Privacy Notice
Introduction
Introduction
WATG (Wimberly Allison Tong & Goo) is a global architecture, design, and planning firm operating through a network of offices and project teams around the world. At WATG Holdings, Inc. and our subsidiaries and affiliates (“WATG,” “we,” “us,” or “our”), we are committed to protecting your privacy and ensuring transparency in how we handle personal data.
This Privacy Notice explains how WATG collects, uses, shares, and protects your personal data when you interact with us—whether you’re visiting our website www.watg.com, working with us on a project, applying for a job, or partnering with us as a vendor.
We operate globally and comply with data protection laws wherever we work, including GDPR (Europe/UK), CCPA (California), PDPA (Singapore), and PIPL (China). Regardless of location, we are committed to applying high standards of data protection.
Your Rights and Our Responsibilities
This Privacy Notice explains what personal data we collect, how we use and share it, the security measures we implement to protect it, your privacy rights, and how to exercise them, and how we handle international data transfers. We are committed to handling personal data transparently, lawfully, and securely across all regions where we operate.
If you have any questions about this Privacy Notice or our privacy practices, please contact us using the information provided in Section 11.
Personal Data We Collect
Personal Data We Collect
The types of personal data we collect depend on your relationship with us:
For Clients and Prospective Clients
Contact and Identification Information
- Full name, title, and occupation
- Business email addresses
- Telephone and mobile numbers
- Business addresses, city, state/province, country, and postal codes
- Company name and organizational affiliation
- Social media handles and professional networking profiles
Professional Information
- Job title and role within organization
- Company details and business registration information
- Professional credentials and industry affiliations
- Nationality (where required for project or compliance purposes)
Financial and Due Diligence Information
- Credit history and creditworthiness information (for due diligence)
- Business licenses and professional certifications
- Identification documents (driver’s license, passport) for identity verification and sanctions screening
For Website Visitors
Automatically Collected Information
- IP address and approximate location
- Browser type and version
- Device information and operating system
- Referring website and exit pages
- Date and time of visit
- Pages viewed and content accessed
- Click patterns and navigation history
Voluntarily Provided Information
- Name and email address (contact forms, newsletter signups)
- Company name and telephone number
- Country and region
- Event registration details
For Vendors, Suppliers, and Business Partners
Contact Information
- Full name, email address, phone number
- Business address and location
- Company name and registration details
Professional Information
- Role and job title
- Professional licenses and certifications
- Portfolio and past work examples
Financial Information
- Bank account details and routing numbers
- Billing addresses
- Tax identification numbers
- Payment preferences and currency
Compliance Information
- Business licenses and insurance certificates
- Tax forms (W-9, W-8, local equivalents)
- Government-issued identification (for verification purposes)
- Passport information (for international projects requiring travel)
For Job Applicants
Application Information
- Full name, contact details (email, phone, address)
- Date of birth and nationality
- Resume/CV and cover letter
- Educational qualifications and certifications
- Employment history and professional experience
- Portfolio and work samples
- Academic records and transcripts
Background and Verification Data (where legally permitted)
- Professional licenses and certifications
- Academic credentials verification
- Employment record verification
- Immigration status and work authorization
- Government-issued identification documents
Diversity and Equal Opportunity Data (voluntary)
- Demographic information collected for equal opportunity monitoring
- Collected separately with explicit consent
- Processed in accordance with applicable law
HOW WE COLLECT YOUR PERSONAL DATA
How We Collect Your Personal Data
We collect personal data so we can deliver our services, communicate with you, and improve how our platforms work. The type of data we collect depends on how you interact with us. In general, we collect personal data from three sources:
From you, directly
You provide personal data when you interact with us directly — online, by email, by phone, or in person. For example, this may happen when you:
- Engage our architectural, design, or planning services, including initial consultations or project inquiries
- Respond to marketing activities, such as web forms, downloading whitepapers, participating in surveys, attending events or conferences, subscribing to newsletters or updates
- Apply for a job or express interest in working with us
- Contact us with questions or use customer support tools
- Exchange business cards at industry or networking events
- Provide feedback or testimonials, or complete client satisfaction surveys
- Submit proposals, respond to requests for proposals, or participate in contract discussions
Sometimes you may provide personal data about colleagues, project team members, or references. When you do, we rely on you to confirm that you have permission to share their information, and it can be used in line with this Privacy Notice.
