Privacy policy

This privacy policy gives you information on how we collect and process your personal information at the New Zealand Council for Education Research – Te Rangahau Mātauranga o Aotearoa – NZCER.

We may need to collect, hold, use and disclose your personal information in order to conduct educational research and provide NZCER products and services to you.  This privacy policy explains how, when collecting, holding, using and disclosing your personal information, we comply with our obligations under the New Zealand Privacy Act 2020 (“the Privacy Act“). We align our practices with all 13 Information Privacy Principles in the Privacy Act. NZCER is committed to being transparent about our data practices and to collecting only the personal information that is necessary for our research and services as per the principal of data minimisation (Principle 1) under the Privacy Act.

The specific areas covered include:

1. Who we are
2. The information we collect
3. How we collect information
4. How we use information
5. International data storage and transfers
6. Security
7. How long we keep information for
8. Your rights
9. Project or product specific privacy information

1. Who we are

New Zealand Council for Educational Research is an independent research and development organisation. We operate under the New Zealand Council for Educational Research Act 1972.  We offer a range of educational tools and services to inform teaching and improve learning.  You can find more information here.

In order to engage with NZCER services and products, you may need to voluntarily share personal information. We require this information to undertake our research projects or to provide you access to our online platforms and associated services/products, as explained in Section 4 below.

Te Tiriti o Waitangi underpins the work of Te Rangahau Mātauranga o Aotearoa | NZCER. In practice, we incorporate its principles in our work. we support Māori data sovereignty, and recognise that Māori have collective rights and interests in data about Māori. We seek to manage all personal information – especially data about Māori learners, whānau, and communities – in a manner consistent with these values. We treat data as taonga that is collected and used with respect and guardianship.

As an educational research organisation, we often work with information about learners, teachers, and schools. We are mindful of the sensitivity of this data. Personal information collected in educational settings is used to benefit teaching and learning outcomes and to produce research insights. We take care to safeguard the privacy of students and school communities, and we apply ethical standards and formal ethics review to all research conducted at NZCER. We collect personal information lawfully and in a way that is not unreasonably intrusive, especially in school contexts and when engaging with children and young people (Principle 4).

2. The information we collect

Personal information means any information about an individual from which that individual can be identified.

We only collect information that is necessary for lawful purposes connected with our research, assessment services, sales and support (Principle 1). Where we assign an NZCER account ID or assessment candidate ID, we do so only when necessary for our functions and we do not reuse identifiers assigned by other agencies (Principle 13).

We do not require individuals to disclose unique identifiers issued by other agencies except for NSN, which is integral for the research, analysis and reporting of educational data over time. If specific legislation (e.g., the Education and Training Act 2020 for NSNs) applies, we follow that scheme and any authorisations or conditions it sets. (Principle 13)

The types of personal information that NZCER may collect include:

• School or organisation information: including name of school or organisation, location of school or organisation, number and type of users who will be using the platform from the applicable school or organisation.
• Learner information: including first name, last name, nationality, username or similar identifier, year level, gender, email and identifying school or organisation that the learner applies to.
• Platform tools user information: including first name, last name, identifying school or organisation that the assist user is employed by and/or related to and the type of role such user has (ie whether it is an administration role and/or an assessor/teacher role for the purposes of the NZCER tools).
• Contact information: including billing address, delivery address, email address and telephone numbers for relevant school or organisation contact person(s).
• Financial information: e.g., bank account details or payment card details (if you are purchasing our products or services).
• Transaction information:  records of payments to and from you and other details of services and products you have purchased from us through your account.
• Technical information: including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile information: including usernames and passwords, purchases or orders, assessments/tests taken, preferences, feedback and survey responses.
• Assessment information: including assessments taken, results, comments and feedback.
• Usage information: including information about how you use our platform, products and services.
• Communications information: including your communications with us or other account holders in relation to our services, and your communication preferences.
• Marketing information: including your preferences in receiving marketing from us and our third parties.
• Other information: any additional information you choose to provide us. For example, if you contact us by email with feedback, fill out an optional survey, participate in a promotion, or upload content to one of our portals, we may collect or retain whatever information you include in those communications or uploads.

