Privacy and personal information

Your privacy is important to Canterbury Regional Council (referred to in this Privacy Statement as “we”, “our” or “us”).  

This Privacy Statement governs our collection, storage, use and disclosure of your personal information (as defined in the Privacy Act 2020 (Privacy Act)) and has been prepared in accordance with our obligations and your rights set out in the Privacy Act. This Privacy Statement does not limit or exclude any rights that you have or may have under the Privacy Act. It may be necessary to depart from this Privacy Statement if any exceptions in the Privacy Act apply.

In this Privacy Statement, “you” and “your” means the individual providing personal information to us or from whom or about who we are collecting personal information.

We may change this Privacy Statement from time to time by uploading a new Privacy Statement on our website. The use and disclosure of personal information collected from you is subject to the Privacy Statement in effect at the time such personal information is collected, unless otherwise agreed. This Privacy Statement was last updated on 25 May 2026,.

Why we collect your personal information

We only collect your personal information when it is necessary for a specific purpose connected with the services we provide or in connection with our statutory rights and obligations. The purpose for collecting and using your information varies according to the services we are providing, or the relevant statutory rights and obligations. The various purposes for collection that apply are described in the section entitled: What do we use your personal information for? 

What types of personal information do we collect?

Your personal information is any information about you. Your name, contact details, finance, purchase records, anything that you can look at and say, ‘this is about me’. 

• When we say ‘personal information’ we mean identifiable information about you, relating to your:  
• identity, including your name, marital status, title, date of birth and gender
• contact details, including your physical address, email address and telephone numbers
• transaction details, including details about payments to and from you, details on forms and submissions you provide and make, and other details of services you have requested
• technical information, including Google Analytics 4 (GA4) user ID, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites and services
• profile information, including requests made by you, your feedback and survey responses
• usage information, including information about how you use our website, facilities and services.

Your personal information also includes, written and photographic records related to compliance, non-compliance or alleged non-compliance by you of the legislation we administer, our directions and bylaws, either witnessed by the public or our officers.

We may also collect any other information provided by you in connection with, or specifically related to your communications with us or your use of our websites, services or facilities.

We may also receive information about you from third parties, including public sources. If you apply for a job with us, we may collect things such as a CV, Visa status, and data from psychometric testing. If you are hired, we may conduct a credit check, police screening or Ministry of Justice check.

We collect your bank account, tax code, emergency contact details, driver's licence details.

Where you work for an organisation that uses our websites, services or facilities, we may collect some personal information from you or which your organisation provides to us, such as your contact details at that organisation.

Our websites, services or facilities may also state other personal information that we collect from you.

When do we collect your personal information?

We may collect your personal information when you, or someone acting on your behalf, provides information to us directly. For example, when you:

• apply for employment with us
• communicate and correspond with us, whether in person, by letter, phone, text, email, instant messages or other means of electronic communication
• complete and submit forms for our services. For example: applications for consents, licences, approvals, permits, funding or other authorisations or for the use of any of our services or facilities, including signing up for and using our online services and apps, such as our online payment services
• prepare and submit a written submission, request or other feedback in relation to applications for consents, licences, approvals, permits, funding or other authorisations, or in relation to consultation on any form of draft or proposed plan, policy, bylaw or other document
• use any of our websites, services or facilities
• subscribe to our newsletter or update services
• follow or post comments in response to our social media or other facilities such as Facebook, X, LinkedIn, YouTube, Instagram, etc.

We may also:

• keep a record of any information that you acquire from us
• monitor and record phone calls made to or by us for quality control or staff training purposes. If a call you make to us, or that we may make to you, is to be monitored and recorded, you will be informed of this at the time of the call
• collect personal information about you from other organisations, entities or persons where you have authorised them to provide us with information or where the Privacy Act allows this.

We may also collect personal information from you or anyone else when it relates to an alleged offence or incident that we may investigate.

We also collect personal information from you indirectly, by using third parties to collect that personal information for us. We describe how this occurs in later sections of this Privacy Statement.

What information do we automatically collect when you visit our websites?

When you visit one of our websites, we may use technology solutions such as a cookie, beacon, pixel, or tag (collectively referred to in this Privacy Statement as cookies) to analyse website usage and to provide you with better access to tailored information and services and to better serve you when you return to them (eg by improving the speed and reliability of the websites). The information collected by cookies is also used in statistical and aggregate formats to assess the effectiveness of and to improve the websites and our services, and to also determine the preferences and interests of visitors to the websites.

