Tāhuna ki te Ao
Last Modified: 22 August 2019
Understanding Who Controls Your Information
For the safeguarding of information which remains in our care, we have put into place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those who need to know.
We have assigned a data privacy manager to superintend all aspects of this Privacy Notice, ensuring your questions are answered and your rights are respected. Whenever you have questions, you should contact the data privacy manager via one of the methods below:
Data Privacy Manager
PO Box 2784, Wakatipu
+64 03-450 0032
When needing to transfer your information internationally -
Information We May Receive
When engaging with you and/or making a decision as to whether you will be able to participate with us, we will may receive the following personal information:
Identity and Historical Information - first name, surname, date of birth, nationality and any other personal details you may send to us including your picture, a record of your opinions and views, your history, your health records, government documents, your police record and your financial information;
Contact Data of you and other persons you provide - email address, geographic address, and phone numbers.
Enrollment Data - educational and vocational experience, character references, interview data, application decision data.
If we receive sensitive data about you, you provide us this information by choice and under no compulsion whatsoever.
How We Receive Your Information
We may receive your data through direct or indirect interactions, automation and in some instances third parties.
Information is collected through:
Direct interactions, including emails, telephone calls, meetings and documents.
Automated technologies or interactions. When you use our website or log in to our services, we may learn technical data about your computing system and browsing activity. This data is gathered by employing cookies and related tools.
Third parties. Your personal data may be received follows:
Via a third party as persons you have authorised to communicate with us;
Via analytics through providers such as Google Analytics, which is located outside of the EU; and
From service providers we use, including companies such as:
Hubspot and Formsite to process applications;
Xero and Windcave to process invoices and payments;
Outlook and MailChimp to communicate with you; and
Social Media platforms such as Facebook, Instagram, and YouTube for collaboration and advertising purposes.
How We Process Your Data
Our Trust will only process your data according to the allowance permitted by law:
When you provide us with your initial information for a limited, specific purpose;
When you authorise us to use and process your information, transfer your information to an assisting third party and engage in receiving communications.
When we need to make sure our records are correct, accurate, relevant and not misleading.
When we are fulfilling an obligation in law or a necessary contract.
We are able to use, hold and pass on your personal information to others if we reasonably believe:
You have consented to the use of your information in that way;
To comply with a legal, regulatory or necessary contractual obligations;
The use of the information is directly related to one of the purposes for which you have provided your information;
The disclosure of the information is necessary in court proceedings;
The information is going to be used in a form that does not identify you.
We will not:
Use your information in a way that is unlawful;
Deliberately use incorrect information about you;
Collect your information without your consent unless lawful to do so;
Refuse to give you access to your information, subject to the lawful parameters;
Disclose your information in a way that violates GDPR standards or criteria.
You have the right to:
Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons.
Oppose the processing of your personal data and information derived from a third party.
Request restrictions on processing of your personal data.
Request the transfer of your personal data to a third party. Upon your written request, we will provide a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. Shared information formulated by the Trust is not transferable without the Trust’s consent.
Withdraw consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
We will comply with your request where reasonable to do so and in accordance with the law. We retain the right to refuse to allow you to participate with us if we are not satisfied all necessary and relevant information has been provided in relation to participating.
Your request, or a request by a third party authorised by you, may be denied by us if:
The request reasonably endangers your safety;
The request reasonably endangers another person’s safety or health;
The request breaches another person’s privacy;
The request breaches our privacy;
The request prevents detection and investigation of a criminal offence;
We are not lawfully compelled to disclose the information;
The information is not retrievable.
If you wish to make a request concerning your personal data, please contact us at EMAIL PROTECTED.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, contractual or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
By law we have to keep your personal information for six years after your participation ceases and seven years for Financial and Transaction Data for tax purposes.
If you have any further questions about how we process your data, or if you want to revoke your consent, please contact us at EMAIL PROTECTED.
We may further need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Lawful Basis for Processing
We use your personal information to:
Identify you and create a profile for you when you register with us and/or to request information from us;
Verify your identity when you access our information or communicate with us;
Deal with your enquiries and requests;
Process your application and request to attend a course and/or participate with us;
Communicate with you;
Inform you with respect to the services and information that we provide;
Meet our obligations to you and other parties;
Provide, improve and personalise our services by analysing information about your use of our resources and to understand how people use our information so that we can make it more intuitive;
Comply with the legal obligations;
Contact you and personalise the communications that we send to you to make them more relevant and interesting by analysing details of the services and information that you are receiving, and your transaction history, to make suggestions for other information that may be of interest
Exercise our legal rights where it is necessary to do so, for example to detect violations of law.
In the following table, we describe ways your personal information may be used and the legal basis for processing.
Initial contact and requests for information: emails to us; requests for information; enquiries about enrolment.
Identity Data: name; nationality (but not race or ethnicity).
Contact Data: email address; phone number; name.
Communication Data: marketing preferences.
Consent may be both implied and expressly stated in order to process your personal information for a specific and limited purpose and/or to fulfil a legitimate interest of a party and in the overall interests of all parties.
Completing, submitting and processing an application for participation or enrolment and communications.
Identity Data: title; given names; DoB, gender; nationality (but not race or ethnicity).
Contact Data: phone number; email; mailing address.
Enrollment Data: education and vocational experience;language proficiency; character references.
Special Categories of Data: religious beliefs; information about your health.
Communication Data: marketing preferences.
You have given clear and express consent for the processing of your personal information and/or it is necessary to fulfil an obligation and/or it is necessary to fulfil a legitimate interest of a party and in the overall interests of all parties.
Relationship management including: asking you for feedback, notifying you about changes to our terms and conditions, notifying you about changes to our Privacy Notice, sending you communication through our newsletter, asking you to update your contact information, communicating with you about our services.
Identity Data: name.
Contact Data: email address; phone number; country.
Communication Data: marketing preferences.
Express consent is provided and the processing is necessary to fulfil an obligation and/or to fulfil a legitimate interest of a party and in the overall interests of all parties.
Payment processing: donations; invoices and payments.
Identity Data: name;
Contact Data: email address; billing address; phone number; account numbers, third parties, tax deductible location.
Express consent is provided to process your personal financial data or those of third parties for a specific purpose and/or the processing is necessary to fulfill an obligation.
Transferring Your Data
Registered Business Address
Location of Processing
Name of Subprocessors
Privacy / Security Policy
Cambridge, Massachusetts United States
Microsoft Office 365
Redmond, Washington, United States
Mountain View, California, United States
Auckland, New Zealand
Wellington, New Zealand
Atlanta, Georgia, United States
Menlo Park, California, United States
San Francisco, California, United States
Communication & Marketing
We will make every effort to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.
We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. You will receive marketing communications from us if you have requested information from us and/or have agreed to our processing and/or use of your information.
We also may evaluate Technical Data including your internet protocol (IP) address, operation system, browser type and plug-ins, mobile platform, and other technical data regarding your computing platform. Usage Data includes data regarding how you use our platform, which pages you visit, and other relevant metrics about our website.
Communication Data includes marketing data, including choice in whether or not to receive newsletters and communication from us or our third parties.
You have a right to request:
A copy your communications and marketing information;
That your information to be remove; and
That we stop sending you marketing messages at any time.
Opting-out of receiving communications and marketing messages will not apply to the personal data you have provided to us.
YWAM Queenstown welcomes your comments regarding this Privacy Notice. Please contact us at EMAIL PROTECTED. If there is a problem, we will use reasonable efforts to promptly determine and remedy the issue. Our Data Privacy Manager can be contacted at +64 03-450 0032.