Privacy policy | Kaupapa Here Matatapu

1.1 At Problem Gambling Foundation of New Zealand ("PGF"), we care about privacy. This privacy statement sets out how we collect, use, disclose and protect your personal information as well as how you can access and correct any information we hold about you. We comply with the Privacy Act 2020 (“Privacy Act”) and, because we are a health agency, with the Health Information Privacy Code 2020 (“the Code”) in relation to health information.

1.2 In this Privacy Statement, "our website" means each of the websites we operate – pgf.nz, touchgrass.org.nz and beingplayed.info – and any other website we operate that links to this statement, together with the services provided through them, including our AI chat, our live chat and our online forms.

2.1 The term personal information covers any information about an identifiable individual.

2.2 Personal information may also constitute “health information”, being information about your health.

2.3 Young people

Our websites, including touchgrass.org.nz, may be used by people under 18. You do not need a parent or guardian’s permission to read our information or to talk to us. When we collect personal information from a young person we take particular care to collect only what we need, to explain what we are doing in a way that is easy to understand, and to consider the young person’s best interests. If you are a parent or guardian with a question about a young person’s information, you can contact us using the details in section 11. A young person’s own views about their information will be taken into account.

3.1 We may collect the following types of personal information:

(a) Your personal details including name, email address, address, age and ethnicity.

(b) Information relating to yours or another person’s gambling, gaming or screen use, including activity completion and assessment results.

(c) Information to support your personal use of our website including journal entries, personal reflections, gambling spending tracker entries, gambling time tracker entries, gambling urge tracker entries.

(d) Information about how you use our website.

(e) Information about your device.

(f) Information you provide in our AI chat or live chat, including the transcript of the conversation.

4.1 We collect your personal information as follows:

(a) If you create an account with us.

(b) If you provide any information through online forms.

(c) For people using our online chat service anonymously, a transcript is created by the chat programme.

(d) If you otherwise access our services (registered clients) in person, by telephone, online chat or email. Our funding contract with Health New Zealand requires us to collect a minimum set of information: you name or an anonymous identifier, basic demographic details, the results of screening questions and the type of gambling involved.

(e) We gather information through the use of cookies (see Do we use Cookies? below).

(f) If you use our AI chat on touchgrass.org.nz, you are talking to an automated system, not a person. Replies are generated by an artificial-intelligence service provided by Anthropic (United States). Only the text you type is sent to that service – no name, contact details or account information – and Anthropic does not use these conversations to train its AI models. Conversations are stored in our content system (provided by Sanity, United States) so that PGF staff can review them for safety and quality, and are used to produce the reports on how the service is used, such as the number of conversations and the themes raised.

(g) Where you use our chat services without giving your name, we do not ask who you are, but what you tell us, together with technical information created by our systems, may still be capable of identifying you in some circumstances. We treat it as personal information and protect it accordingly.

5.1 We use your personal information in order to:

(a) Provide our services to you.

(b)To communicate with you. If you sign up to receive emails from us, we will only send you the kind of email you signed up for, and every email will include a way to unsubscribe.

(c) Receive funding from Health New Zealand which helps us to help you.

(d) Help us to get an overall picture of how gambling, gaming, and screen use problems affect different groups of people in different parts of New Zealand.

(e) To analyse our services, including how our website is used and, where you have consented to analytics cookies, the general demographics and interests of visitors as reported by Google Analytics.

(f) To review AI chat and live chat conversations where there is a concern for someone’s safety, and to improve the quality and safety of those services.

(g) Any other uses to which you consent.

6.1 Except as provided below we do not share any of your personal details like name, address, and contact details with any other individual or organisation without your permission.

6.2 We may share your personal information with third parties who provide services for us, and some of them hold information outside New Zealand. Our main systems – Microsoft 365, our client database (Salesforce) and our backups – are held in Australia. Our websites use services in the United States for hosting, content management, analytics, error monitoring and email delivery, and (on touchgrass.org.nz) for the AI chat. Our live chat runs in Australia. The providers, what each one does for us, where it holds information and a link to its privacy policy are listed below.

Microsoft (Microsoft 365 and Azure) - our email, documents and internal systems, managed for us by Cloudland Limited (New Zealand) - Australia – privacy.microsoft.com/privacystatement (https://privacy.microsoft.com/privacystatement)

Datto – backups of our Microsoft 365 data, arranged by Cloudland – Australia – datto.com/legal/privacy (https://datto.com/legal/privacy)

Salesforce – our client database and the counselling requests sent from pgf.nz - Australia – salesforce.com/company/privacy (https://salesforce.com/company/privacy)

Zoho – live chat (SalesIQ) on pgf.nz and touchgrass.org.nz, and our newsletter – Australia – zoho.com/privacy.html (https://zoho.com/privacy.html)

Google – website analytics and tag management on all our websites, reCAPTCHA on our forms, Google Fonts, and Google Ads on pgf.nz - United States – policies.google.com/privacy (https://policies.google.com/privacy)

Mailgun (Sinch) - delivers the email notifications generated by pgf.nz forms – United States – mailgun.com/legal/privacy-policy (https://mailgun.com/legal/privacy-policy)

