Privacy Policy
Last updated: 27 September 2026
Purpose and scope
PMDD Aotearoa is committed to protecting personal information and handling it respectfully, transparently, and securely. This policy explains how we collect, use, store, disclose, and dispose of personal information when people use our website, contact us, participate in our activities, volunteer, donate, subscribe to communications, complete surveys, or otherwise engage with us.
We handle personal information in accordance with New Zealand’s Privacy Act 2020 and its information privacy principles. Where the Health Information Privacy Code 2020 applies to our activities, we will also meet its requirements. This policy applies to PMDD Aotearoa’s trustees, volunteers, contractors, systems, and services.
Information we collect
-
Contact details, such as your name, email address, phone number, and postal address.
-
Information you provide in enquiries, registrations, submissions, feedback, surveys, or applications.
-
Information about your relationship with us, including supporter, donor, volunteer, partner, supplier, or event participation details.
-
Donation and transaction information. Payment card details are processed by our payment provider and are not retained by us unless expressly stated.
-
Health-related or lived-experience information that you choose to share with us. We will only ask for this where it is necessary for a clear purpose.
-
Website and communications data, such as device, browser, approximate location, pages viewed, referral source, and email engagement information.
-
Photos, recordings, stories, or testimonials where you have agreed they may be collected or used.
How we collect information
We usually collect information directly from you, including through our website, email, forms, surveys, events, donations, social media, and conversations. At or before collection, we will take reasonable steps to explain why the information is being collected, who may receive it, whether providing it is voluntary or required, what may happen if it is not provided, and your rights to access and correct it. We may collect information from another person or organisation where you have authorised this, where it is publicly available, or where another exception under the Privacy Act applies. When we collect personal information indirectly, we will take reasonable steps to tell you that it has been collected, the purpose of collection, the intended recipients, who collected and holds it, any law authorising or requiring collection, and your access and correction rights, unless an exception applies.
Why we use personal information
-
Respond to enquiries and provide information, resources, support pathways, or referrals.
-
Deliver events, campaigns, education, advocacy, research, and community activities.
-
Manage volunteers, supporters, members, donors, funding relationships, suppliers, and partners.
-
Process donations, issue receipts, maintain financial records, and meet legal obligations.
-
Send newsletters, updates, invitations, and fundraising communications where permitted.
-
Understand and improve our services, website, reach, accessibility, and impact.
-
Protect people, our systems, and our organisation; prevent misuse or fraud; and respond to incidents or complaints.
-
Meet contractual, reporting, governance, and legal requirements.
We will only use personal information for the purpose for which it was collected, a directly related purpose, a purpose you authorise, or another purpose permitted by law. We do not provide clinical care or emergency services, and information submitted to us is not a substitute for professional medical advice.
Sharing and disclosure
We may share personal information with trusted service providers that support our operations, such as website hosting, cloud storage, email, event, survey, accounting, payment, and professional advisory providers. We may also disclose information where you authorise us to do so, where required or permitted by law, or where necessary to prevent or lessen a serious threat to health or safety. We require service providers to protect information and use it only for the services they provide to us. We do not sell personal information.
Overseas service providers
Some of our service providers may store or process information outside New Zealand on our behalf. Where a provider acts only as our agent and does not use the information for its own purposes, we remain responsible for ensuring that it is protected appropriately. If we disclose personal information to a foreign person or organisation for its own use, we will comply with information privacy principle 12 by taking reasonable steps to ensure that the recipient is subject to comparable safeguards, obtaining your informed authorisation where required, or relying on another lawful basis.
Website, cookies, and analytics
Our website may use necessary cookies and similar technologies to operate securely and remember preferences. With appropriate notice or consent, we may use analytics or communications tools to understand how people use our website and messages. You can manage cookies through your browser settings, although disabling some cookies may affect website functionality. Our website may link to third-party sites; their privacy practices are governed by their own policies.
Security and retention
We use reasonable administrative, technical, and physical safeguards to protect personal information against loss, misuse, unauthorised access, alteration, or disclosure. Access is limited to people who need the information for an authorised purpose. No internet transmission or storage system is completely secure, but we review our safeguards and respond promptly to identified risks.
We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, to meet legal or financial recordkeeping requirements, or to resolve disputes. When information is no longer required, we securely delete, destroy, or anonymise it.
Accessing and correcting your information
You may ask whether we hold personal information about you and request access to or correction of it. We may need to verify your identity before responding. We will respond to your request as soon as reasonably practicable and no later than 20 working days after receiving it, unless the Privacy Act permits an extension. We will explain any lawful reason for refusing or limiting a request. If we do not make a requested correction, you may ask us to attach a statement of correction to the information.
Communications and fundraising
If you receive promotional or fundraising messages from us, you can unsubscribe using the link in the message or contact us to update your preferences. We may still send service-related or administrative communications where necessary.
Children and young people
We take additional care when collecting information from or about children and young people. We will collect only what is necessary, use clear and age-appropriate explanations, and seek parent or guardian involvement where appropriate, while recognising the young person’s rights, circumstances, and best interests.
Privacy breaches
We will contain and assess suspected privacy breaches, reduce potential harm, and take corrective action. If a breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as we are practically able, unless an exception applies.
Questions, requests, and complaints
PMDD Aotearoa is the organisation that collects and holds the personal information described in this policy. Contact our Privacy Officer if you have a question, want to exercise your privacy rights, or wish to make a complaint:
Email: privacy@pmddaotearoa.org.nz
Organisation: PMDD Aotearoa, Registered Charity CC64273
We will acknowledge and investigate any privacy concerns fairly and promptly. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes to this policy
We may update this policy to reflect changes to our activities, systems, or legal obligations. The current version will be published through our usual channels and will show the date it was approved or last updated.