PRIVACY NOTICE

Last updated: 18 October 2021

The Sport and Recreation Complaints and Mediation Service (operated by Immediation New Zealand Limited) (referred to as "SRCMS", "we", "us" or "our") is an independent dispute resolution service for sport and active recreation across Aotearoa New Zealand (the Service). In this privacy notice (Privacy Notice) we inform you of how we will process your Personal Information and the measures and processes we have put in place to ensure its adequate protection.  In the course of our business we may need to gather and use information about you from which you can be identified or are reasonably identifiable, such as your name, and contact details (Personal Information).  This Privacy Notice applies to all Personal Information that we collect in the course of operating the Service.  Immediation New Zealand Limited is a member of the Immediation Group (which includes Immediation New Zealand Limited's related companies), that operates an online dispute resolution platform and associated services (the Platform).  The privacy notice applicable to the operation of the Platform is available at https://www.immediation.com/privacy, and will apply to Immediation New Zealand Limited's other business. In using or participating in the Service you consent to the collection, use, disclosure and transfer of your Personal Information as set out in this Privacy Notice.

Our Privacy Notice consists of:

In this Privacy Notice, by "processing", we mean the collection, recording, storage, use, disclosure and any other form of operations or dealings with your Personal Information.

GENERAL PRIVACY INFORMATION

  1. TYPES OF INFORMATION COLLECTED
  1. We only collect Personal Information to the extent that this is reasonably necessary for one or more of our functions or activities.  
  2. We collect the name and contact details (phone number, address, email) of our users, job applicants, contractors and others.  Other Personal Information that we may collect includes, but is not limited to:
  1. if you use the Service and/or our SRCMS website: your display name, job title, information about you relating to the relevant complaint, dispute or matter and other content, files, links, feedback and information that you upload or share via the Service or otherwise provide us while interacting with our business (including any call recordings);
  2. if you apply for a role with SRCMS or as a contracted mediator or investigator: your qualifications, experience, your curriculum vitae, your education, professional memberships and employment history.
  1. We may also collect other information relating to you from third parties, including if a user of the Service or our websites provides us with any content or information relating to you.
  2. It is possible that we will collect Sensitive Information about you in the course of performing our services.  "Sensitive Information" includes health information and information about a person's racial or ethnic origin, political or philosophical beliefs or affiliations, trade or professional affiliations, sexual preferences or practices, or criminal record.  We do not collect Sensitive Information unless it is provided by you or a third party.
  1. METHOD OF COLLECTION
  1. Our preference is to collect Personal Information about an individual directly from that individual unless it is unreasonable or impracticable for us to do so.
  2. Information will generally be collected from the following sources:
  1. directly from you, including via the Service, or our websites, and social media profiles or through your other interactions with us (e.g. by phone or email).  You may wish to provide us with Personal Information concerning other individuals when you use the Service.  If you provide us with information about any other individual, where reasonably practicable, you should obtain that person's consent to give us the information and inform them of this Privacy Notice;
  2. from other users or potential users of the Service, or our website and other services, for example when they nominate you as an authorised user, make an allegation, complaint or claim in relation to you, or upload or share content through the Service that includes information about or allegations against you;
  3. from other members of the Immediation Group, for example where you use the Platform; and
  4. from third party services used in connection with the provision of the Service and our other services, for example if you use the Whispli platform in connection with any Matter.
  1. PURPOSES OF COLLECTION, USE AND DISCLOSURE
  1. We collect, use and disclose your Personal Information to enable you to use the Service to operate our business and to comply with applicable laws.  Other purposes for which we may collect, use or disclose your Personal Information include:
  1. providing you, your organisation or your employer with our services, including enabling users to conduct and participate in mediations, conferences and other instances of dispute resolution or investigations (Matter); to personalise your experience; and to connect you with other persons, including users participating in your Matter and our panel mediators and investigators;
  2. communicating with you, including communicating with you about your enquiry, complaint, dispute or matter, the Service; responding to any enquiries, questions, requests or complaints that you have made; and providing you with relevant information and support;
  3. operating our business, including to provide early facilitation services and to facilitate the appointment of mediators and investigators and to provide training to our staff;
  4. for administrative and security purposes, including for administrative purposes in relation to confirming your identity and the security and access of our systems, premises, platforms and secured websites; for fraud and crime prevention and detection purposes; for the safety of any individual; to recover any payments due to us and enforce such recovery through engagement of debt collection agencies; and in connection with the acquisition, merger or sale of any part of our business;
  5. complying with applicable laws, including to comply with our legal and regulatory obligations and requests in New Zealand and anywhere in the world, including reporting to and/or being audited by national and international regulatory bodies; and to comply with court orders and exercise and/or defend our legal rights; and
  6. any other lawful purposes, including for any other purpose that you have consented to; for any other legitimate business purpose; and as otherwise permitted or required by any applicable law or regulation.
  1. If you do not provide us with the required Personal Information, you may not be able to use or fully utilise the Service.
  2. We will not disclose details of a complaint to any person without your consent other than in extreme circumstances.  Extreme circumstances includes where the disclosure is required by law or where the disclosure is permitted under applicable laws and the disclosure is reasonable in the circumstances (e.g. where there is an imminent and serious risk to the safety of a known person).
  1. DIRECT MARKETING AND OTHER COMMUNICATION FROM US

