Privacy Policy

Last updated: June 2026

Policybase is a community project providing free, openly-licensed policy templates for New Zealand schools. This policy explains how we collect, use, store, and disclose personal information through this website, policybase.co, in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).

This is an information website. We do not run a user platform, we do not ask you to create an account, and we do not host or process your school’s policy data.

Who we are

Policybase is operated from New Zealand. We are the “agency” responsible for personal information collected through policybase.co.

Contact details:

• Email: hello@policybase.co

What personal information we collect (IPP 1-4)

We only collect personal information that is necessary, and we collect it directly from you. The only personal information you give us is what you choose to send. That may include:

• Your email address (and any name you give) when you ask us to notify you about the templates, offer to contribute, or otherwise contact us by email.
• Template content you choose to contribute, which you send to us by email.
• Limited, non-identifying usage data through privacy-friendly analytics (see Cookies and analytics below).

We do not collect personal information by unlawful means, and we do not collect more than is reasonably necessary.

Why we collect it and how we use it (IPP 10)

We use your information only for the purpose it was collected:

• Letting you know when templates are released, if you have asked us to
• Responding to your enquiries and reviewing contributions you send us
• Understanding, in aggregate, how the site is used so we can improve it

We do not use personal information for purposes other than those for which it was collected, unless you consent or an exception under the Privacy Act 2020 applies. If you have asked to be notified about the templates, you can opt out at any time by emailing us. We will not add you to any other mailing list.

Disclosure to third parties (IPP 11)

We do not sell your data, and we do not share your personal information with third parties for marketing purposes.

We use a small number of service providers to operate the site (for example, email and website hosting, and analytics). They only handle information to the extent necessary to provide their service, and may be located in New Zealand or overseas; where information is sent overseas, the Cross-border disclosure section below applies.

We may disclose personal information if required by law, or to prevent a serious threat to health or safety.

Data storage and security (IPP 5)

We take reasonable steps to protect personal information from loss, and from unauthorised access, use, modification, or disclosure. This includes encryption in transit (TLS) and limiting access to the people who need it.

Cross-border disclosure (IPP 12)

If we disclose personal information to an overseas service provider, we take reasonable steps to ensure the information is protected in a way that is comparable to the protections under the Privacy Act 2020.

Your rights (IPP 6-7)

Under the Privacy Act 2020, you have the right to:

• Request access to the personal information we hold about you (IPP 6)
• Request correction of any information that is inaccurate, incomplete, or misleading (IPP 7)
• Request deletion of your personal information where we no longer need it

To exercise these rights, email hello@policybase.co. We will respond without undue delay. If we refuse a request, we will give you the reason and advise you of your right to complain to the Office of the Privacy Commissioner.

Retention (IPP 9)

We do not keep personal information for longer than is necessary for the purpose it was collected. If you ask us to remove your details, we will do so within a reasonable timeframe, unless we are required to retain the information by law.

Cookies and analytics

We use Plausible Analytics, a privacy-friendly analytics tool that does not use cookies and does not collect personal information. We do not use advertising or cross-site tracking cookies.

Children’s information

This website is aimed at schools and education professionals, not children. We do not collect personal information from children through this site. Our templates are generic documents; any personal information a school puts into a policy it adapts is handled by that school, not by us.

Privacy breaches (Part 6)

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the affected individuals and the Office of the Privacy Commissioner as soon as practicable, in line with Part 6 of the Privacy Act 2020.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

Complaints

If you are not satisfied with how we have handled your personal information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Contact

If you have questions about this policy, email hello@policybase.co.