Cookies are text files that identify your computer or mobile device to the cookie, so that when you visit the websites again, the cookie will identify your computer as returning to the websites. We set our own cookies and do not permit anyone to set third party cookies on our websites. Cookies in themselves do not identify individual users and are not used to collect or store personally identifiable information about you. However, the information they collect (e.g. your IP address (i.e. the location of your computer on the internet)) still constitutes personal information of the visitor.

You can choose to set your computer or device to notify you when a cookie is issued, or to reject any cookies, but the latter means that some of our services may not be able to be provided to you and the websites may not display its pages correctly.  

We use third party services for these purposes. Currently we use Google Analytics and Hotjar.  In respect of Google Analytics, we use GA4, a service that provides aggregated reports on website activity. GA4 relies on the use of first-party cookies. Through GA4, we collect and store statistical information about your visits, which may include:

• the search terms you used
• the pages accessed and the links you clicked
• the date and time you visited the site
• the referring website (if any) through which you clicked through to our website
• your operating system
• the type of web browser you use
• the make and model number of mobile device used to visit our site.

The information provided is aggregated and identifiers are masked so the information cannot be used to identify individuals. For full details on what information is collected via these cookies, and how it is stored and used, see Google's privacy policy.

Hotjar is used to help us understand how people use our websites so can improve user experience. Hotjar is headquartered in the European Union. For full details on what information is collected via cookies set using Hotjar, and how it is stored and used, see Hotjar’s privacy policy.

Our internet service providers may also make a record of your visit and log information for statistical purposes. This information is only analysed on a bulk basis for broad demographic content. Individual use is not analysed.

We do not attempt to identify users or their browsing activities unless they choose to give us personal information while using our website (i.e. by submitting a form).

Our websites (and this Privacy Statement) includes links to third party websites.  It is important to note that once you follow a link and leave our websites you are subject to the privacy and security policies of the website you are visiting. We do not have control over the privacy policies of other websites. 

What information do we collect when you visit our social media pages?

We also use third party social media services like Facebook, X, LinkedIn, YouTube, and Instagram. Your use of these third party services both publicly and in person messaging applications is entirely optional. We may make use of any information that you make available to us or which you make public when you use any such third party services for the purposes of our functions.

All third party services are governed by the privacy policies and/or practices of the relevant third party, for which we are not responsible. If you do not want to provide personal information to any of those third parties, or make information available to us and others, you should not use their particular service.

What information do we collect from CCTV?

We use Closed Circuit Television (CCTV) in particular areas to monitor such things as:

• behaviour in public-facing areas of our buildings, to keep people safe;
• coastal conditions to help manage the safe navigation of vessels and promote safe recreational boating; and
• access to our parks and reserves, to prevent and detect crime and to keep people safe.
  

Signage advising of CCTV equipment will in most instances give notice of areas covered by such equipment. CCTV footage will only be viewed by authorised people in accordance with the purpose noted above or to regularly check the system is operational. No attempt is made to identify individuals from CCTV footage except in relation to a reported or suspected incident requiring investigation.

What obligations apply to other persons’ personal information?

If you provide us with personal information relating to someone else (including others in your organisation) you warrant that you are authorised to do so and that you have ensured that the individual is aware of the information in this Privacy Statement. However, this obligation does not apply where you provide us with publicly available information.

If you provide us personal information about others, or if others give us your personal information, and such personal information is provided for a specific purpose, we will only use that personal information for the specific reason for which it was provided to us, or as otherwise permitted by the Privacy Act. In any other case, we may use that personal information as provided for in this Privacy Statement.

What do we use your personal information for?

We only collect your personal information for purposes connected with the websites, services and facilities we provide, our functions, or in connection with our statutory rights and obligations.

The personal information that we collect from you, or someone acting on your behalf, or your organisation, may be used for purposes such as:

• to provide you (or your organisation) with services or facilities, including:  
• those you have requested; and
• assisting our contractors and other government partners to provide such services or facilities to you
• to positively confirm your identity. This is to avoid inappropriate release or use of your information
• to respond to correspondence or to provide you with information that you have requested
• to process your application for any consent, licence, registration, approval, permit or other authorisation for which you have applied
• to process your application to use or to register for any of our services or facilities, including our online services
• to invoice you and process payments received by, or made by, us or provide refunds, including authorising and processing credit card transactions;
• to respond to your requests, enquiries or feedback, or for customer care related activities
• to provide you with information about our events, news, services or facilities, or the events, news, services or facilities of our contractors and other government partners that we consider may be of interest to you. Receiving this information is optional, and you can opt out at any time
• to take any action in any case of dispute, or legal proceedings of any kind between you and us, or between you and any other person with respect to our functions, including with our professional advisors and insurers;
• to protect our interests in our property, our legal rights, or those of others, including to detect, investigate, prevent or address fraud, security or technical issues, or if we have good reason to believe there is an imminent threat of death or injury or a serious threat to health and safety;
• to comply with our legal obligations, including where required, with tribunals and courts (including the coroner’s court), law enforcement authorities;
• to comply with, and enforce, relevant laws and regulations
• investigating and resolving issues with our services and facilities
• to carry out activities connected with the running of our functions or operations such as reviewing, analysing and improving our services, and our processes and users’ experience, and for personnel training or testing and maintenance of computer and other systems
• for any specific purpose which we notify you of at the time your personal information is collected
• to carry out surveys to improve our processes and operations, based upon your feedback
• for general administrative purposes.

