How we handle your information.

3RS Resilience Services is a New Zealand-based consultancy providing independent maturity assessments of business continuity and emergency management capability. For the purposes of the Privacy Act 2020, we are the agency responsible for the personal information described in this policy.

• Contact: 3rs.nz/contact
• Location: Auckland, New Zealand

We keep this to the minimum we need.

2.1 Website Contact Form

When you contact us through our website, we collect:

• your name;
• your email address;
• your organisation (if provided);
• your phone number (if provided);
• whatever you write in the message field.

2.2 Website Analytics

Our website uses Google Analytics to help us understand how visitors use the site. Google Analytics collects anonymised data including:

• pages visited and time spent on each page;
• how you arrived at the site (search engine, direct, referral);
• general geographic location (city or region level, not your address);
• device type, browser, and operating system.

Google Analytics uses cookies to collect this information. A cookie is a small text file placed on your device by your browser. You can control or disable cookies through your browser settings. If you disable cookies, the website will still work.

We have configured Google Analytics to anonymise IP addresses, which means your full IP address is not stored or visible to us. We do not use Google Analytics to identify individual visitors, and we do not combine analytics data with any other information we hold about you.

Google processes this data on our behalf under its own data processing terms. Google may store this data on servers outside New Zealand, including in the United States. For more information on how Google handles analytics data, see Google’s privacy policy.

2.3 Business Contact Information

If you become a client or we are in discussion about a potential engagement, we will hold basic contact information: your name, role, organisation, email, and phone number along with records of our correspondence. This is standard business information necessary to manage a professional relationship.

2.4 Client Engagement Information

During assessment engagements, we collect information about the client organisation's systems, processes, and resilience capability. This may include:

• names and roles of individuals we interview;
• notes from interviews and workshops;
• observations about organisational processes and capability;
• information provided to us about roles, responsibilities, and operational arrangements.

Interview notes and assessment findings may contain information that identifies individuals within the client organisation. We treat all engagement information as confidential. Our assessment reports do not identify individual interviewees by name unless specifically agreed with the client.

We collect personal information only where we have a clear purpose, including:

• To respond to your enquiry: when you contact us through our website or by other means.
• To manage a client relationship: including proposals, engagement planning, invoicing, and follow-up.
• To deliver our services: conducting assessments requires us to interview people and record findings.
• To improve our website: anonymised analytics help us understand what content is useful and how visitors find us.

We do not sell, share, or trade personal information with third parties.

Our website uses cookies only for Google Analytics. We do not use cookies for advertising, tracking, or personalisation. When you first visit our website, your browser will prompt you to accept or decline cookies. If you decline, the website works normally. You can also control cookies through your browser settings at any time.

Personal information and client engagement data is stored in Microsoft 365, which provides encryption in transit and at rest. Only the 3RS principals have access to client engagement information. Specific measures include:

• All data stored in Microsoft 365 with encryption enabled.
• Access limited to 3RS principals — no third-party access to client data.
• Strong passwords and multi-factor authentication on all accounts.
• Client engagement data stored separately from general business records.

We do not store personal information on portable media where it can reasonably be avoided. Where paper notes are taken during interviews, they are transferred to secure digital storage and the paper copies destroyed.

Our data is stored in Microsoft 365. Microsoft operates under its own privacy and security commitments, including compliance with ISO 27001 and SOC 2 standards. Details of Microsoft's data handling practices are available in the Microsoft Trust Center.

Website analytics data collected through Google Analytics is processed by Google and may be stored on servers outside New Zealand, including in the United States. This data is anonymised and does not identify you personally.

We do not otherwise transfer personal information outside New Zealand.

We do not share your personal information with anyone outside 3RS except in the following limited circumstances:

• Client organisations: assessment reports are provided to the commissioning client. Individual interviewees are not named in reports unless specifically agreed.
• Microsoft: Microsoft processes data on our behalf under its own security and privacy obligations. Microsoft does not have independent access to the content of our files.
• Google: Google processes anonymised website analytics data on our behalf. Google does not receive any personal information you submit through our contact form or during client engagements.
• Legal obligation: if we are required by law to disclose information, we will do so. We will notify the affected individual unless prohibited from doing so.

We do not share information with marketing platforms, advertising networks, or data brokers.

We retain personal information only for as long as it is needed for the purpose it was collected:

• Website enquiries: retained for twelve months after our last contact, then deleted.
• Website analytics: Google Analytics data is retained for 14 months, after which it is automatically deleted by Google. We do not export or separately store analytics data.
• Business contact information: retained for the duration of the professional relationship and for twelve months after our last contact, then deleted unless there is a continuing business reason to retain it.
• Client engagement reports: retained for seven years from the completion of the engagement, consistent with standard professional practice and professional indemnity requirements.
• Interview notes and working papers: retained for twelve months after the final report is delivered, then destroyed.

If you ask us to delete your information earlier, we will do so unless we have a legal or professional obligation to retain it.

All information obtained during a client engagement — including personal information about individuals within the client organisation — is treated as confidential. It is not disclosed to any party other than the commissioning client unless:

• The individual concerned has given their consent.
• The commissioning client has authorised disclosure.
• Disclosure is required by law.

Where we use anonymised or de-identified case study material drawn from past engagements, no individual or organisation is identifiable without their prior written consent.

Under the Privacy Act 2020, you have the right to:

• Access: ask us what personal information we hold about you. We will respond within twenty working days.
• Correction: ask us to correct any personal information that is wrong or misleading.

To exercise any of these rights, get in touch through the contact form or call one of the numbers listed there. We will verify your identity before releasing or amending any information.

If you were interviewed as part of a client engagement, you have the right to access any personal information we hold about you, including interview notes that relate to you. Requests for access to engagement information may be subject to consultation with the commissioning client where the information is intertwined with the client's confidential organisational data.

If you believe we have handled your personal information incorrectly, contact us through the contact form or call one of the numbers listed there. We will investigate and respond within twenty working days. If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner:

We may update this policy from time to time. Any changes will be posted on our website with the updated date.

3RS Resilience Services · Grounded. Ready. Assured. · www.3rs.nz