Netlify – hosts touchgrass.org.nz and holds its referral form submissions – United States – netlify.com/privacy (https://netlify.com/privacy)

Sanity – the content system behind touchgrass.org.nz, which also stores the AI chat conversations – United States – sanity.io/legal/privacy (https://sanity.io/legal/privacy)

Anthropic – the artificial-intelligence service behind the touchgrass.org.nz chat – United States – anthropic.com/legal/privacy (https://anthropic.com/legal/privacy)

Microsoft Clarity – how visitors move around touchgrass.org.nz (no typed text is recorded) - United States – privacy.microsoft.com/privacystatement (https://privacy.microsoft.com/privacystatement)

Raygun – error monitoring on touchgrass.org.nz - United States – raygun.com/privacy-policy (https://raygun.com/privacy-policy)

Wix – hosts beingplayed.info - United States – wix.com/about/privacy (https://wix.com/about/privacy)

Sentry – error monitoring on beingplayed.info - United States – sentry.io/privacy (https://sentry.io/privacy)

Tiktok – advertising measurement on beingplayed.info - Singapore and United States – tiktok.com/legal/page/row/privacy-policy (https://tiktok.com/legal/page/row/privacy-policy)

Gamban Limited – if you take up a free Gamban licence through us – United Kingdom – gamban.com/privacy-policy (https://gamban.com/privacy-policy)

6.3 If there is a concern about your own safety or that of others, we may need to disclose your personal information to other services, e.g. Health Services, the Police, etc. We always attempt to seek your agreement first and act ethically in your best interests.

6.4 We have to release your information where we are required to do so by law including to the Courts, if they subpoena your information.

6.5 Health New Zealand requires us to disclose statistical, non-identifying information and also does regular audits of our service.

6.6 We occasionally work with researchers who may be conducting research projects. We seek your permission prior to disclosing any personal information though, and all care is taken to remove identifying information before we share anything with these organisations.

7.1 We also use reasonable technical and organisational measures to protect your personal information. This includes:

(a) Storing it in encrypted files.

(b) Technical protections on our websites and systems, including encryption of information in transit, restricting our content and administration systems to named users, multi-factor authentication and managed endpoint protection on our internal Microsoft environment, and regular backups held in Australia.

(c) Access to website information is restricted to authorised users with appropriate permissions

(d) We require authorised users and service providers with administrative access to maintain the confidentiality of information and comply with applicable privacy and security obligations.

(e) If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act requires.

8.1 Cookies are text files that are stored on your computer or device when you visit certain web pages. We may use cookies to:

(a) Remember your preferences and settings;

(b) Personalise your use of our services;

(c) Enable us to improve the content, reliability and functionality of our website;

(d) Enable you to use certain services or functionality;

(e) Evaluate the effectiveness of our content; and

(f) Track and understand usage.

(g) The cookies we use fall into two groups: (a) cookies that are necessary for the website to work, including those that run our live chat; and (b) cookies used to understand how our websites are used and, on some sites, to measure advertising — set by Google Analytics on all our websites, Google Ads on pgf.nz and TikTok on beingplayed.info [, and Microsoft Clarity on touchgrass.org.nz]. [We ask for your consent before setting the second group, and you can withdraw it at any time through the cookie settings on our website.]

8.2 Accepting a cookie will not give us access to any data on your computer other than the data stored in the cookie.

8.3 You can set most internet browsers to notify you when you receive a cookie and to give you the opportunity to decide whether or not to accept it. You can also disable all cookies generally.

8.4 In some instances you may be required to accept certain cookies in order to use our services.

9.1 You have the right to access and correct your personal information. Please send an email to bridgitte.thornley@pgf.nz or contact PGF on 0800 664 262 if you wish to access or correct the personal information we hold about you.

9.2 We will respond to a request within 20 working days, as the Privacy Act requires. If you are under 18 you can make a request yourself; a parent or guardian can also contact us on your behalf, and we will consider your views and your best interests in deciding how to respond.

10.1 We only keep your personal information for as long as we require it and are guided by the Privacy Act and the Health Information Privacy Code (with respect to health information) and any other applicable law.

10.2 Subject to any legal requirement to retain health information:

(a) Where you use our online chat service anonymously, the transcript which contains your personal information, will be deleted automatically after 3 months.

(b) AI chat conversations are kept in our content system for [90 days] and then deleted. The AI service provider (Anthropic) keeps the text it processes for up to 7 days for safety monitoring and then deletes it.

(c) Email addresses collected through our newsletter sign-up are kept until you unsubscribe.

(d) Information you send us through our website forms (for example counselling requests and referrals) is passed to our client system and deleted from the website after [30 days].

(e) Personal information will be deleted when your account is deleted in accordance with our Terms of Use.

11.1 If you would like to make a complaint, you can contact our Privacy Officer directly, by sending an email to bridgitte.thornley@pgf.nz or by contacting PGF on 0800 664 262.

11.2 You can also make a complaint to the New Zealand Privacy Commissioner. Information about how to lodge a complaint is available on their website at www.privacy.org.nz

12.1 We may update this privacy statement from time to time. Any such changes will be posted on our website. We recommend that you check back frequently to see any updates or changes