Automatically, through your device or browser
We automatically collect certain information when you visit our website, open our emails, or interact with our digital content. This helps us keep our services secure, understand what works, and improve your experience. This information may include:
- Device and technical details, such as device type and operating system, browser type and version, IP address and device identifiers, and general location (city and country level)
- Usage and interaction data, such as pages viewed and features used, links clicked and navigation patterns, content viewed or downloaded, and dates, times, and referral sources
We collect much of this data using cookies and similar tracking technologies. Some of our business partners or service providers may also use these technologies when you interact with our content.
From trusted third parties
As part of operating a global architecture and design practice, we may receive personal data from trusted third parties, including business partners and clients, publicly available sources, due diligence and compliance providers, recruitment and staffing sources, and service providers and technology platforms.
We require all third parties who provide us with personal data to comply with applicable data protection laws, use the data only for the purposes we specify and protect it through appropriate security and confidentiality measures through contracts, data processing terms, and safeguards.
HOW WE USE YOUR PERSONAL DATA
How We Use Your Personal Data
We use personal data for specific purposes related to delivering our services, managing business operations, and maintaining professional relationships. Usage depends on your relationship with us.
- Delivering Services and Managing Projects – Design and deliver architectural services, document designs, coordinate construction, manage permitting, oversee quality, and support projects through completion.
- Client Relationship Management – Respond to inquiries, prepare proposals, execute contracts, manage client records, schedule milestones, and share updates.
- Financial Operations – Invoice clients, process payments, maintain financial records, track budgets, and meet tax and accounting requirements.
- Due Diligence and Compliance – Onboard clients, perform KYC and compliance checks, verify credentials, assess creditworthiness when needed, and comply with applicable laws.
- Marketing and Business Development – Where consent is required, understand client needs, share insights and case studies, send updates, invite you to events, and conduct surveys.
- Research and Analysis – Conduct research, analyze trends, and improve services and operations.
- Recruiting and Hiring – Review applications, interview candidates, verify references, conduct background checks where permitted, make hiring decisions, and comply with employment laws.
- Website and Digital Experience – Operate and secure our website, process forms and downloads, manage subscriptions, analyze usage, and improve performance.
- Legal and Regulatory Purposes – Protect legal rights, respond to lawful requests, handle regulatory inquiries, prevent fraud, and meet professional obligations.
HOW WE DISCLOSE YOUR PERSONAL DATA
How We Disclose Your Personal Data
We do not sell your personal data.
We share personal data only when it’s necessary to provide our services, comply with the law, or protect our legitimate business interests. Below we explain when sharing happens, who we share data with, and why.
Service Providers – We work with trusted partners who help us run our business and deliver services, such as:
- Technology and cloud providers that support our systems and communications
- Platforms that help manage client relationships and business operations
- Professional advisors, including legal, compliance, recruitment, and research partners
Project Partners – To deliver architectural and design services, we may share limited information with:
- Clients and project representatives
- Partners, co-design firms, and specialized consultants
- Suppliers and manufacturers involved in project coordination
Government and Regulatory Authorities – We share personal data when required by law, including with:
- Tax, labor, and employment agencies
- Professional licensing and registration bodies
- Immigration authorities, where applicable
Legal and Compliance Matters – We may disclose data to courts, regulators, or advisors to respond to legal requests, investigations, or to protect our rights. We review all requests carefully and share only what is required.
Research and Surveys – If you participate in research:
- Responses may be shared with the organization that commissioned the research
- Published results are anonymized and shared only in aggregate
Business Transactions- If we’re involved in a merger, acquisition, or sale, personal data may be shared under confidentiality obligations. Any successor organization must honor this Privacy Notice.
COOKIES AND SIMILAR TECHNOLOGIES
Cookies and Similar Technologies
Our website uses cookies, which are small text files stored on your computer or mobile device, to enhance your browsing experience and help us understand how our website is used. Cookies enable core site functionality, remember your preferences, analyze usage patterns, and support the continuous improvement of our services.