We do not use or disclose Personal Information that we collect about you in relation to the Service to engage in direct marketing.  However, if you also use the Platform for your matter, please refer to the Immediation Group privacy notice available at https://www.immediation.com/privacy which describes the circumstances in which we may use your Personal Information in connection with direct marketing.

  1. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?
  1. We do not and will not sell, rent out or trade your Personal Information.  We will only disclose your Personal Information in the ways set out in this Privacy Notice and, in particular, to the following recipients:
  1. to any member of the Immediation Group, including their respective employees, officers, insurers, professional advisers, agents, and contractors;
  2. to other persons using the Service and our other services or otherwise involved in or connected with your Matter, with your express or implied consent or where required by law;
  3. to Neutrals and other third party external advisors or experts engaged in relation to a Matter, with your prior consent, such as mediators;
  4. to third parties who process your Personal Information on our behalf (such as our systems providers, cloud service providers, debt collection agencies and document management system providers);
  5. to third party service providers, contractors and advisors in the course of delivery of the SRCMS, in accordance with the Guidelines, including where applicable, FairWay, EAP Services, Safeguarding Children NZ, Tutira Mai and Incident Response;
  6. to any third party to whom we assign or novate any of our rights or obligations;
  7. to any prospective buyer in the event we sell any part of our business or assets; and/or
  8. to any government, regulatory agency, enforcement or exchange body or court where we are required to do so by applicable law or regulation or at their request; and/or
  9. to other persons or bodies, to the extent required by applicable law or regulation.
  1. STORAGE OF DATA AND OVERSEAS DISCLOSURE
  1. We, including our subcontractors, may hold electronic records of your Personal Information using cloud technology or by other electronic means, or in paper form.  These means of holding Personal Information may include offshore storage.  
  2. There is the potential for Personal Information to be shared outside of your country, including where you are using the Service and our other services to communicate and share content with persons outside of your country.  Your Personal Information may be stored or otherwise processed in locations including Australia, New Zealand, the UK, the USA, Germany, or any other country where a user you are communicating and sharing content with is based.  It is not practicable for us to specify in advance the location of every service provider or user with whom we deal.
  1. HOW LONG WILL WE HOLD YOUR PERSONAL INFORMATION FOR?

We will only retain your Personal Information for as long as reasonably necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements.

  1. DATA SECURITY
  1. We are committed to safeguarding and protecting Personal Information and will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to protect any Personal Information provided to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Information transmitted, stored or otherwise processed.
  2. We will also take steps as are reasonable in the circumstances to destroy or de-identify Personal Information as soon as reasonably practicable once we no longer need it for any purpose for which the information may be used, disclosed or retained for the purposes described in this Privacy Notice.  However, when using the Service or our websites you should be aware that no data transmission over the Internet can be guaranteed as totally secure.  Although we strive to protect such information, we do not warrant the security of any information that you provide us over the Internet and you do so at your own risk.
  1. THIRD PARTY SITES

If you link to or use other websites, services or software, please review the privacy policies posted at those websites.  This Privacy Notice does not apply to, and we are not responsible for, any third party websites which may be accessible through links from our websites.  If you follow a link to any of these third party websites, they will have their own privacy policies and you will need to check these policies before you submit any Personal Information to such third party websites.

  1. TRACKERS

We do not track you when you use the SRCMS website.  However, if you also use the Platform, please refer to the Immediation Group privacy notice available at https://www.immediation.com/privacy for further information about how we use cookies and other trackers on our Platform, websites and applications.

