Privacy Policy

June 9, 2025

Heading

1. Introduction

The Curiosity Company ("we", "us", or "our") is a limited liability company. We are an insights consultancy business based in New Zealand. The Curiosity Company is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with the Privacy Act 2020 (NZ).

By engaging with our services, visiting our website, or communicating with us, you agree to the terms of this Privacy Policy.

2. What Personal Information We Collect

2.1 Personal Information We Collect

We may collect personal information directly from you or from third parties where you have authorised this. ‘Personal Information’ is defined by the Privacy Act 2020 as information about an identifiable individual. The types of personal information we commonly collect to conduct our business include:

Contact Details: Full name, address, email, phone number, company name, job title, work telephone numbers, and email and postal addresses.
Professional Details: Job and career history, educational background, professional memberships, and published articles.
Personal Details: Only if relevant for analysis, such as date of birth, gender, household income, and geographical locations.
Information Collected Through Our Website: IP address, browser type, and cookies.
Other Information: Any other information relevant to the services we provide.

2.2 Sensitive or Special Categories of Personal Information

We do not typically collect sensitive or special categories of personal information about individuals. We only process this type of information with the express consent of the individual or where it has been obtained indirectly for legitimate purposes. Sensitive personal information may include:

Dietary restrictions or access requirements when registering for in-person events that reveal religious beliefs or physical health.
Personal identification documents that may reveal race or ethnic origin, and possibly biometric data of private individuals, beneficial owners of corporate entities, or applicants.
Information provided to us by our clients in the course of a professional engagement.

2.3 Information About Children and Vulnerable Individuals

In our general work, we do not intentionally collect information from individuals under 16 years of age or vulnerable people. There may be occasions when we are asked by clients to survey this demographic. When this happens, we comply with the ‘ESOMAR/GRBN Guideline on Research and Data Analytics with Children, Young People, and Other Vulnerable Individuals’. Parental or guardian consent may be required.

3. How We Collect Your Information

Schedule 8 of the Privacy Act 2020 sets out the collection limitation principle, whereby “there should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.”

To be transparent, we collect personal information through the following methods:

Directly: Through phone conversations, email, survey completion, business cards, online forms, newsletter subscriptions, webinar registrations, meetings or events, and applications for open roles.
Indirectly: Through recruitment services, our clients, and customer relationship management records. Other indirect sources include:
- Public Sources: Public registers, such as the NZ Companies Office, news articles, sanctions lists, and internet searches.
- Social and Professional Networking Sites.
- Business Clients: Our business clients may engage us to perform professional services that involve sharing personal information they control as part of that engagement.
- Hosted Software Applications: Our services may involve processing personal information under our clients’ control on hosted software applications, which may be governed by different privacy terms and policies.
Business Relationships and Professional Services: We may obtain personal information directly when establishing a business relationship, performing professional services through a contract, or through our hosted software applications.
Video Recordings: Video recordings of focus groups or interviews.
CCTV: CCTV at our sites may collect images of visitors. Our policy is to automatically overwrite CCTV footage within 30 days.
Website and Digital Platforms: Information collected through our website and digital platforms.
Use of Our Services: Information collected through the use of our services, including analytics and service feedback.

4. How We Use Your Information

We aim to be transparent when we collect and use personal information.

We use personal information for the following purposes:

To analyse our data to provide professional advice reports related to our insights consultancy practice.
To help our clients navigate complex business problems and decisions by providing evidence-based aggregated data responses.
To meet our legal and regulatory obligations.
To help our clients improve their services and experiences for you.
To improve our services, website, and client experience.
For recruitment or employment purposes, if applicable.

We are the intended recipients of your personal information and will only use your personal information to contact you for research purposes. We do not pass on any personal information to our clients. All feedback given to our clients is anonymised.

5. Disclosure of Personal Information

As an agency that holds personal information, we shall not disclose that information without taking steps that are, in the circumstances, reasonable to ensure the information is accurate, up to date, complete, relevant, and not misleading.

We will only share your personal information where necessary and appropriate, including:

With third-party service providers who support our operations, such as IT, cloud storage, and marketing providers.
With government agencies or regulators if required by law.
With your express consent or as otherwise permitted under the Privacy Act.

We require all third-party providers to handle your data securely and in compliance with privacy law.

6. Lawful Reasons for Collecting Personal Information

We try to ensure that all our personal information collection is necessary for us to professionally conduct our business and that we have a lawful basis for processing. These lawful bases include:

Contract: We may process personal information in order to perform our contractual obligations.
Consent: We may process personal information that you have allowed us to collect and process with your explicit consent. We are careful to ensure we give you clear notice of what we are collecting, why, and who we might be sharing it with.
Legitimate Interests: When we rely on a legitimate interest to collect and use your information, we take an objective, risk-based assessment of our interest and your individual rights and freedoms. We will only use information that has a minimal privacy impact or risk, is not collected intrusively, and involves collecting only as much information as we need to fulfil the purpose for which it was collected. We want you to trust us, and we try hard not to collect or use your information for any purpose you would not reasonably expect us to.

