Privacy

Privacy Policy

Cashmere High School Foundation maintains a database of alumni/ friends/ supporters/ parents/ professionals in order to stay in touch with our community and keep you updated about news, events, careers initiatives and fundraising activities [edit / expand as appropriate].

Some of our database (but not all) choose to join our online community by registering on this website and creating an online profile. In both instances (individuals with offline database records and individuals with online profiles), we collect and store personal information (or “data”) about you. We are committed to protecting and respecting your privacy and this Policy sets out what information we collect about you, where and how we use (“process”) it.

We may change this Policy from time to time. If we make any significant changes we will advertise this on the website or contact you directly with the information. Please check this page occasionally to make sure you are happy with any changes.

If you have any questions about this Policy or concerning your personal information, please email [email].

For the purposes of the New Zealand Privacy Act 2020, the agency collecting and holding your information is Cashmere High School Foundation.

What type of personal information we collect

The information we have about you depends on where we collect it, but may include:

Full name (including previous names)
Email
Address
Phone number
Photographs
Gender
Date of birth
Family relationships
Years at Cashmere High School
Higher education and work details
Participation in our events, emails, competitions, surveys and other activities
Donations/payments made to Cashmere High School and/or Cashmere High School Foundation
Geo-location data (your geographical location based on your IP address)
Log-ins and activity on the website
A record of payments made via the website (but we do not store your credit/ debit card details as these are processed securely externally by a third-party payment provider) which could include event tickets, shop purchases or online donations
Consent options and communication preferences
Content (such as announcements, stories, photos, documents, comments, events, jobs) that you post on this website or provide to us by other means
Messages that you send to other community members via the direct messaging system when logged in to this website. (Messages sent via the direct messaging system are stored securely and are not routinely accessed by us. However, we reserve the right to review messages where there is a report of misuse, a safeguarding concern, or where we are required to do so by law.)

Where we collect information from

We collect personal information when you:

[Include/ delete/ amend list as appropriate]

visit this website
create or update your online profile
post content on to this website or other websites and social media sites managed by Cashmere High School Foundation
take part in an event
attend a meeting with us and provide us with information
contact us in any way including online, email, phone, SMS, social media or post
open an email sent from this website
send a message via the direct messaging system on this website
leave Cashmere High School, and we transfer some basic details about you from the main Cashmere High School database into our alumni database, in accordance with consent obtained at enrolment.

[Note: we have not included public sources used in data matching and tele-appending, on which further advice should be sought, if relevant to your organisation]

How we use your information

We will use your personal information in a number of ways, always with a legal basis for processing your data. These may include:

[Include/ delete/ amend list as appropriate]

providing you with the information or updates that you have asked for
sending you communications (with your consent if required) that may be of interest, including invites to events, newsletters and fundraising campaigns
delivering our obligations under any contract between us
seeking your views on the services or activities we carry out, so that we can make improvements
updating our database records and ensuring we know how you prefer to be contacted
analysing your engagement with our website and other content to help us improve our services for you
running our mentoring programme/ club or group activities/ reunion events/ sports fixtures
displaying your name as a list of potential ‘matches’ when you (or someone with similar details) signs-up for an event, makes a donation or joins the online community and the system is trying to match your information to an existing record stored in our database

[Note: The above is a selection of the ways in which data might be used. You should delete where not applicable and add any other intended uses you have. Note that we have not included profiling, wealth screening or transference of personal data off the ToucanTech database to other third-parties – you should clearly state if you are doing any of these things, and potentially seek legal advice on the nature of this processing.]

Our legal basis for processing your information

We collect and use your personal information only for lawful purposes connected with the Foundation's functions and activities. These purposes are described in the "How we use your information" section above. We will not use your information in ways that you would not reasonably expect, and we will not use it for purposes beyond those for which it was collected without your consent or as otherwise permitted by law.

Updating your consent preferences

If you have an online profile on this website you can update your consent options by logging-in and clicking on “My Settings” in your profile. Scroll down to find your ‘Consent options’ where you will see a list of consents and the options “opt-in”, “opt-out” and “unspecified”.

