Privacy policy

1. Information portal staff provide

We collect work email addresses, portal activity logs, TOS acceptance records, and profile edits you make in the portal.

2. Citizen information you receive

When citizens submit through regulation.nz, you receive their email, message content, and attachments in your portal inbox. You become responsible for that information under the Privacy Act 2020 in your capacity as a regulator.

3. Your obligations

You must:

• Use citizen information only for the purpose submitted
• Keep portal access credentials secure
• Follow your organisation's records management and retention policies
• Notify your privacy officer of any breach involving platform data

4. Platform retention and logs

regulation.nz maintains a permanent audit trail of portal correspondence for citizen and regulator visibility. Logs may be accessed by platform administrators for support, security, and legal compliance.

5. Shared infrastructure

Portal data is hosted on secured infrastructure described in the citizen Privacy Policy. No Vercel services are used.

6. Contact

Data handling questions: regulation.nz/contact. Citizen deletion requests involving your organisation may require coordination between you, the citizen, and us.