Privacy

Our privacy notice

Collecting your information

We collect the personal information we need to carry out our lawful functions. This includes information we need to assess and settle claims, and to support natural hazard preparedness, response, recovery and research.

We may collect:

• personal information about you, including your name and contact details
• property and location details
• details of how the natural hazard has affected your property
• proof of your identity
• claim or enquiry information
• any details of your specific circumstances, if you tell us about them, that may help us to tailor how we manage your claim
• CCTV images when you visit our premises.

You can ask us not to collect certain information, but this may limit how much we can help you.

Information we collect from others about you

We may collect information from third parties (for example, insurers, banks, loss adjusters or other agencies) to help us to perform our functions. We use that information only to help us perform our functions.

Other information we collect

We may:

• record phone calls so that we can track our services and improve our training
• keep records of correspondence, and
• collect information through forms, websites, email and written correspondence, by phone and in person. 

We may ask you to confirm that the information you give us is up to date and accurate. Please tell us if your details change so we can contact you.

Using your information

We use personal information to carry out our lawful functions and to provide, manage, and improve services, including:

• assessing and settling claims,
• tailoring support to your needs, and
• maintaining site safety and security (including CCTV for safety and security purposes).

We may provide de‑identified or aggregated data (data we remove the identifying details from and group together) to other organisations for:

• research into natural hazard preparedness, response, and recovery
• natural hazards loss modelling to estimate the impacts caused by natural hazard events and build a view of New Zealand’s natural hazard risk
• spatial analysis to identify location-based relationships, patterns, and trends.

Sharing and storing your information

We may share personal information with:

• insurers
• contracted providers (for example, assessors, loss adjusters, and repairers)
• mortgagees, and
• other government agencies. 

We require these organisations to protect your information and use it only for the purpose we shared it for.

We only share information that identifies you when the law requires or authorises us to, or with your consent. When we share information, we always:

• check the purpose of sharing and whether the law allows us to share
• share only what is needed, and
• keep it only as long as needed.

Sometimes organisations may work on our behalf. We may give them access to the data and information we manage, or we may give them de-identified data and analytics to do their work independently. 

We protect information with security measures that fit how sensitive it is. For example, we:

• limit access to information so that only people who need it to do their job can see it
• protect systems with strong passwords and multi‑factor authentication
• store information securely, whether it’s in locked cabinets for paper files or secure systems for digital information.

We keep personal information only as long as we need it to do what we collected it for, or to meet our obligations under the Public Records Act 2005. After this, we securely destroy it or permanently remove the identifying details.

We may store or process personal information outside New Zealand. When we transfer personal information overseas, we take reasonable steps to make sure it is protected to a standard similar to the standard in the Privacy Act 2020. This may include contract requirements, checks on the provider, and security controls. 

Changes to our Privacy Notice

We may change this privacy notice from time to time. Any updated versions of this privacy notice will be posted on our website (last updated 1 July 2026).

Our website and social media

When you visit our website or interact with us on our official social media accounts, we may collect personal information that you give us or that is generated when you use those services. We use this information to answer questions, improve our services and communications, and meet our legal responsibilities.

This notice applies to personal information collected through this website, our official social media accounts, and other online interactions where you contact or engage with us.

It explains how we handle personal information provided directly to us and information we collect automatically through these channels.

When you use social media, the platform’s privacy policy and settings also apply. Please review those policies to understand how they may affect your personal information.

Collection, use and storage 

Depending on how you interact with us, we may collect information such as:

• name and contact details
• messages, comments and feedback
• interaction information (likes, shares, replies)
• website analytics (pages viewed, device and browser information). 

What we collect depends on the platform, what you choose to share and your privacy settings. If you give us someone else’s personal information, please make sure they know and agree to this.

We collect information when you submit forms or enquiries, contact us through our website or social media, comment on our posts, or take part in online engagement activities.

We may share information within NHC Toka Tū Ake or with other organisations who host or support our digital platforms, and with other organisations when the law requires or authorises us to. We only share what we need to.

Some services may store or process information outside New Zealand. When this happens, we take reasonable steps to make sure it is protected to a standard similar to the standard in the Privacy Act.

We keep personal information only as long as needed for the purpose it was collected or to meet legal obligations.

Cookies

Cookies are small text files placed in your browser to support website functionality and to collect analytics about site use.

We use analytics tools to collect anonymous usage data (via session cookies) to understand site trends and improve performance.

We use analytics to improve site performance, support site administration and generate usage statistics so that we can improve the website. We:

• do not link analytics data to personal information held by us
• do not use it to identify individuals, and
• limit its use to aggregated reporting (grouped data).

The session cookies may be stored (including IP addresses) securely outside New Zealand. 

You can control cookies through your browser settings or cookie controls. However, disabling cookies may affect whether the site works properly.

Contacting us about privacy

You can contact us to ask to see or correct your information, ask how we handle your information, make a privacy complaint, or give feedback.

When contacting us, please tell us your name, contact details, the information you are asking for or the nature of your enquiry or complaint, and any supporting documents (if needed).

