1. Purpose and scope
This policy sets out how Ray Simpson Real Estate (“RSRE”, “we”, “us”) collects, uses, stores, discloses, and protects personal information. It gives effect to the Privacy Act 2020 and the 13 Information Privacy Principles (IPPs).
It applies to everyone working for or on behalf of RSRE, including directors, employees, and contractors, and covers all personal information we handle about property owners, tenants, applicants, tradespeople, website visitors, and other individuals.
2. Definitions
- Personal information: information about an identifiable individual.
- Agency: an organisation that collects or holds personal information. RSRE is an agency under the Privacy Act 2020.
- Privacy breach: unauthorised access to, disclosure, alteration, loss, or destruction of personal information, or an action that prevents an agency accessing information.
- Processor: a service provider that handles personal information on our instructions and on our behalf.
3. Privacy Officer
RSRE’s Privacy Officer is responsible for encouraging compliance with the IPPs, dealing with access and correction requests, working with the Office of the Privacy Commissioner (OPC) on any inquiry, and ensuring the organisation meets its obligations under the Privacy Act 2020.
Privacy Officer: Wendy. Email: wendy@rsre.co.nz. Phone: 04 801 9367.
4. How we give effect to the Information Privacy Principles
IPP1 – Purpose of collection
We collect personal information only where it is necessary for a lawful purpose connected with our property-management functions.
IPP2 – Source of information
We collect personal information directly from the individual where we can. Where we collect it from another source, IPP3A applies (see section 5).
IPP3 – Notice on direct collection
When we collect personal information directly, we make sure the individual knows who we are, why we are collecting it, who will receive it, whether it is voluntary, and their rights of access and correction, through our website privacy statement, our forms, and our management agreement.
IPP3A – Notice on indirect collection
In force from 1 May 2026, IPP3A applies where we collect personal information about a person from a source other than that person, on or after that date. Where we do so, for example through references, previous property managers, or identity and credit checks in the course of a tenancy application, we take reasonable steps to ensure the individual is made aware of the collection and its purpose, unless a statutory exception applies. Where we rely on an exception, we do so in line with OPC guidance, and we will take legal advice where the position is not clear.
IPP4 – Manner of collection
We collect personal information by lawful and fair means that are not unreasonably intrusive.
IPP5 – Storage and security
We hold personal information securely and take reasonable steps to protect it against loss, misuse, and unauthorised access or disclosure (see section 9).
IPP6 and IPP7 – Access and correction
Individuals may request access to, and correction of, personal information we hold about them (see section 10).
IPP8 – Accuracy
We take reasonable steps to ensure personal information is accurate, up to date, and complete before we use it.
IPP9 – Retention
We do not keep personal information for longer than we need it for the purposes for which it may lawfully be used, or for as long as the law requires.
IPP10 and IPP11 – Use and disclosure
We use and disclose personal information only for the purpose it was collected, or for a directly related purpose, or where an exception under the Privacy Act 2020 applies (see section 6).
IPP12 – Offshore disclosure
Where we disclose personal information to a provider outside New Zealand, we take reasonable steps to ensure it is protected to a standard comparable to the Privacy Act 2020 (see section 7).
IPP13 – Unique identifiers
We assign unique identifiers only where necessary to carry out our functions efficiently, and we do not require an individual to disclose a unique identifier assigned by another agency unless permitted.
5. What we collect and from whom
Depending on the relationship, we may collect:
- From owners: name, contact details, property address and details, and bank account details for rent disbursement.
- From tenants and applicants: name, contact details, identification, rental history, references, employment and income information, and bank account details.
- From website visitors: enquiry form details (name, email, phone, message) and basic technical information such as IP address and device type.
We collect most of this directly. For tenancy applications we may also collect information indirectly, from references, previous landlords or property managers, and identity or credit checks, in which case IPP3A applies as described in section 4.
6. Use and disclosure
We use personal information to manage properties on behalf of owners, assess tenancy applications, meet legal obligations under tenancy law and the Healthy Homes standards, communicate with owners and tenants, and run our website and business.
We disclose personal information only where needed or where the law requires, including to property owners, tradespeople carrying out maintenance, Tenancy Services and the Tenancy Tribunal, and service providers who help us operate (such as our website host and email provider).
7. Offshore disclosure
Some of our service providers store or process information outside New Zealand. These include Cloudflare, which hosts our website and provides the security check on our enquiry form, and Google, which provides our website analytics; both may process information in the United States and other locations. Where information is disclosed offshore, we take reasonable steps under IPP12 to ensure the overseas recipient protects it to a standard comparable to the Privacy Act 2020, typically through the provider’s contractual terms.
8. AI tools and automated decision-making
We use third-party artificial intelligence tools to help us draft and prepare correspondence and documents. In the course of this, personal information such as owner and tenant names, contact details, property details, and tenancy or application information may be processed by these tools. This information is handled under the same purposes and protections set out in this policy.
These AI tools are provided by overseas companies and process information outside New Zealand, so the offshore protections in section 7 apply. We use business-tier accounts where available and take reasonable steps to limit the personal information shared with these tools to what is needed for the task.
We do not use AI to make automated decisions about individuals that have legal or similarly significant effects. Decisions about tenancy applications, tenants, and properties are made by a person.
9. Storage, security, and retention
We store personal information securely and limit access to those who need it. We take reasonable steps to protect it against loss, misuse, and unauthorised access, and we dispose of it securely when it is no longer needed. Where information is sent to us by email, such as a completed management agreement, we handle it promptly and store it securely; individuals who prefer a more secure method of sending sensitive details can contact us to arrange one.
10. Access and correction
Individuals may ask for a copy of the personal information we hold about them (IPP6) and ask us to correct it (IPP7). Requests should go to the Privacy Officer. There is usually no charge. We will respond as soon as reasonably practicable, and no later than 20 working days after receiving the request. If we decline a request, we will explain why. If we decline to correct information, the individual may ask us to attach a statement of the correction sought, and we will take reasonable steps to do so.
11. Privacy breach response
If we become aware of a privacy breach, the Privacy Officer will assess it promptly, contain it, and consider whether it has caused, or is likely to cause, serious harm to any affected individual. Where serious harm is likely, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, consistent with Part 6 of the Privacy Act 2020. We keep an internal record of breaches and near misses to improve our practices.
12. Cookies and website tracking
Our website uses cookies and similar technologies. Strictly necessary technologies include Cloudflare Turnstile, which protects our enquiry form from automated abuse. Performance and analytics cookies include Google Analytics 4, which helps us understand how visitors use the site, generally on an aggregated basis that does not identify individuals. Both Cloudflare and Google may process information offshore, as covered in section 7. Visitors can control cookies through their browser settings, though some parts of the site may not work as well as a result.
13. Complaints
Anyone with a concern about how we handle personal information should contact the Privacy Officer first. If they are not satisfied, they may complain to the Office of the Privacy Commissioner: www.privacy.org.nz, 0800 803 909, or PO Box 10094, Wellington 6143.
14. Training and review
Everyone handling personal information on our behalf is made aware of this policy and their obligations under the Privacy Act 2020. We review this policy at least annually, and sooner if the law or our practices change.