YOUR RIGHTS
Your Rights
Depending on your location and subject to applicable law, you may have the following rights regarding your personal data:
- the right to access the personal data held about you;
- the right to ask us not to process your personal data for marketing purposes;
- the right to withdraw at any time any consent you have given to receive marketing material from us, or in any other case where we process your personal data on the basis of a consent that you have given (and not on some other legal basis);
- the right to ask us to rectify inaccurate personal data about you;
- the right to ask for the restriction of personal data concerning yourself that is inaccurate, unlawfully processed, or no longer required;
- the right to ask for the transfer of your personal data in a structured, commonly used and machine-readable format where the processing is based on your consent;
- the right the right to ask for the erasure of personal data concerning yourself where processing is no longer necessary, or the legitimate interests we have in processing your personal data are overridden by your interests, rights, and freedoms as the data subject;
- and the right to make a complaint about the Information Commissioner’s Office.
To exercise any of these rights, contact us by emailing privacy@watg.com. We may request verification of your identity before processing your request to protect your personal data from unauthorized access.
CROSS-BORDER TRANSFER
Cross-Border Transfer
As a global firm, WATG operates across multiple countries and may transfer personal data internationally to fulfil our services and business operations, collaborating with global project teams and consultants, centralized IT infrastructure and data storage, group-wide business operations and administration, recruitment for positions in different offices, and vendor and supplier management across regions
When transferring personal data from China, Singapore, the EEA, or UK to countries outside these regions, we ensure overseas recipients provide comparable levels of protection, implement contractual safeguards, and apply appropriate security measures
If you have questions about international data transfers or would like more information about the safeguards we use, please contact us at privacy@watg.com.
RETENTION OF YOUR PERSONAL DATA
Retention of Your Personal Data
We keep your personal data only for as long as it is needed to provide our services, comply with legal obligations, and operate our business responsibly. How long we retain information depends on a few factors, including how recently you have interacted with us, whether we are required to keep it for legal, regulatory, or accounting reasons, and whether retention is necessary under applicable laws or agreements.
When personal data is no longer needed for these purposes—or when we are no longer required to keep it—we take reasonable steps to remove it. This may include deleting it, securely destroying it, or, where allowed by law, aggregating or anonymizing the data so it can no longer be linked to you.
AUTOMATED DECISION MAKING
Automated Decision Making
We may use AI-assisted tools for activities like due diligence research, survey analysis, and candidate screening support. These tools assist human decision-makers—they do not make decisions with legal or significant effects on their own. Where applicable, you have the right to opt out of automated decision-making.
MINORS
Minors
Our website and services are not directed at anyone under 18. We never knowingly collect data from minors. If we learn we have inadvertently collected such data, we will delete it promptly.
QUESTIONS ABOUT THIS PRIVACY NOTICE
Questions About this Privacy Notice
If you have questions or comments about this Privacy Notice or how we handle personal data, please contact us:
Email: privacy@watg.com
Data Protection Officer: Chris Groves
Address: WATG Atlantic City
1020 Atlantic Avenue,
Atlantic City, NJ 08401
CHANGES TO THIS PRIVACY NOTICE
Changes to this Privacy Notice
We may revise this notice from time to time at our sole discretion. If any significant updates are made, and where required by law, we will request your approval before those updates take effect. Changes introduced in a revised notice will apply only to information collected after the new version is published.
The date of the most recent update can be found below:
Last Revision Date: March 19, 2026
ADDITIONAL INFORMATION FOR RESIDENTS OF CERTAIN JURISDICTIONS
Depending on where you reside, the following jurisdiction-specific disclosures may apply to the personal data we collect from website visitors, clients and prospective clients, vendors and business partners, and job applicants. These disclosures supplement, and should be read together with, our general Privacy Policy.
United States — California
California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”)
If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), provides you with specific rights regarding your personal information.
Sale and Sharing of Personal Information
WATG does not “sell” personal information as that term is defined under the CCPA. WATG does not “share” personal information for cross-context behavioral advertising purposes as that term is defined under the CCPA.