Phone: 0800 326 243 

Postal address:                                                                                                                         
Natural Hazards Commission Toka Tū Ake
PO Box 790
Wellington 6140

Email: privacy@naturalhazards.govt.nz

If you are not satisfied with our response, you can reach out to the Office of the Privacy Commissioner:

Phone: 0800 803 909

Postal address:
Office of the Privacy Commissioner
PO Box 10094
Wellington 6143

Privacy Act requests

You have the right to ask to see the personal information we hold about you and to ask us to correct it if it is wrong, incomplete or out of date. You do not need to explain why you are asking. 

You can make a request using our online Privacy Act request form(external link). To protect your information, we may need to confirm your identity before responding. This form helps us to do this, and to find your records faster. However, you can also make a request over the phone and in person. 

Examples of requests include:

• asking for a copy of personal information we hold about you (for example, file notes or emails)
• asking how or why we collected or used information
• asking us to correct contact details, claim information or other records
• asking us to note a preferred name or to record a correction where we cannot change original records.

We will respond as soon as we can, and normally within 20 working days. If we need more time or information, we will tell you and explain why.

If we cannot give you access or make a correction, we will explain why and tell you how you can complain or seek a review.

To help us process your request, we will ask for:

• your name and contact details
• proof that the information you’re asking for belongs to you (or that you have authority if you’re acting for someone else), and
• a clear description of the information you want. Specific details help us respond faster.

If you have questions about Privacy Act requests, email privacy@naturalhazards.govt.nz.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner.

You can also request official information under the Official Information Act 1982 (OIA). This allows any person to request the official information we hold, except if there is a legal reason to withhold it. For example, land documents, claims-related reports, and assessments can be requested and provided under the OIA. Information released under the OIA may be provided with personal information removed or withheld.

You can ask for this information or other official information (for example, internal policies or claim-related information) using our Official Information Act request form(external link).

How we use information and technology

We use information, including personal information, to do our work and to support people and communities before, during and after natural hazard events. We are committed to being open about how we use information.

In this notice, we explain how we manage your information and what technology we use to do so. When we use your information, we use only as much as we need.

We use Artificial Intelligence (AI) tools internally to help staff productivity and information handling. For example, staff may use it to summarise material, to help with drafting and reviewing documents, and to make it easier to find information.

AI is a support tool only. It does not replace human judgement, and our staff remain responsible for all outputs and decisions. We do not use AI to make automated decisions about individuals.

Staff must follow our Artificial Intelligence policy and guidelines, which set out our requirements for safe, secure and responsible AI use.

When we use AI, we assess the risks. We make sure it is used safely, with human oversight, and we follow the law and public sector standards for responsible and transparent use.

Third parties and procurement

We engage other organisations (third parties) to help deliver our services. When we do this, we follow the New Zealand Government Procurement Rules, applying a fair, transparent and proportionate approach. Our procurement processes (the processes we use to buy goods and services) are designed to make sure we use public funds responsibly, treat suppliers fairly, and choose providers who meet our requirements.

When we need to buy some kinds of services, we publish planned opportunities, open tenders, and contract awards on the Government Electronic Tenders Service (GETS). Our procurement policy sets out how we buy goods and services and the principles we apply.

Before engaging a provider, we assess the risk of engaging them. This may include assessing:

• their capability and experience
• their compliance with New Zealand law and government standards (including privacy and information security), and
• the sensitivity of information involved.

When providers need access to personal or sensitive information, we:

• include appropriate privacy, security, confidentiality, and incident reporting obligations in their contract
• require them to follow applicable laws such as the Privacy Act and Public Records Act, and
• share only what they need. 

We check suppliers before we engage them, and we put safeguards in their contracts and monitor their performance. For higher-risk arrangements, we do more detailed risk assessments.

Recruitment

We collect and use personal information to manage recruitment and job applications. For successful applicants we keep relevant information for onboarding and employment to avoid duplication. Some information is optional. We may collect information directly from you or, where necessary, from other organisations.

This notice applies to personal information we collect through our recruitment process and through other interactions where you contact or talk with us about vacancies.

It explains how we handle personal information provided directly to us and how this information is used.

Depending on the role and how you communicate with us during the recruitment process, we may collect:

• your name and contact details
• your eligibility and identity information
• your application materials (CV, cover letter, qualifications, interview notes)
• referees’ contact details, and
• optional demographic information for aggregated reporting.

We may collect information about you from referees, previous employers, recruitment agencies or public sources, where this is appropriate and lawful.

If you provide someone else’s personal information (for example, a referee’s details), please ensure they know about and agree to it.

We use personal information to:

• manage and assess applications
• communicate with candidates
• help us to improve our recruitment processes
• tell you about job opportunities if you have opted in, and
• meet our legal obligations.

We may share recruitment information within NHC Toka Tū Ake, with referees you nominate, and when the law requires or authorises us to. We only share what we need to. We take reasonable steps to protect your personal information against loss, misuse, and unauthorised access, disclosure, or alteration.

Some recruitment services may store or process information outside New Zealand. When this happens, we take reasonable steps to make sure it is protected to a similar standard to the standard in the Privacy Act.

We keep information only as long as needed:

• for the purpose we collected it for
• to meet legal obligations
• for employment purposes, and
• for job alerts when you have opted in to receiving them. 

Please keep your details and preferences up to date.

We may confirm your identity and qualifications, and will ask for your consent to do so.