You can choose not to provide personal information to us, but that may impact on our ability to provide NZCER services and products to you. 3. How we collect information

We use different methods to collect personal information from and about you:

• You may give us personal information by filling in forms (for example, when creating an account, signing up for an assessment, or agreeing to take part in a research study) or by corresponding with us via post, phone, email, or in person. When learners complete assessments or activities on our online portal and submit them for marking, those responses and results are collected and stored. If assessments are done on paper, and a teacher or NZCER staff member enters the results into our system, that entered data is also collected and stored.
• As you interact with our websites or online portals, we automatically collect certain technical data about your equipment, browsing actions and usage patterns (as described under “Technical information” in Section 2). We collect this information using cookies, server logs, and similar technologies. (Please see Cookies in Section 4 below for more details on how we use these technologies.)

Where practicable, we collect information directly from you or your school/organisation; if we need to collect it from another source, we ensure an exception listed in the Privacy Act 2020 applies (Principle 2). At or before collection, we take reasonable steps to tell you our purposes, intended recipients, whether collection is required/authorised by law, our contact details, and your access and correction rights (Principle 3)

4. How we use your information

We will use your personal information to:

• provide you with access to NZCER tools, and associated services and products;
• contact you about your account and activity, for example, when supporting you to setup or administer assessments;
• work with your school or organisation to support your use of NZCER tools;
• comply with our legal, regulatory, tax and/or accounting requirements;
• continually improve NZCER services and products that we provide;
• to carry out educational research. For example, we may analyse assessment data to discern trends or insights that inform teaching practice or education policy. Any research publications or reports we produce will not identify you personally without your consent.
• contact you about services, products and items that we think may be of interest to you. You can unsubscribe from any marketing communications from us by following the instructions on any communications sent to you.  You can also exercise this right at any time by contacting us using the details at the end of this privacy policy;
• carry out marketing activities; and
• assist with any queries, requests or complaints that you may have.

We do not sell your personal data to anyone, and we disclose personal information only as permitted under the Privacy Act (Principle 11). However, we may need to share personal information with certain parties in order to carry out the purposes described above. This includes sharing on an as-needed basis with: our service providers and suppliers (for example, cloud hosting providers, IT support, payment processors, etc.) where necessary for us to be able to provide NZCER tools and services and products to you, including;

• other account holders or persons who share your account who may need access to your assessments and/or results (e.g. teachers from the same school or organisation as the learner);
• anyone you consent to us sharing your personal information with;
• credit reference agencies (for credit checking) or with debt collection agencies solely to recover payments you owe us, potential purchasers of our business (or a portion of it); and
• anyone whom we are required by law to share your information with. This can include the Privacy Commissioner (if you lodge a privacy complaint involving NZCER), law enforcement or government agencies (if they present a lawful warrant or request), or other authorities. We may also disclose information if needed to exercise, establish, or defend our legal rights.

We only use personal information for the purposes for which it was collected (or a directly related purpose), unless another lawful ground applies (Principle 10). Before using or disclosing personal information, we take reasonable steps to ensure it is accurate, up to date, complete, relevant, and not misleading (Principle 8)

We may use aggregated or anonymised data (which does not identify you personally) for research, reporting or product development purposes. For example, under our NZCER Assist platform terms, we are allowed to compile system-wide statistics and trends. We use such aggregated data to understand educational patterns and to publish insights that help the education sector, without disclosing any individual’s information.

Use of artificial intelligence and automated tools

NZCER may use artificial intelligence (AI) or automated data analysis tools. If we employ AI tools that process personal information (for example, an algorithm that helps mark assessments or analyse survey responses), any such use will comply with the Privacy Act as well as our own ethical guidelines. In practice, this means that we will not upload personally identifying information into any AI tools or model that retains individual data after use or use such data for model development or training. In addition, we will ensure that important decisions or insights involving your personal data are always subject to human review. Human review is retained in line with fairness and accuracy expectations (Principle 8).