Other sections of this Privacy Statement also set out other specific situations in which your information is collected, held, used and disclosed.

We may also use for our own purposes and make aggregated, anonymous data (ie data that cannot identify you) available to third parties.

We may use and disclose your Personal Information for any of these purposes, in any circumstances authorised by the Privacy Act, or in any other manner with your consent.

Who do we share your information with?

We may share your personal information with:

• any person engaged by us to provide services or facilities to you on our behalf, where your personal information is necessary for the provision of those services or facilities.  We do not permit these persons to use your personal information for their own purposes

We may also disclose your personal information to the following parties who may use it for their own purposes:

• a third party if we are required to do so under any laws or regulations, including to comply with our statutory obligations (for example, but without limitation, under the Local Government Official Information and Meetings Act 1987, Building Act 2004 and Resource Management Act 1991)
• a third party in the course of legal proceedings or other investigations. This may include sharing CCTV footage with the New Zealand Police or other public sector agencies such as New Zealand Customs Service or Maritime New Zealand where criminal activity is reported or suspected. These parties may also access live feeds from certain CCTV cameras from time to time, for law enforcement, investigation and emergency response purposes
• any person you authorise us to disclose your personal information to
• any person, if that information is held in a public register, e.g. information held on property files or the rating information database.
  

How we use Artificial Intelligence (AI)

We may use approved digital tools, including Artificial Intelligence (AI), to support our work. 

Read more about our use of Artificial Intelligence (AI), including our approach to privacy, governance, and human oversight.

How is your personal information used for making payments?

We currently use Windcave to facilitate your payments. Windcave will provide or make available to us any personal information collected by them as required to enable us to confirm payment and provide the services you have requested. Any credit card details stored for payments are done so on the Windcave system. No credit card information is stored by us. Please read Windcave’s privacy policy, available here, to understand the ways in which they collect, hold, use and disclose personal information.

How is your personal information used for marketing communications and surveys?

It is also important to note that we do not use your information for commercial marketing. However, where you have signed up to receive them, we send you information about our events, news, services or facilities, or the events, news, services or facilities of our contractors and other government partners that we consider may be of interest to you (“marketing communications”) and surveys.  

We use third parties to assist us to provide such marketing communications and surveys. We provide those third parties with your name and relevant contact information. Such third parties may be offshore, and may not be subject to privacy laws as comprehensive as New Zealand.  

Where marketing communications and surveys we initiate are sent by electronic means the relevant third party (where applicable) will collect information about your interaction with the communication. The information collected includes whether you opened the email, the links you clicked on, the webpages viewed and the dates and times of such access and activity. Information about the device used to access the marketing communication or survey may also be collected. The third party provides or makes available this information to us for the various purposes outlined in this Privacy Statement. They may also hold this information on our behalf.

While these third parties are primarily collecting this information on our behalf, some of these third parties also use the information that we provide them and which is collected from your interaction with the marketing communications and surveys for their legitimate business interests, such as to provide, support and improve the services they provide and to undertake data analytics projects. However, we do not use third parties that would use your personal information to market their or any other person’s services to you.

The third parties that we currently use for these purposes are Intuit (MailChimp), Momentive (SurveyMonkey/Wufoo) and Granicus (EngagementHQ). These third parties are headquartered in the United States. To understand the ways Intuit, Momentive and Granicus collect, hold, use and disclose such personal information, please read their privacy policies:

• Intuit privacy policy is available here;
• Momentive privacy policy is available here; and
• Granicus privacy statement is available here.
  

We consider that Intuit and Momentive are required (by virtue of their privacy policies) to protect the information shared in a way that, overall, provides comparable safeguards to those in the Privacy Act. Granicus has an office in New Zealand and so we consider it must also do so as it is subject to the Privacy Act. However, if you do not agree with how Intuit, Momentive or Granicus will handle your personal information then you will need to unsubscribe from receiving marketing communications and/or surveys from us. You may unsubscribe from receiving marketing communications and surveys from us in accordance with the unsubscribe facility in any email sending you marketing communications or surveys, or by contacting us in accordance with the contact details set out below.