Your California Privacy Rights
Subject to certain exceptions, as a California resident you have the following rights under the CCPA:
- Know the personal information we collect about you, including the categories, sources, purposes, and third parties with whom it is disclosed
- Delete your personal information, subject to applicable legal exceptions
- Correct inaccurate personal information we maintain about you
- Opt out of the sale or sharing of your personal information (WATG does not sell or share personal information as defined under the CCPA)
- Limit the use and disclosure of sensitive personal information to purposes permitted by law
- Not be discriminated against for exercising your CCPA rights
California “Shine the Light”
Under California Civil Code Section 1798.83 (“Shine the Light” law), California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us, once per calendar year, information about the personal information we shared, if any, with other businesses for their own direct marketing purposes. If applicable, this information would include the categories of personal information and the names and addresses of those businesses with which we shared personal information for the immediately prior calendar year. To obtain this information, please contact us using the details provided at the end of this policy.
European Union / European Economic Area and United Kingdom
General Data Protection Regulation (EU) 2016/679 (“GDPR”), UK General Data Protection Regulation (“UK GDPR”) & Data Protection Act 2018
If you are in the European Economic Area (“EEA”), the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies to processing your personal data. Wimberly Allison Tong & Goo, Inc. (“WATG”) acts as the data controller for the processing activities described in our Privacy Policy.
LEGAL BASES FOR PROCESSING
We process your personal data on the following legal bases, depending on the context of processing:
- Performance of a contract, where processing is necessary to perform our contractual obligations to you, such as delivering design and planning services or managing vendor engagements.
- Legitimate interests, where processing is necessary for our legitimate business interests, such as business development, client relationship management, due diligence, marketing our services, and improving our operations, provided these interests are not overridden by your rights.
- Consent, where you have given us your freely given, specific, informed, and unambiguous consent, submitting an inquiry through our website, or consenting cookies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Legal obligation, where processing is necessary for us to comply with applicable legal or regulatory obligations.
INTERNATIONAL TRANSFERS
We may transfer personal data from the EEA to other countries, including the United States, Singapore, China, and the United Arab Emirates.
YOUR RIGHTS
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete personal data
- Erase your personal data (“right to be forgotten”)
- Restrict processing of your personal data
- Data portability (receive your data in a structured, machine-readable format)
- Object to processing based on legitimate interests or direct marketing
- Withdraw consent at any time
- Not be subject to a decision based solely on automated processing, including profiling
SUPERVISORY AUTHORITY
You have the right to lodge a complaint with a data protection supervisory authority in the EEA member state where you reside, where you work, or where the alleged infringement occurred. A list of supervisory authorities is available on the European Data Protection Board website at edpb.europa.eu.
People’s Republic of China
Personal Information Protection Law (“PIPL”), Data Security Law & Cybersecurity Law
If you are in the People’s Republic of China (“PRC”), the Personal Information Protection Law (“PIPL”), the Data Security Law, and the Cybersecurity Law apply to our processing of your personal information. WATG maintains an office in Shanghai and processes the personal information of employees, clients, prospective clients, vendors, and job applicants located in the PRC.
Legal Bases for Processing
We process your personal information based on one or more of the following grounds under Article 13 of the PIPL:
- Where necessary to conclude or perform a contract to which you are a party, or where necessary for human resource management pursuant to lawfully established employment rules and collective contracts
- Where necessary to fulfil statutory duties or obligations
- Where necessary to respond to a public health emergency or to protect the safety of natural persons in an emergency
- Where you have given your separate and informed consent
Cross-Border Transfers
We transfer personal information collected in the PRC to recipients located outside of China, including the United States, United Kingdom, and Singapore. We carry out such transfers in accordance with the PIPL’s cross-border transfer requirements, which may include entering into the Standard Contract for Cross-Border Transfer of Personal Information published by the Cyberspace Administration of China (“CAC”).
Your Rights
Under the PIPL, you have the right to:
- Know about the personal information we process and how it is handled
- Access the personal information we hold about you
- Correct inaccurate or incomplete personal information
- Delete your personal information, subject to applicable legal conditions
- Restrict the processing of your personal information
- Request the portability of your personal information, where applicable
- Withdraw your consent at any time
- Request an explanation of the rules governing automated decision-making
Singapore
Personal Data Protection Act 2012 (“PDPA”)
If you are in Singapore, the Personal Data Protection Act 2012 (“PDPA”) applies to our collection, use, and disclosure of your personal data. WATG maintains an office in Singapore and processes the personal data of employees, clients, prospective clients, vendors, and job applicants located in Singapore across a wide range of operational activities.