  1. CHANGES TO OUR PRIVACY NOTICE
  1. We may change or update parts of this Privacy Notice, including to maintain our compliance with applicable laws and regulations or following an update to our internal practices.  We will do this by updating this Privacy Notice on https://www.sportsmediationservice.org.nz/privacy-policy.  You may obtain a copy of our current notice from the SRCMS website or by contacting us via the details in paragraph ‎14.  
  2. If the proposed modification will result in a material change to this Privacy Notice, we will use reasonable endeavours to provide you with written notice of the change.  Except where required by law, you may not be directly notified of other changes to this Privacy Notice.  Please ensure that you regularly check this Privacy Notice so you are fully aware of any changes or updates.
  1. ACCESS, CORRECTION AND FURTHER INFORMATION
  1. We will take such steps as are reasonable in the circumstances to ensure that the Personal Information which we collect from you remains accurate, up to date and complete.  
  2. We will provide you with access to your Personal Information held by us unless we are permitted under the applicable privacy and data protection laws to refuse to provide you with such access.  Please contact us via the details in paragraph ‎14 if you:
  1. wish to have access to the Personal Information which we hold about you;
  2. consider that the Personal Information which we hold about you is not accurate, complete or up to date; or
  3. require further information on our Personal Information handling practices.
  1. There is no charge for requesting access to your Personal Information but we may require you to meet our reasonable costs in actually providing you with access.  
  2. If you consider that the information which we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, we will take reasonable steps, consistent with our obligations under the applicable privacy and data protection laws, to correct that information if you so request.  
  3. We will respond to all requests for access and/or correction within a reasonable time.
  4. Please note that we will not provide you with access to the identity of another party to any Matter or other details relating to the Matter that have not been provided by you, except in extreme circumstances (as described paragraph 3(c) above).  
  1. COMPLAINTS
  1. If you have a complaint or inquiry about the way in which we have handled any privacy issue, please advise us via the details in paragraph ‎14.  We will use reasonable efforts to deal promptly with complaints and inquiries and, in any event, acknowledge your complaint or inquiry within 30 days.  
  2. If you are not satisfied with how we manage your complaint, you may contact:
  1. if you are based in Australia, the Office of the Australian Information Commissioner, which can be contacted at GPO Box 5218 Sydney NSW 2001 or oaic.gov.au;
  2. if you are based in New Zealand, the Privacy Commissioner, which can be contacted at PO Box 10 094, Wellington 6143;
  3. if you are based in the UK, the Information Commissioner's Office, which can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF;
  4. if you are based in the European Economic Area (EEA) or Switzerland, the competent supervisory authority; or
  5. if you are based outside of the areas referenced above, the local privacy regulator or privacy commissioner in your location.
  1. CONTACT INFORMATION

Our Data Protection Officer may be contacted at:

Attention:         The Data Protection Officer

Mail:         Immediation Platform Pty Ltd
Chifley Tower, Suite 1904, Level 19, 2 Chifley Square,
Sydney, NSW, 2000

Email:                 privacy@immediation.com

SPECIFIC PRIVACY INFORMATION FOR AUSTRALIA

If you are in Australia, the following additional information is relevant to how we handle your Personal Information.

  1. EMPLOYEE RECORDS

In accordance with the Privacy Act 1988 (Cth), this Privacy Notice does not apply to our acts and practices directly related to a current or former employment relationship between us and an employee, and an employee record held by us relating to the employee.

SPECIFIC PRIVACY INFORMATION FOR NEW ZEALAND

If you are in New Zealand, the following additional information is relevant to how we handle your Personal Information.

  1. YOUR RIGHTS IN RELATION TO THE PERSONAL DATA WE COLLECT
  1. If you wish to update, modify or obtain a copy of the Personal Information that we hold on you, you can request this by emailing us at the address set out in paragraph ‎14 above. We endeavour to respond to such requests within 20 working days or less, although we reserve the right to extend this period for complex requests.
  2. As referenced in paragraph 12(f) above, we will not provide you with access to the identity of another party to any Matter or other details relating to the Matter that have not been provided by you, except in extreme circumstances.
  1. STORAGE OR DISCLOSURES OUTSIDE OF NEW ZEALAND
  1. Your information will be collected by:
  1. Immediation New Zealand Limited located at 2 Commerce Street, Auckland CBD, Auckland 1010, New Zealand; and
  2. Immediation Platform Pty Ltd located at Chifley Tower, Suite 1904, Level 19, 2 Chifley Square, Sydney, NSW, 2000.
  1. Your Personal Information may be disclosed, accessible from, and/or stored at, a destination outside of New Zealand, in which privacy and data protection laws may not provide comparable safeguards to those in the Privacy Act 2020 (NZ Privacy Act).
  2. Where your Personal Information is disclosed outside of New Zealand, we will ensure that your personal information is protected in a way that overall, provides comparable safeguards to those in the NZ Privacy Act, usually by entering into contractual arrangements with the recipient of your Personal Information.  

