Governance
& Policies

1. Introduction

1.1. Research First (“we” or “us”), is a New Zealand limited liability company. We are a research and business consultancy business based in Christchurch, New Zealand.

1.2. Research First Limited (“Research First”) is dedicated to protecting the confidentiality and privacy of information entrusted to us in compliance with the Privacy Act 2020. This policy applies because in the course of our business we may collect personal information from you. ‘Personal Information’ is defined by the Privacy Act 2020 as information about an identifiable individual. Please read this Privacy Policy to learn about your rights, what information we collect, how we use and protect it.

1.3. Personal information we commonly collect to conduct our business includes:

1.3.1. Contact details (e.g., name, company name, job title, work and mobile telephone numbers, work and personal email and postal address);

1.3.2. Professional details (e.g., job and career history, educational background and professional memberships, published articles);

1.3.3. Financial information (e.g., household income levels for demographic analysis);

1.3.4. Video recordings of focus groups and in-depth interviews; and

1.3.5. CCTV at our sites may collect images of visitors. Our policy is to automatically overwrite CCTV footage within 30 days.

1.4. We do not typically collect sensitive or special categories of personal information about individuals. We only process this type of information with the express consent of the individual or where it has been obtained indirectly for legitimate purposes. Sensitive personal information may include:

1.4.1. Dietary restrictions or access requirements when registering for in-person events that reveal religious beliefs or physical health;

1.4.2. Personal identification documents that may reveal race or ethnic origin, and possibly biometric data of private individuals, beneficial owners of corporate entities, or applicants; and

1.4.3. Information provided to us by our clients in the course of a professional engagement.

1.5. As an agency that holds personal information, we shall not disclose that information without taking steps that are, in the circumstances, reasonable to ensure the information is accurate, up to date, complete, relevant and not misleading.

1.6. In our general work we do not intentionally collect information from individuals under 16 years of age or vulnerable people. There may be occasions that we are asked by clients to survey this demographic and when this happens, we comply with ‘ESOMAR/GRBN Guideline on Research and Data Analytics with Children, Young People, and Other Vulnerable Individuals’. Parental/Guardian consent may be required.

1.7. Please also note that we may process geographical locations you give us to analyze location specific responses that include the attitudes, perspectives and behaviours of sub communities.

2. Our contact details

2.1. Under Principle 3 of the Privacy Act 2020, we are required to provide you with our name and address because we will collect and hold your personal information. You can contact us through the details below if you have any questions or concerns regarding this Privacy Policy or the collection/handling of your personal information.

2.1.1.

• Research First
  Data Protection and Privacy Officer
  PO Box 94
  Christchurch 8140

2.1.2. Alternatively, you can email privacy@researchfirst.co.nz. We aim to respond within 14 days from the date we receive privacy-related communications.

2.1.3. You may contact the New Zealand Privacy Commissioner’s Office at https://www.privacy.org.nz/  to report concerns you may have about our information handling practices.

3. Purpose for collecting your personal information and intended recipients

3.1. We aspire to be transparent when we collect and use personal information. The purpose of our information collection typically includes:

3.1.1. Providing professional advice and delivering reports related to our market research and insights consultancy practice.

3.1.2. Helping our clients navigate complex business problems and decisions by using evidence based aggregated data and responses.

3.2. We are the intended recipients of your personal information and will only use your personal information to contact you for research purposes. We do not pass on any personal information to our clients. All feedback given to our clients is anonymized.

4. Lawful reasons for collecting your personal information

4.1. We try to ensure all our personal information activities are necessary and have a lawful basis for processing. These basis include:

4.1.1. Contract: we may process personal information in order to perform our contractual obligations.

4.1.2. Consent: personal information you have allowed us to collect and process with your explicit consent. We are careful to ensure we give you clear notice of what we are collecting, why and who we might be sharing it with.

4.1.3. Legitimate interests: When we rely on a legitimate interest to collect and use your information, we take an objective, risk-based assessment of our interest and your individual rights and freedoms and will only use information that has a minimal privacy impact or risk, is not collected intrusively and only collect as little information as we need to fulfil the purpose it was collected for. We want you to trust us and we try hard not to collect or use your information for any purpose you wouldn’t reasonably expect us to. Our interests include:

4.1.3.1. Delivering services to our clients – To deliver the professional services our clients have engaged us to provide.

4.1.3.2. Direct marketing – To deliver timely market insights and specialty knowledge we believe is welcomed by our business clients, subscribers and individuals who have interacted with us.

4.2. The only consequence for any individual, if all or any part of the requested information is not provided, is that we may be not be able to contact you in order to get your perspective from you for our research.

5. Your rights of access to, and correction of, information provided

5.1. Pursuant to section 1(a) and (b) of Information privacy principle 6 of the Privacy Act 2020, you have the right to request confirmation of whether we hold personal information about you, access that information and request correction of that information. We have set this out in further detail below:

5.1.1. Access: you can ask us to verify whether we are processing personal information about you, and if so, to provide more specific information.