Our legitimate interests include:

Delivering Services to Our Clients: To deliver the professional services our clients have engaged us to provide.
Direct Marketing: To deliver timely market insights and specialist knowledge we believe will be welcomed by our business clients, subscribers, and individuals who have interacted with us.

The only consequence for any individual, if all or any part of the requested information is not provided, is that we may not be able to obtain and include your perspective in our research.

7. Storage and Security of Your Information

Schedule 8 of the Privacy Act 2020 sets out the security safeguards principle, whereby “personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.”

We have put appropriate technical and organisational security policies and procedures in place to protect personal information from loss, unauthorised access, use, modification, or disclosure. These measures include:

Secure servers, firewalls, and encryption.
Access controls and authentication procedures.
Regular security reviews and staff training.
Secure disposal of information when no longer needed.

Some information may be stored using cloud services or third-party platforms located outside New Zealand. Where this occurs, we ensure that your data is protected to a standard comparable to New Zealand law.

If you have access to parts of our websites or use our services, you remain responsible for keeping your user ID and password confidential.

Please be aware that the transmission of data via the internet is not completely secure. Whilst we do our best to protect the security of your personal data, we cannot ensure or guarantee the security of your data transmitted to our site. Any transmission is at your own risk.

8. Your Rights

Under sections 1(a) and (b) of Information Privacy Principle 6 of the Privacy Act 2020, you have the right to request confirmation of whether we hold personal information about you, access that information, and request correction of that information.

This means that you can:

Access the personal information we hold about you and ask us to verify whether we are processing personal information about you.
Request correction of any inaccurate, incomplete, or outdated information.
Request that we erase or delete your personal information after you withdraw your consent to processing or when we no longer need the personal information for the purpose it was originally collected.
Request that we temporarily restrict our processing of your personal information if you contest its accuracy, prefer to restrict its use rather than have us erase it, or need us to preserve it to establish, exercise, or defend a legal claim. A temporary restriction may apply while we verify whether we have overriding legitimate grounds to process it. You can ask us to inform you before we lift that temporary processing restriction.
In some circumstances, where you have provided personal information to us, ask us to transmit that personal information (data portability) in a structured, commonly used, and machine-readable format directly to another company, if technically feasible.
Object to our use of your personal information for direct marketing purposes, including profiling. Information gathered in our survey process is not used for direct marketing. Information sourced for business-to-business purposes, including sales, may be used where we believe there will be interest from the receiving party. We may need to keep some minimal information to comply with your request to cease marketing to you.
Complain to the Office of the Privacy Commissioner if you believe your rights have been violated. You may contact the New Zealand Privacy Commissioner’s Office at https://www.privacy.org.nz to report concerns you may have about our information handling practices.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or exercise any of your other rights. This helps us ensure that personal information is not disclosed to any person who has no right to receive it.

Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.

To make a request or lodge a concern, please contact us using the details provided below.

9. Cookies and Website Analytics

Our website may use cookies and similar technologies to improve user experience and analyse site traffic. You can control or disable cookies via your browser settings, though some site functionality may be affected.

We may also use analytics tools, such as Google Analytics, to collect anonymised usage data to help improve our website and marketing.

Please Note: Our websites may contain links to other sites that are not governed by this Privacy Policy. Please review the destination websites’ privacy policies before submitting personal information on those sites. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other sites.

10. Retention of Personal Information

Information Privacy Principle 9 under the Privacy Act 2020 provides that an agency that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.

We retain personal information to fulfil the purposes for which it was collected, or to meet legal, tax, or operational requirements, provide our services, stay in contact with you, and comply with applicable laws, regulations, and professional obligations to which we are subject.

Once no longer required, we securely destroy or anonymise the information.

For specific legal, regulatory, or contractual requirements, we may be required to retain personal information for up to seven years. Wherever possible, this personal information is anonymised.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The most recent version will always be available on our website. We encourage you to review it periodically.

12. Contact Us

Under Principle 3 of the Privacy Act 2020, we are required to provide you with our name and address because we collect and hold your personal information.

You can contact us using the details below if you have any questions or concerns regarding this Privacy Policy or the collection or handling of your personal information.

If you have any questions about this Privacy Policy, or wish to access or correct your personal information, please contact:

Privacy Officer

The Curiosity Company

12 Gurners Lane

Lincoln 7608

Email: privacy@curiositycompany.co.nz

Phone: +64 22 140 8700

We aim to respond within 14 working days from the date we receive privacy-related communications.

Policy Date: June 2025