SPECIFIC PRIVACY INFORMATION FOR EEA, SWITZERLAND AND UK

If you are in the EEA, Switzerland or the UK, the following additional information is relevant to how we handle your Personal Information.

  1. FAIR AND LAWFUL PROCESSING
  1. Under applicable EU and UK data protection laws we are required to have a "lawful basis" to collect and use your information.  We will only process your Personal Information, where we are able to rely upon the following lawful bases:
  1. you have given your consent to such processing (which you may withdraw at any time, as detailed at paragraph ‎19 below);
  2. the processing is necessary to perform our contract with you to enable you to use the Service and receive our other services;
  3. the processing is necessary for compliance with our legal obligations; and/or
  4. the processing is necessary for our legitimate interests or those of any third party recipients that receive your personal data (as detailed in paragraphs ‎3 and ‎5 above).
  1. If you have consented to our use of your Personal Information about you for a specific purpose, you have the right to change your mind and withdraw your consent at any time, but this will not affect any processing that has already taken place.  Where we are using your Personal Information because we or a third party (such as your employer) have a legitimate interest to do so, you have the right to object to that use; however, this may mean you can no longer use the Service or our other services.
  1. YOUR RIGHTS IN RELATION TO THE PERSONAL DATA WE COLLECT
  1. Under applicable EU and UK data protection laws, you may have certain legal rights in respect of your Personal Information, such rights include:
  1. To request access to your Personal Information.  This is commonly known as a ’data subject access request’.  This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it.  As referenced in paragraph ‎12, we will not provide you with access to the identity of another party to any Matter or other details relating to the Matter that have not been provided by you, except to the extent required by law.
  2. To request correction of your Personal Information.  This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
  3. To request erasure of your Personal Information.  This enables you to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it.
  4. To object to processing of your Personal Information.  This applies where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your individual rights and freedoms.  In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
  5. To request restriction of processing of your Personal Information.  This enables you to ask us to suspend the processing of your Personal Information in the following scenarios: (A) if you want us to establish the data's accuracy; (B) where our use of the data is unlawful but you do not want us to erase it; (C) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; (D) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
  6. To request the transfer of your Personal Information to you or to a third party.  We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format (if feasible).  Note that this right only applies to automated information which you initially provided consent for us to use or where you provided the information to us to perform a contract with you.
  7. To request that we cease or not begin processing your Personal Information for direct marketing purposes.  Where we are processing your Personal Information for direct marketing purposes, you have the right to notify us in writing requesting that we cease or do not begin processing your personal data for direct marketing purposes.
  8. To object to a decision made about you based solely on automated processing.  This applies if the decision is made solely by automated means (without human involvement).  You will be notified when decisions are made solely on an automated basis.
  9. To withdraw consent at any time where we are relying on consent to process your Personal Information.  If you withdraw your consent, we may not be able to provide certain products or services to you.  We will advise you if this is the case at the time you withdraw your consent.

If you would like to exercise any of your information rights, please email us at: privacy@immediation.com.

  1. In any of the situations listed above, we may request that you prove your identity by providing us with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorised disclosure of data.
  2. We reserve the right to charge you a reasonable administrative fee for any manifestly unfounded or excessive requests concerning your access to your Personal Information, and for any additional copies of the Personal Information you request from us.
  3. You are entitled to lodge a complaint with our data protection regulator if you consider that we have breached your data protection rights.
  1. STORAGE OF DATA AND OVERSEAS DISCLOSURE OUTSIDE OF THE UK, EEA AND SWITZERLAND
  1. The Personal Information we collect from you may be transferred to (including accessed in or stored in) a country or territory outside the UK, the EEA and Switzerland including to countries whose laws may not offer the same level of protection of personal data as are enjoyed within the EEA, the UK and Switzerland.
  2. Regardless of the location of our processing, we will impose the same data protection safeguards that we deploy inside the EEA, the UK and Switzerland and implement appropriate measures as required by applicable data protection laws to ensure that your Personal Information is protected.  
  3. Where a third party service provider processes the Personal Information of EEA, Swiss or UK residents on our behalf, we will ensure that appropriate measures are in place to ensure an adequate level of protection for your Personal Information, including EU standard contractual clauses in our agreements with such third party service providers and other contractual and technical measures.
  4. For further information about the measures we rely on, please contract privacy@immediation.com.

SPECIFIC PRIVACY INFORMATION FOR CALIFORNIA

For California residents only: If you are a resident of California, the following additional information is relevant to how we handle your Personal Information.