Consent and Notification
We collect, use, and disclose your personal data with your consent, unless an exception under the PDPA applies. You may withdraw your consent at any time by contacting us, subject to legal and contractual restrictions and reasonable notice.
Cross-Border Transfers
We transfer personal data from Singapore to recipients in other countries, including the United States, United Kingdom, and China. We ensure that recipients provide a comparable standard of protection to the personal data transferred, in accordance with the PDPA’s transfer limitation obligation, through contractual arrangements or other legally recognized mechanisms.
Your Rights
Under the PDPA, you have the right to:
- Access the personal data we hold about you
- Know how your personal data has been used or disclosed during the preceding year
- Correct inaccurate personal data we maintain about you
- Request the portability of your personal data, where applicable
India
Digital Personal Data Protection Act, 2023 (“DPDPA”)
If you are in India, the Digital Personal Data Protection Act, 2023 (“DPDPA”) applies to our processing of your personal data. We process personal data of individuals located in India in connection with vendor engagement, recruitment, client services, and project management.
Notice and Consent
We obtain your consent for processing unless an exemption applies, such as where processing is necessary for a legitimate use related to the performance of a contract, compliance with applicable law, or an employment-related purpose.
Your Rights
Under the DPDPA, you have the right to:
- Access information about your personal data being processed
- Correct inaccurate or incomplete personal data
- Erase your personal data, subject to applicable legal conditions
- Nominate another individual to exercise your rights in the event of your death or incapacity
- Seek grievance redressal
To exercise these rights, please contact us using the details provided at the end of this section.
Cross-Border Transfers
We may transfer your personal data outside of India. We implement appropriate contractual and organizational safeguards to protect the data during such transfers.
Japan
Act on the Protection of Personal Information (“APPI”)
If you are in Japan, the Act on the Protection of Personal Information (“APPI”) applies to our handling of your personal information. We process the personal information of clients, prospective clients, and business partners located in Japan in connection with our architectural design and project management services.
Purpose of Use
We use your personal information for the purposes disclosed in our Privacy Policy, including project delivery, client communications, business development, and compliance with applicable laws. We will not use your personal information beyond the scope necessary to achieve these purposes without obtaining your prior consent.
Cross-Border Transfers
We transfer personal information from Japan to third countries, including the United States, United Kingdom, and Singapore.
Your Rights
Under the APPI, you have the right to:
- Request disclosure of the personal information we hold about you
- Correct, add to, or delete your personal information
- Request the cessation of use of your personal information
- Request the erasure of your personal information
- Request the cessation of provision of your personal information to third parties
- Request disclosure of records relating to third-party transfers
South Korea
Personal Information Protection Act (“PIPA”)
If you are in South Korea, the Personal Information Protection Act (“PIPA”) applies to our processing of your personal information. We process the personal information of clients, prospective clients, vendors, and job applicants located in South Korea in connection with our design services, project management, and recruitment activities.
Collection and Use
We collect and use your personal information in accordance with the purposes notified to you at the time of collection or as subsequently consented to. We process only the minimum personal information necessary for each purpose.
Cross-Border Transfers
We transfer personal information from South Korea to recipients outside of the country. We inform you of the identity of the recipient, the purpose of transfer, the items of personal information transferred, and the country of the recipient, and we obtain your consent or rely on other permitted legal grounds as required under PIPA.
Your Rights
Under PIPA, you have the right to access, correct, delete, and suspend the processing of your personal information. You may also designate an agent to exercise these rights on your behalf.
Thailand
Personal Data Protection Act B.E. 2562 (2019) (“Thailand PDPA”)
If you are in Thailand, the Personal Data Protection Act B.E. 2562 (2019) (“Thailand PDPA”) applies to our processing of your personal data. We process the personal data of employees, clients, prospective clients, vendors, and job applicants located in Thailand in connection with recruitment, onboarding, project management, and design services.
Cross-Border Transfers
We transfer personal data from Thailand to countries that may not have equivalent data protection standards. We ensure adequate safeguards are in place, including appropriate contractual protections, and we comply with the Thailand PDPA’s requirements for cross-border data transfers.