5.1.2. Correction: you can ask us to correct our records if you believe they contain incorrect or incomplete information about you.

5.2. Further information protection rights available to you are detailed below:

5.2.1. Erasure: you can ask us to erase (delete) your personal information after you withdraw your consent to processing or when we no longer need it for the purpose it was originally collected.

5.2.2. Processing restrictions: you can ask us to temporarily restrict our processing of your personal information if you contest the accuracy of your personal information, prefer to restrict its use rather than having us erase it, or need us to preserve it for you to establish, exercise, or defend a legal claim. A temporary restriction may apply while verifying whether we have overriding legitimate grounds to process it. You can ask us to inform you before we lift that temporary processing restriction.

5.2.3. Data portability: in some circumstances, where you have provided personal information to us, you can ask us to transmit that personal information (in a structured, commonly used, and machine-readable format) directly to another company if it is technically feasible.

5.2.4.     Right to Object to Direct Marketing including Profiling: information gathered in our survey process is not used for direct marketing.  Information sourced for business to business purposes including sales may be used where we believe there will be interest from the receiving party. You can object to our use of your personal information for direct marketing purposes, including profiling. We may need to keep some minimal information to comply with your request to cease marketing to you.

5.2.5. Right to Withdraw Consent: you can withdraw your consent that you have previously given to one or more specified purposes to process your personal information. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

5.3. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal information is not disclosed to any person who has no right to receive it. No fee is required to make a request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.

6. Collection of personal information

6.1. Schedule 8 of the Privacy Act 2020, sets out the collection limitation principle whereby “there should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.” To be transparent, we have set out the means through which we obtain personal information below:

6.1.1. Directly: we obtain personal information directly from individuals in a variety of ways, including obtaining personal information from individuals who complete surveys administered by Research First, provide us their business card, complete our online forms, subscribe to our newsletters, register for webinars, attend meetings or events we host, visit our offices or apply for open roles. We may also obtain personal information directly when, for example, we are establishing a business relationship, performing professional services through a contract, or through our hosted software applications.

6.1.2. Indirectly: we obtain personal information indirectly about individuals from a variety of sources, including recruitment services and our clients. We may attach personal information to our customer relationship management records to better understand and serve our business clients, subscribers and individuals, satisfy a legal obligation, or pursue our legitimate interests. Our indirect sources for obtaining personal information include:

6.1.2.1. Public sources: personal information may be obtained from public registers (such as NZ Companies Office), news articles, sanctions lists, and internet searches.

6.1.2.2. Social and professional networking sites:  if you register or login to our websites using social media (e.g., LinkedIn, Google, or Twitter) to authenticate your identity and connect your social media login information with us, we will collect information or content needed for the registration or login that you permitted your social media provider to share with us. That information may include your name and email address and depending on your privacy settings, additional details about you, so please review the privacy controls on the applicable service to set how much information you want shared with us.

6.1.2.3. Business clients: our business clients may engage us to perform professional services which involves sharing personal information they control as part of that engagement. For example, we will review customer data as part of an experience survey. Our services may also include processing personal information under our clients’ control on our hosted software applications, which may be governed by different privacy terms and policies.

6.1.2.4. Recruitment services: we may obtain personal data about candidates from an employment agency, and other parties including former employers, and credit reference agencies.

7. Security safeguards

7.1. Schedule 8 of the Privacy Act 2020, sets out the security safeguards principle whereby “personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.”

7.2. We have put appropriate technical and organizational security policies and procedures in place to protect personal data (including sensitive personal data) from loss, misuse, alteration or destruction. We aim to ensure that access to your personal data is limited only to those who need to access it. Those individuals who have access to the data are required to maintain the confidentiality of such information. We may apply pseudonymisation, de-identification and anonymisation techniques in efforts to further protect personal data.

7.3. If you have access to parts of our websites or use our services, you remain responsible for keeping your user ID and password confidential. Please be aware that the transmission of data via the internet is not completely secure. Whilst we do our best to try to protect the security of your personal data, we cannot ensure or guarantee the security of your data transmitted to our site; any transmission is at your own risk.

8. Retention of your personal information

8.1. Information privacy principle 9 under the Privacy Act 2020 provides that an agency that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.

8.2.  We retain personal information to provide our services, stay in contact with you and to comply with applicable laws, regulations and professional obligations that we are subject to. Unless a different time frame applies as a result of business need or specific legal, regulatory or contractual requirements, where we retain personal information in accordance with these uses, we retain personal information for seven years. We will dispose of personal information in a secure manner when we no longer need it.

Please Note: Our websites may contain links to other sites that are not governed by this Privacy Policy. Please review the destination websites’ privacy policies before submitting personal information on those sites. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other sites.