Via ‘My Settings’ you can also choose to hide your profile from Google, limit access to your profile so that it’s only viewable to your connections and adjust some of the automatic notifications that you receive from this website. Please note that your name (but not full profile) may appear in various places around the community website, such as a ‘Recent Joiners’ box and in ‘Search’ results irrespective of the privacy settings you have selected.

If we are using consent as our legal basis for processing your data, we must have an explicit “opt-in” from you for this specific type of processing.

If we are using legitimate interests as our legal basis for processing your data, we will process your data responsibly in a way that you would reasonably expect, and you can opt-out at any stage.

If you click ‘unsubscribe’ at the bottom of one of our emails sent you will be automatically opted-out of these types of email communications in the future.

If you want to contact us about your consent preferences please contact [details] by telephone/ email [details].

How we keep your information safe

We understand the importance of keeping your personal information secure and take appropriate steps to safeguard it.

Your data is stored on a dedicated, secure cloud server hosted by Amazon Web Services (AWS) in the APAC region and managed by our website provider, ToucanTech. Industry standard firewalls, anti-virus, encryption and back-up methods are in place, as well as strict data handling protocols.

We always ensure only authorised persons have access to your information, which means only our approved employees and contractors, and that everyone who has access is appropriately trained in data management.

If you have an online profile for this website you are responsible for keeping your login details (email and password) confidential and we ask that you do not share your password with anyone.

No data transmission over the internet can be guaranteed to be completely secure. So, whilst we strive to safeguard your information, we cannot guarantee the security of any information you provide online and you do this at your own risk.

Who has access to your information?

[Include/ delete/ amend list as appropriate]

Third parties who provide services for us, for example [insert details such as, collecting or processing data and sending mailings]. We select our third-party service providers with care. We provide these third parties with the information that is necessary to provide the service and we will have an agreement in place that requires them to operate with the same care over data protection as we do
Third parties if we run an event in conjunction with them. We will let you know how your data is used when you register for any event
Web hosting, email hosting, analytics and search engine providers that enable us to run our community database and improve our website and its use
Third parties in connection with restructuring or reorganisation of our operations, for example if we merge with another business. In such event, we will take steps to ensure your privacy rights will be protected by the third party

[Note: if you make transfers of your data to third parties outside of the EEA for other reasons, please include details here and explain how you are ensuring compliance with GDPR]

Other than this, we will not share your information with other organisations without your consent.

Keeping your information up to date

Please would you let us know if your contact details change. Online members can update your details directly by logging-in to the website and clicking on ‘My Settings’ under your profile. You can also update your details by contacting us at [insert details].

Use of aggregated data

Where data can be aggregated and anonymised, our website provider (ToucanTech) might use this for research purposes without restriction. For example, they may monitor traffic patterns, site usage, response rates and data trends to help make improvement to the website software. They are entitled to do this because the resulting data will not personally identify you and will therefore no longer constitute personal data for the purposes of data protection laws.

How long we keep your information for

We will hold your personal information for as long as it is necessary for the relevant activity. [Include link to a Record Retention Policy if you have one]

Where we rely on your consent to contact you for direct email marketing/ fundraising purposes, we will treat your consent as lasting only for as long as it is reasonable to do so. This will usually be for [two] years. We may periodically ask you to renew your consent.

If you ask us to stop contacting you, we will keep a record of your contact details and limited information needed to ensure we comply with your request. If you ask us to remove your personal data from our database we will delete all the information we hold out apart from your name and the dates that you attended or taught at Cashmere High School and archive your record in our database.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to ask for access to the personal information we hold about you, and to request that it be corrected if you believe it is inaccurate or out of date. We will respond to access and correction requests within 20 working days. To make a request, please contact us at [email].

If we are unable to correct information at your request, you may ask us to attach a statement of correction to the record.

We may in some circumstances agree to delete personal information we hold about you, but this is not an absolute right and will depend on our legal obligations and legitimate operational needs, for example, we may be required to retain financial records for a minimum period under applicable law.

If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner: https://www.privacy.org.nz/

Privacy breaches

We take reasonable steps to protect your personal information from loss, misuse or unauthorised access. In the event of a privacy breach that we believe is likely to cause serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as soon as practicable, in accordance with our obligations under the Privacy Act 2020.

----------------------------------------

This Policy was last updated in June 2026.