Your Rights
Under the Thailand PDPA, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete personal data
- Delete your personal data, subject to applicable legal conditions
- Restrict the processing of your personal data
- Request the portability of your personal data, where applicable
- Withdraw your consent at any time
- Object to the processing of your personal data
- Lodge a complaint with the Personal Data Protection Committee
Indonesia
Personal Data Protection Law (Law No. 27 of 2022) (“PDP Law”)
If you are in Indonesia, the Personal Data Protection Law (Law No. 27 of 2022, the “PDP Law”) applies to our processing of your personal data. We process the personal data of employees, vendors, clients, and job applicants located in Indonesia in connection with payments, onboarding, recruitment, and project management.
Legal Bases
We process your personal data on the basis of your consent, the performance of a contract to which you are a party, our legitimate interests, or compliance with legal obligations. Where we process sensitive personal data, we obtain your explicit written consent.
Cross-Border Transfers
We transfer personal data from Indonesia to other countries. We ensure that the receiving country provides an equivalent level of personal data protection or that adequate safeguards are in place through binding agreements with the data recipient, in compliance with the PDP Law’s requirements.
Your Rights
Under the PDP Law, you have the right to be informed, to access, to correct, to delete, to restrict, and to withdraw your consent to the processing of your personal data. You also have the right to object to processing based on automated decision-making, the right to data portability, and the right to sue and receive compensation for violations of the PDP Law.
Malaysia
Personal Data Protection Act 2010 (“Malaysia PDPA”)
If you are located in Malaysia, the Personal Data Protection Act 2010 (“Malaysia PDPA”) applies to our processing of your personal data in commercial transactions. We process personal data of employees, vendors, clients, and job applicants located in Malaysia.
Notice and Choice
We provide you with written notice in both the Malay and English languages regarding the purposes for which your personal data is processed, your right to request access and correction, the categories of third parties to whom your data may be disclosed, and whether the supply of the personal data is obligatory or voluntary.
Cross-Border Transfers
We transfer personal data from Malaysia to countries outside Malaysia. We comply with the Malaysia PDPA’s cross-border transfer restrictions and ensure that any transfer is made only to places that have been specified by the Minister, or with your consent, or in circumstances where the transfer is necessary for the performance of a contract.
Your Rights
Under the Malaysia PDPA, you have the right to access your personal data, request correction of personal data that is inaccurate, withdraw your consent to processing, and prevent processing that is likely to cause damage or distress.
Australia
Privacy Act 1988 (Cth) & Australian Privacy Principles (“APPs”)
If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”) apply to our handling of your personal information. We process the personal information of clients, prospective clients, vendors, and job applicants located in Australia.
Collection
We collect personal information that is reasonably necessary for our business functions and activities. Where practicable, we collect personal information directly from you. We do not collect sensitive information unless you consent, and it is reasonably necessary for our functions, or we are required by law to collect it.
Cross-Border Disclosure
We disclose personal information to recipients located overseas, including in the United States, United Kingdom, and Singapore. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to the information, or we obtain your informed consent, or the disclosure is required or authorized by law (APP 8).
Your Rights
You may request access to the personal information we hold about you and request correction of any inaccurate, out-of-date, incomplete, irrelevant, or misleading information. If you are dissatisfied with our handling of your request, you may lodge a complaint with the Office of the Australian Information Commissioner (“OAIC”) at oaic.gov.au.
New Zealand
Privacy Act 2020 & Information Privacy Principles (“IPPs”)
If you are located in New Zealand, the Privacy Act 2020 and its Information Privacy Principles (“IPPs”) apply to our handling of your personal information. We process the personal information of clients, prospective clients, and job applicants located in New Zealand.
Cross-Border Disclosure
We disclose personal information to recipients located outside New Zealand. Before doing so, we ensure that the recipient is subject to privacy laws that provide comparable safeguards, is required by contract to protect the information in a manner comparable to New Zealand’s IPPs, or we have obtained your authorization after informing you that the recipient may not be required to protect your information in a way comparable to the IPPs (IPP 12).
Your Rights
You have the right to request access to and correction of your personal information. You may also lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.
Notifiable Privacy Breaches
In the event of a privacy breach that is likely to cause serious harm, we will notify both the affected individuals and the Office of the Privacy Commissioner as soon as practicable.