requirements, ensuring that sensitive or restricted information is not publicly released while enabling appropriate sharing of publishable data. 

Data disposal policy

NZRIS data is retained and disposed of in line with MBIE’s approved records retention and disposal schedules and the requirements of the Public Records Act 2005. Retention periods depend on the nature of the data and its business, legal, or historical value.

When data reaches the end of its approved retention period, it is securely disposed of in a manner that prevents unauthorised recovery or reuse.

Disposal activities are undertaken in accordance with government approved information management and security practices.

Security assessments

NZRIS security controls are supported by MBIE's broader protective security framework and are subject to ongoing assurance processes. This includes alignment with the Protective Security Requirements (PSR), which require agencies to assess and report on their information, personnel, physical, and governance security controls.

Security assurance activities may include self-assessments, evidence-based reviews, and independent verification where appropriate, to ensure that risks are understood, managed, and addressed over time.