Scottlands Consulting Limited - Privacy Policy

Effective date: 1 June 2026

 

Scottlands Consulting Limited (“we”, “us”, or “our”) is an independent investigation, training and safeguarding consultancy based in Christchurch, New Zealand, operating across the Pacific and Asia. We take the privacy of the people we work with extremely seriously. Much of our work involves sensitive personal information, including information about survivors, complainants, witnesses and respondents in investigations into sexual exploitation, abuse and harassment and other serious matters.

This policy explains how we collect, use, store, disclose and protect personal information. It applies to information collected through our website at www.scottlands.co.nz, through contact with us by any means, and through the investigation, training and consultancy services we provide. This policy does not limit or exclude any of your rights under the Privacy Act 2020.

We comply with the Privacy Act 2020 and its thirteen Information Privacy Principles. Where we carry out work for international organisations, United Nations agencies or other clients with their own data protection requirements, we also work within the framework those clients require, including any applicable foreign or international data protection standards. Where this policy and a client framework differ, we apply whichever standard gives greater protection to the individual.

​

1. The personal information we collect

The personal information we collect depends on how you interact with us. It may include the following.

From website visitors and business contacts:

• Your name, job title and the organisation you represent.

• Contact details such as your email address, postal address and telephone number.

• The content of any enquiry, correspondence or request you send us.

• Technical information collected automatically when you visit our website, such as your IP address, browser type and version, operating system, and the pages you view and how you interact with them.

In the course of investigations, training and consultancy:

• Information about complainants, survivors, witnesses, respondents and other people connected to a matter, which may include sensitive information about a person’s health, sexual life, ethnicity, cultural or religious background, and other personal circumstances.

• Statements, records of interview, documents, correspondence, images and other evidence gathered or produced during an investigation.

• Information provided to us by a client organisation that has engaged us to carry out work on its behalf.

We collect sensitive information of this kind only where it is necessary for a lawful purpose connected to the work we have been engaged to do, and we handle it with particular care.

​

2. How we collect personal information

Wherever it is reasonable and practicable to do so, we collect personal information directly from the person concerned. We collect information in the following ways.

• When you contact us through our website, by email, by telephone, by post or in person.

• When you engage us to provide investigation, training or consultancy services, or when a client engages us on a matter that involves you.

• During interviews, meetings and the gathering of evidence in the course of an investigation.

• From client organisations, institutions and third parties who hold relevant records, where we are lawfully entitled to obtain that information.

• Automatically through your use of our website, including through cookies and analytics, as described below.

There are situations in an investigation where collecting information directly from the individual is not possible or appropriate, for example where doing so would prejudice the purpose of the investigation or the safety of a person. In those situations we collect information from other sources only to the extent the Privacy Act 2020 permits.

​

3. How we use personal information

We use personal information only for purposes connected with our work and consistent with the reason it was collected. These purposes include the following.

• Planning, conducting and reporting on investigations.

• Delivering training, facilitation and capability development.

• Providing consultancy, safeguarding and advisory services to our clients.

• Responding to your enquiries and communicating with you.

• Meeting our legal, professional and contractual obligations.

• Maintaining our internal records and improving our services and website.

We do not sell personal information. We do not use the personal information of investigation participants for marketing. Where we send occasional updates to business contacts about our services, we do so only where it is appropriate, and you can ask us to stop at any time.

​

4. Sensitive information and investigation participants

We recognise that people who take part in our investigations, particularly survivors and witnesses, are often sharing deeply personal and traumatic experiences. We are committed to a survivor centred and trauma informed approach to the information they entrust to us.

• We collect only the information necessary for the investigation or matter we have been engaged to carry out.

• We explain, so far as the circumstances allow, why we are collecting the information and how it will be used and shared.

• We treat information about a person’s identity, safety and wellbeing with strict confidentiality, and we limit access to it to those who genuinely need it.

• We are mindful of cultural needs and obligations when handling personal information, and we seek to respect the tikanga and cultural safety of the people we work with.

In most investigations, the client organisation that engaged us has its own obligations as the body responsible for the information, and the final investigation report and supporting material are provided to that client. We handle that information in accordance with our agreement with the client and with this policy.