We will not be able to provide marketing communications or surveys to you if you unsubscribe or do not agree to our use of third parties to assist us with marketing communications and surveys.

What information do we make public?

We are required by law to make certain information that we hold available to the public. This information may include your personal information. For example:

• the Resource Management Act 1991 requires us to make certain documents publicly available, including copies of resource consent applications, consent documents and submissions on our proposed plans.
• the Local Government (Rating) Act 2002 requires us to make publicly available our “complete rating information database”, which includes personal information of property owners
• the local electoral roll must be available for inspection in certain circumstances, under the Local Electoral Act 2001
• all submissions made to us during a special consultative procedure or other consultative procedure (for example submissions on proposed plan changes, consent applications and the long-term plan) are usually made available to the public under the Local Government Act 2002.
  

We also make publicly available information such as oblique flood imagery and aerial imagery, and imagery to help manage the safe navigation of vessels and promote safe recreational boating.

Our submission policy

Learn how we process submissions under the Local Government Act 2002, including Annual and Long-Term Plans.

 Download our submission policy (PDF file, 2.84MB)

How do we protect your information?

Except as otherwise stated in this Privacy Statement, your personal information we collect is held by us. Our address is set out below.  

Looking after your information is our priority. We are committed to protecting your personal information and take reasonable steps to ensure it is:

• protected against loss, damage, misuse, and unauthorised access. We restrict access to personal information to those individuals who need access to this information in order to assist us in performing our functions and obligations
• accurate, up to date, complete, relevant, and not misleading.
  

We take unauthorised attempts to upload information or change information seriously. Doing this is strictly prohibited and may result in criminal proceedings.

We may contract third parties to provide data hosting services, including storage of your personal information, and to provide software tools and services to us to enable us to undertake our functions and meet our obligations. Those third parties perform services on our behalf, process information for us, or hold it on our behalf. Those third parties may be based in other countries such as Australia or the United States. Appropriate safeguards are put in place to ensure adequate protection of information. We will not authorise any such third party to use your personal information for their own purposes.

How long will we keep your personal information?

The length of time we keep your personal information depends on what it is and whether we have an ongoing need to retain it (for example, to provide you with a service you’ve requested).

We may retain all personal information that we collect (on both our active systems and our archive systems), for as long as administratively necessary, in accordance with our information retention policies and disposal schedule.

To determine the appropriate retention period of your information, we consider the nature, sensitivity, appropriate legal obligations, the potential risk of harm from unauthorised disclosure, the purposes for which we process your information and whether these purposes can be achieved through alternative means.

We are required to keep records of our operations under the Public Records Act 2005, which requires us to retain “protected records” indefinitely. In some circumstances, your personal information may be included within a protected record, including submissions you make in relation to bylaws, annual plans, and district or regional planning instruments.

What happens if a privacy breach occurs?

If a serious privacy breach occurs, we will notify the Privacy Commissioner and affected individuals as required by the Privacy Act.

What if you do not want to provide the personal information requested?

If you do not provide us with all of the personal information about you that we request, we may not be able to adequately respond to your correspondence, process any applications you have submitted, provide the services or facilities you have requested, process payments or otherwise deal with any requests or enquiries you have submitted.

In some circumstances, personal information may be required to be provided under laws, and the failure to provide such information when requested may be unlawful, and/or result in legal consequences. These laws, circumstances and the potential consequences will be explained to you when your personal information is requested.

What are your rights?

You have the right to ask why the information is being collected and what is its use.

You also have the right to know what information we hold about you, to request a copy, and to request that we correct your information if you consider that it is inaccurate.

Your rights of access to and correction of any personal information we hold about you are subject to the procedures set out in the Privacy Act.

• Accessing your information or obtaining a copy of your information: You may request confirmation of whether or not we hold any personal information about you and you may request access to your personal information that we hold. If you request access to your information, we take steps to confirm your identity. This might involve asking you some security questions and checking your identity documents. Once we have verified your identity we will provide you with such confirmation and access unless one of the grounds for refusal to do so under the Privacy Act applies.
• Updating and correcting your information: If you think the information we hold about you is inaccurate, you may request changes to your personal information. If we agree that your personal information is to be corrected, we will provide you with an amended record of your personal information if requested. If we do not agree that the information needs to be corrected, we'll make a note of your request on the disputed information as a "statement of correction".
  

We will endeavour to respond to your request as quickly as possible and no later than 20 working days after you make your request. Email us or use the postal address provided below to make a request.