1. Introduction

The Whanganui College Board of Trustees (“College Board”), Whanganui Collegiate School, and St George’s School (“the Schools”, “we”, “us”, “our”) are committed to protecting personal information and respecting privacy in accordance with the Privacy Act 2020 and guidance from the Office of the Privacy Commissioner (OPC). https://www.privacy.org.nz/

This Privacy Policy explains how personal information is collected, used, stored, shared, and protected across the campus environment.

Although each entity has distinct responsibilities, many services, systems, and facilities are shared. This policy therefore applies across all three organisations.

2. Scope

This policy applies to personal information collected or held in relation to:

• Students
• Parents, caregivers and families
• Staff, contractors, and volunteers
• Alumni, donors, supporters, and community members
• Visitors, suppliers, and service providers
• Members of the public interacting with the campus

It covers information collected through our services, facilities, events, systems, and communications.

3. What is Personal information?

Personal information is any information about an identifiable individual. This may include:

• Name and contact details
• Enrolment, academic, attendance, and assessment information
• Health, wellbeing, or pastoral information
• Employment and contractor information
• Financial and billing information
• CCTV or security footage
• Communications, feedback, or complaints

We only collect personal information that is reasonably necessary for our functions.

4. How We Collect Personal Information

We collect personal information in several ways:

Directly from you

For example, when you:

• Apply for enrolment at either School
• Enquire about educational, boarding, or campus services
• Register for events
• Enter into a contract with us
• Contact us by email, phone, or in person

Automatically

When you use our digital systems or are on campus, such as through:

• Learning management and school administration systems
• Website forms and usage data
• Security systems including CCTV
• Access control systems

From other organisations or third parties

We may receive personal information from other organisations where this is necessary for our functions and lawful.

When we collect personal information indirectly, we take reasonable steps to ensure individuals are aware of the collection where required under Information Privacy Principle 3A (IPP3A).

Further details about how we share and receive information with other organisations are set out in Section 10 (Information Sharing).

5. Why We Collect and Use Personal Information

We collect and use personal information for purposes connected with our legitimate functions, including:

• Delivering education and supporting student learning
• Managing student enrolment, attendance, assessment, and reporting
• Providing student pastoral care and wellbeing
• Managing boarding and residential life
• Managing property, facilities, and campus operations
• Organising and managing events, functions, tours, and community activities
• Employment and contractor management
• Financial administration, billing, and fundraising
• Health and safety, including incident management
• Security and asset protection
• Communicating with students, families, staff, and the wider community
• Meeting legal and regulatory obligations
  
  

We will only use personal information for the purpose it was collected, or for a directly related purpose, unless you consent or the law allows otherwise.

6. Disclosure of Personal Information

We may disclose personal information to campus-related organisations or third parties where this is necessary for our functions or where required or permitted by law.

Further details about how we share personal information are set out in Section 10 (Information Sharing).

7. Storage and Security

We take reasonable safeguards to protect personal information against loss, unauthorised access, misuse, or disclosure. These safeguards include:

• Secure digital systems and access controls
• Staff training and confidentiality obligations
• Physical security for buildings and records
• Secure disposal of information when no longer required
  
  

We retain personal information only for as long as it is required for the purpose for which it was collected, or as required by law.  While we take security seriously, no system can be completely secure.

8. Overseas Disclosure

Some of our service providers (such as cloud or software providers) may store or process information overseas.

When this occurs, we take reasonable steps to ensure the information is protected in a way that is comparable to New Zealand privacy protections, as required by the Privacy Act.

9. Accessing and Correcting your Information

You have the right to:

• Request access to personal information we hold about you
• Request correction of that information if you believe it is inaccurate

To make a request, please contact our Privacy Officer (see Section 12). We will respond in accordance with the Privacy Act.

You may choose to opt out of certain non-essential uses of your personal information, such as receiving general communications.

However, we may still need to collect and use certain personal information to provide services, ensure safety and wellbeing, and meet our legal or contractual obligations. If you choose not to provide required information, this may affect our ability to provide services or fulfil our responsibilities.

10. Information Sharing

Because of the integrated nature of campus life and operations, we may share personal information with and receive personal information from other organisations where this is necessary, lawful, and consistent with the purpose for which the information was collected.

Campus-Related Organisations

Depending on the situation, we may exchange relevant personal information between:

• Whanganui College Board of Trustees
• Whanganui Collegiate School
• St George’s School
• Whanganui Collegiate School Foundation
• Whanganui Collegiate School Old Boys’ and Girls’ Association (OBGA)
• Whanganui Collegiate School Museum Trust
  
  

This sharing may relate to education, boarding, student wellbeing and safety, campus operations, community engagement, events, and legal or governance responsibilities.

Third Parties

We may also share personal information, where appropriate, with:

• On-site or contracted service providers (e.g. catering, health, maintenance, security, or transport providers)
• Medical professionals or emergency services where health or safety is at risk
• Government agencies or regulators where required or authorised by law
• Professional advisers (e.g. legal, audit, or insurance)

How and Why Information Is Shared

We only share or receive personal information where:

• It is directly related to the purpose for which the information was collected
• It is necessary for safety, wellbeing, operational, or legal responsibilities
• The individual has authorised the sharing, or
• The sharing is required or permitted by law
  
  

Where appropriate, information sharing between campus-related organisations is supported by formal agreements that outline:

• The types of information that may be shared
• The purposes for sharing
• Roles and responsibilities for protecting the information
• Security and confidentiality expectations
  
  

When we receive personal information indirectly, we take reasonable steps to ensure individuals are aware of the collection where required under Information Privacy Principle 3A (IPP3A).

Safeguards When Sharing

When personal information is shared with another organisation or service provider, we take reasonable steps to ensure:

• The information is only used for the agreed purpose
• The receiving party protects the information appropriately
• Access is limited to those who need it
  
  

Where information is shared with service providers, we take reasonable steps to ensure they protect it appropriately.

We do not sell personal information.

Your Rights

Information sharing does not remove your rights under the Privacy Act 2020. You still have the right to request access to and correction of personal information we hold about you, including information that has been shared with or received from other organisations.

If you have questions about how your information is shared, you can contact our Privacy Officer (see Section 12).

11. Privacy Breaches

If we become aware of a privacy breach that is likely to cause serious harm, we will follow our privacy breach response procedures. This may include notifying affected individuals and the Office of the Privacy Commissioner, as required by law.

12. Contact Us

If you have any questions about this Privacy Policy or wish to request access to or correction of your personal information, please contact:

Whanganui College Board of Trustees
Privacy Officer
Email: privacy@wcbot.org.nz
Phone: +64 6 3490210

You also have the right to make a complaint to the Office of the Privacy Commissioner if you believe your privacy has been breached. https://www.privacy.org.nz/

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available from us, with the updated date noted at the top.