Notification of indirect data collection

Starting no later than 1 May 2026, when we collect personal information about you from someone else (for example, from your school or a research partner), we will take reasonable steps to tell you about that collection as soon as reasonably practicable after we have received it, unless an exception applies under the Privacy Act. Our notice to you will make you aware of that we collected your information, why we did so, and who we intend to share it with. In addition, we will provide the name and contact information of the agency that collected the information (NZCER) and any third-party agency holding it and how to exercise your access and correction rights (Principle 3A).

Cookies  

We may use cookies and other interactive techniques such as web beacons to collect information about how you use our website to:

• provide you with a more enjoyable, customised service and experience on our website;
• enable you to use certain services on our website;
• help us develop and deliver better services and products which are customised to our customers’ interests; and
• help us manage security and fraud risks.

We may use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device for a set period or until you delete them). For example, a persistent cookie allows us to remember your login details or other settings so you don’t have to re-enter them every time.

Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies or to alert you when cookies are being sent. Note: If you disable or refuse certain cookies, some parts of our site or online services may not function properly for you (for instance, interactive features might not work or you may not be able to stay logged in).

Third-Party Links

This platform may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for how they may use your personal information.

5. International Data Storage

Where practicable, NZCER stores personal information on secure servers located in New Zealand.

However, we also use trusted third-party service providers and cloud platforms that may store or process data in other countries – specifically in Australia, the European Union, and the United States. This means your personal information could be transferred to or accessed from these jurisdictions.

When sending or storing personal data overseas, we comply with New Zealand’s Privacy Act requirements (including Information Privacy Principle 12) to ensure your information remains protected. In particular, we take steps to ensure that any overseas recipient of personal data is either: subject to New Zealand’s privacy laws, subject to their own country’s privacy laws that provide comparable safeguards to the New Zealand Privacy Act, or bound by a contract that requires them to protect the data to New Zealand standards.

For example, our cloud providers in Australia and the EU operate under privacy regimes and security practices that are very similar to New Zealand’s. (Notably, New Zealand has been recognized by the European Commission as offering data protection that is equivalent to the EU’s, which permits free flow of personal data between NZ and EU countries. For service providers in the United States – which does not have a single comprehensive privacy law comparable to NZ’s – NZCER relies on contractual safeguards, US state-level privacy regulation, and due diligence to protect your information.

6. Security

Information transmitted over the internet is not always secure, but we will use reasonable, industry standard security measures to protect information we hold against loss, access, use, modification and unauthorised disclosure (Principle 5)  These measures include technical controls (such as encryption, secure network firewalls, and access control restrictions) and organisational controls (such as staff training in data protection and policies governing how we handle information). We have procedures to deal with any suspected privacy breach and will notify you and any applicable regulator of a breach where required by law.

7. How long we keep information for

We will only retain your personal information for as long as we legitimately need it and not longer than permitted by law (Principle 9).  We will de-identify and aggregate information wherever possible. In practice, this means:

• If you have an account or are actively using NZCER services, we keep your information for as long as your account is open or as needed to provide services to you.
• If you close your account or your relationship with NZCER ends, we may still hold some of your information for a period of time. For example, we might retain data to meet legal record-keeping requirements, to resolve disputes, or to continue ongoing research. To be able to answer any follow-up questions about research we conduct, we store research data for three years after the completion of research activities. After this, it is deleted or irreversibly anonymised.
• In some cases, where NZCER maintains longitudinal datasets over an extended period of time for research purposes.

8. Your rights

You have rights to see and request the correction of any personal information we hold about you.  We respond to access requests as soon as practicable and, where possible, within twenty working days. If we decline or extend time beyond twenty days, we’ll explain why. If we refuse a correction, you can ask us to attach a statement of correction to your record (Principles 6 & 7) If you want to exercise these rights or to ask us questions about this privacy policy, please contact us using the following details:

New Zealand Council for Educational Research

Email address: privacy@nzcer.org.nz

Telephone number: (04) 384-7939

This privacy policy is governed by New Zealand law.  For more information about privacy issues in New Zealand and protecting your privacy, visit the New Zealand Privacy Commissioner’s website.