  1. APPLICATION TO CALIFORNIA RESIDENTS
  1. This portion of our Privacy Notice advises California residents of rights provided in the California Consumer Privacy Act (the CCPA) and how California residents may exercise those rights.  The CCPA currently exempts personal information reflecting a written or verbal business-to-business communication (B2B Personal Information) from certain of the law's requirements, and also currently exempts Personal Information collected and used about a natural person acting as a business's employee or contractor (Personnel Information). The rights described below may not apply to B2B Personal Information or Personnel Information.
  2. If you are a California resident, you may request certain information from or certain action by us, such as exercising the access and deletion rights described below, or you may authorise an agent to make such a request on your behalf.  We will seek to verify your identity and your agent's authority when we receive an individual rights request from you or on your behalf to ensure the security of your Personal Information, and may need to collect additional Personal Information to do so.
  3. Please direct any such rights requests (as further described below) or additional questions that you may have regarding this Privacy Notice to: privacy@immediation.com.
  1. YOUR RIGHTS UNDER THE CCPA
  1. Under the CCPA and other Californian privacy requirements, California residents may have the following rights:
  1. Right to Know – you may request that we disclose to you details about how we have collected, used, shared and sold your Personal Information in the 12 month period preceding your request, including:
  1. the specific pieces of Personal Information we have collected about you;
  2. the categories of Personal Information we have collected about you;
  3. the categories of sources of the Personal Information;
  4. the categories of Personal Information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
  5. the categories of Personal Information we have sold about you (if any), and the categories of third parties to whom the information was sold; and
  6. the business or commercial purposes for collecting or, if applicable, selling the Personal Information;
  1. Right to Delete – California residents have the right to request the deletion of their Personal Information, but some or all of such Personal Information may need to be retained, as required or permitted by applicable law, such as if the requested information is necessary to:
  1. complete your transaction;
  2. provide you with a good or service;
  3. perform a contract between us and you;
  4. protect your security and prosecute those responsible for breaching it;
  5. fix our Services in the case of a bug;
  6. protect the free speech rights of you or other users;
  7. comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
  8. engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws;
  9. comply with a legal obligation; or
  10. make other internal and lawful uses of the information that are compatible with the context in which you provided it;
  1. Right to Opt-Out of Sale – If a business sells Personal Information, you have a right to opt-out of that sale.  We do not, and do not intend to, sell the Personal Information of California residents and, furthermore, do not have actual knowledge that we sell the personal information of consumers under 16 years old; and
  2. Right to Non-Discrimination – we will not, and are not permitted under the CCPA to, discriminate against you for exercising any of your CCPA rights, such as the access and deletion rights described above.
  1. Under California's "Shine the Light" law, you have a right to know how your information is disclosed to third parties for their direct marketing purposes under California's "Shine the Light" law (Cal. Civ. Code §1798.83).
  2. To exercise your rights, please contact us by emailing us at the address set out in paragraph ‎‎14 above.  We will respond to your request within 45 calendar days, unless we notify you that we require a longer period (up to 90 calendar days) to respond to your request.  

SPECIFIC PRIVACY INFORMATION FOR SINGAPORE

If you are in Singapore, the following additional information is relevant to how we handle your Personal Information pursuant to the Personal Data Protection Act 2012 (Act 26 of 2012) (Singapore PDPA).

  1. WITHDRAWING YOUR CONSENT
  1. The consent that you provide for the collection, use and disclosure of your Personal Information will remain valid until such time it is being withdrawn by you in writing.  You may withdraw consent and request us to stop collecting, using and/or disclosing your Personal Information for any or all of the purposes listed above by submitting your request in writing or via email to our Data Protection Officer at the contact details provided in paragraph ‎‎14 above.
  2. Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us.
  3. Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you and we will, in such circumstances, notify you before completing the processing of your request.
  4. Please note that withdrawing consent does not affect our right to continue to collect, use and disclose Personal Information where such collection, use and disclose without consent is permitted or required under applicable laws.
  1. TRANSFERS OF PERSONAL DATA OUTSIDE OF SINGAPORE

If we transfer your Personal Information out of Singapore, we will take reasonable steps to ensure that your Personal Information continues to receive a standard of protection that is at least comparable to that provided under the Singapore PDPA.  

  1. ACCESS AND CORRECTION OF YOUR PERSONAL INFORMATION
  1. If we intend to charge you to access your Personal Information, we will inform you of the fee before processing your request.
  2. If we are not able to respond to your request to access and/or correct your Personal Information within 30 days after receiving your request, we will inform you in writing within 30 days of the time by which we will be able to respond to your request.  If we are unable to provide you with any Personal Information or to make a correction requested by you, we will generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the Singapore PDPA).