​

5. When we disclose personal information

We treat personal information as confidential and disclose it only where it is necessary and permitted. We may share personal information in the following circumstances.

• With the client organisation that has engaged us, as part of delivering the investigation, training or service.

• With our team members, partners and contractors who are involved in the work and are bound by confidentiality obligations.

• With professional advisers, such as legal advisers, where we need their advice.

• With Complaints Assessment Committees, Church Authorities, regulators, law enforcement or courts, where this is part of the agreed process for a matter or is required or authorised by law.

• Where disclosure is necessary to prevent or lessen a serious threat to the life, health or safety of an individual or the public.

• Where we are otherwise required or permitted to disclose information by law.

A partner business, may be involved in delivering certain services. Where that is the case, any sharing of personal information is limited to what is necessary for the work and is subject to confidentiality obligations.

​

6. Disclosure and storage outside New Zealand

Because we operate across the Pacific and Asia and work with international clients, personal information may be collected, stored or disclosed outside New Zealand. This may happen when we carry out work in another country, when a client is based overseas, or when we use reputable cloud based service providers to store information.

Where we disclose personal information to a person or organisation outside New Zealand, we take reasonable steps to ensure the information is protected by comparable safeguards to those required under the Privacy Act 2020, consistent with Information Privacy Principle 12.

​

7. How we keep personal information secure

We use technical and organisational measures appropriate to the sensitivity of the information we hold. These measures include the following.

• Storing information on secure systems with access controls and strong authentication.

• Limiting access to personal information to those who need it for the work.

• Applying confidentiality obligations to our team, partners and contractors.

• Secure handling, transfer and disposal of physical and electronic records.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we ever became aware of a privacy breach that was likely to cause serious harm, we would notify the affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

​

8. How long we keep personal information

We keep personal information only for as long as it is needed for the purposes set out in this policy, or for as long as we are required or permitted to keep it by law, by our professional obligations, or by our agreement with the client. Investigation material is often retained by the client organisation as the body responsible for the matter. When information is no longer required, we dispose of it securely. Information may persist for a period on secure backups before it is overwritten.

​

9. Your rights to access and correct your information

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it if you believe it is wrong. To make a request, please contact our Privacy Officer using the details below.

We will respond to your request as soon as reasonably practicable and within the timeframes set by the Privacy Act 2020. There are limited situations where we may need to decline a request or withhold information, for example where releasing it would breach another person’s privacy, would prejudice an ongoing investigation, or where another lawful ground applies. If we decline a request, we will explain why and let you know how you can take the matter further.

If you cannot correct information directly, you may ask us to attach a statement noting that you have requested a correction.

​

10. Cookies and website analytics

Our website may use cookies, which are small text files placed on your device, and similar technologies to help the site function and to understand how it is used. We may use analytics tools, such as web analytics services, to collect information about visits to our website in order to improve its content and performance.

You can set your browser to refuse cookies or to alert you when cookies are being used. If you disable cookies, some parts of the website may not work as intended.

​

11. Links to other websites

Our website may contain links to other websites that we do not operate or control, including the website of our partner business and the websites of clients or other organisations. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies before providing them with personal information.

​

12. Information about children and young people

Our website is directed at organisations and adult business contacts, and we do not knowingly collect personal information from children through it. We may, however, collect information about children or young people where it is relevant to an investigation. In those situations, we handle that information with particular care and in accordance with the Privacy Act 2020 and any additional safeguarding obligations that apply.

​

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The current version will always be available on our website, and the effective date at the top of the policy will show when it was last updated.

​

14. How to contact us

If you have any questions about this policy, wish to access or correct your information, or want to make a complaint about how we have handled your personal information, please contact our Privacy Officer.

​

Privacy Officer: Simon Scott

Scottlands Consulting Limited

Email: simon@scottlands.co.nz

Phone: +64 275 974 774

Web: www.scottlands.co.nz

 

If you are not satisfied with how we have responded to a privacy concern, you can raise the matter with the Office of the Privacy Commissioner. You can find their contact details and make a complaint at www.privacy.org.nz.