Version:1.0 |  Last reviewed:06/10/26  |  Next review due: October 2027

Our Tomorrow (“we” or “us”) takes the protection of your personal data seriously. This Privacy Policy explains how we use any personal information that you supply to us, or that might be collected from a third party, and sets out your rights in respect of our processing of your personal information.

In particular, this Policy explains:

• the means by which we obtain your personal information;

• the kinds of personal information we collect about you;

• the ways in which we use your personal information;

• the basis on which we use your personal information;

• who we share your personal information with;

• how we protect your personal information; and

• where and why we transfer your personal information outside of New Zealand;

• the length of time that we keep your personal information.

We may collect your personal data in your capacity as a partner, donor, applicant, supplier, participant in a research project or training session, subscriber to our marketing lists, or as a visitor to our website (www.ourtomorrow.nz) (the “Site”).

The agency responsible for personal information processed under this Privacy Policy is Our Tomorrow, a registered charitable trust board in New Zealand. Where we refer to “we”, “us”, or “Our Tomorrow” in this policy, we mean Our Tomorrow. Our Tomorrow collects, holds, and processes personal information in accordance with the New Zealand Privacy Act 2020 and the guidelines issued by the Office of the Privacy Commissioner.

This Privacy Policy is intended to assist you in making informed decisions about your personal data. Please take a moment to read and understand it.

Our Tomorrow’s mission is to identify and educate Kiwis about where they can come together and agree on how to deal with big long-term issues. We are a non-partisan community-owned pollster and think tank, using qualitative and quantitative research to help Kiwis understand different perspectives, mitigate political polarisation, and uncover shared values across New Zealand society.

Inspired by international deliberative research models like More in Common, Our Tomorrow adapts these methods to the Aotearoa New Zealand context, respecting Te Tiriti o Waitangi obligations and ensuring that civic data remains a collective asset held for public benefit.

If you have any questions about this Policy or want to exercise your privacy rights, please contact us by email at contact@ourtomorrow.nz

We may collect your personal information in the following ways:

(1)  When you give it to us directly

You may give us your personal data directly in various ways, for example when you interact with us on social media or visit our website, when you apply for employment with us or are employed by us, when you take part in a research poll or focus group, and when you contact us by email or sign up to our newsletter online.

(2)  When we receive your information indirectly

Your information may be provided to us when you follow us or otherwise interact with us on or via social media platforms, or through media and academic partners collaborating on research projects.

(3)  When you give permission to other organisations to share it with us, or it is available publicly

We may combine information you provide to us with information available from external publicly available sources. We use this information to gain a better understanding of you and to improve our communications.

(4)  When you visit our website

We use cookies when you visit our website, which may record personal information about you. Please refer to our Cookies Policy for details on the way we use cookies.

We may process the following kinds of personal data:

• Your name and contact details, including physical address, telephone number, e-mail address, and social media identity.

• Financial information, such as payment-related information, including bank details or debit/credit card details.

• Personal information we receive in the course of providing services to you, including details of why you have decided to contact us, details of trainings you have attended, and details of topics or areas of interest to you.

• Information collected during qualitative research sessions, including audio and video recordings of focus groups and interviews, written notes, and transcripts.

• Recruitment and employment application data, including CVs, covering letters, interview notes, and assessment records.

• Special category personal data, as described in the section below.

Sensitive Personal Information and Māori Data Governance

The nature of our research means we sometimes process sensitive personal information, including political opinions, ethnicity, religious beliefs, and social attitudes. Under the New Zealand Privacy Act 2020, we take extra care to collect and process sensitive information lawfully and fairly. We collect sensitive information directly with your explicit consent or where provided through representative panels. In accordance with Māori Data Sovereignty principles, data collected from Māori participants is governed and stewarded to protect iwi interests and ensure collective benefit. You may withdraw your consent to our processing of sensitive personal data at any time by contacting us.

Research Data

Quantitative data from polling

Quantitative polling data is supplied to us by our research and panel partners (such as Kantar) or collected directly from individuals when they complete our online surveys. All data we receive from partners is fully de-identified and anonymised before it reaches us – we do not receive personally identifiable information through this channel.

Focus group participants

Participant data from focus groups (including hybrid and virtual focus groups) contains personal data and sensitive opinions. We collect and process this data based on your explicit consent and our core purpose of identifying public consensus across Kiwi tribes.

Focus group participant data is stored securely in our cloud-based document storage system (Google Workspace) and protected via individually held identity keys and anonymised personality pools. Files containing raw participant contact details are deleted within two months of the session completing.

Focus group recordings

Focus group sessions are recorded via secure video conferencing platforms. Recordings are stored using encrypted transcription services and deleted when no longer required.

Consent to record sessions and retain recordings is obtained prior to each focus group. Recordings are retained for up to three years to enable longitudinal analysis of public sentiment across election cycles, after which they are securely deleted.

Recruitment and Employment Applications

When you apply for a role with Our Tomorrow, we collect and process personal data including your name, contact details, CV, and references. We process this information to evaluate your suitability for employment in accordance with the Privacy Act 2020.

We retain unsuccessful candidate records for up to two years from notification of the outcome in case suitable future roles arise. After this period, all identifiable application data is securely destroyed.

We may use your personal information to:

• Manage and administer our relationship with you, including providing you with services and information you have requested.

• Market our services, including sending you information about our work, training events, and other activities.

• Administer our Site, including monitoring its use.

• Administer payments.

• Administer your employment application and employment with us once you are hired

• Conduct research and data analysis into public attitudes and the impact of our work.

• Deal with enquiries and complaints made by or about you.

• Audit and/or administer our accounts.

• Manage individuals’ preferences, including administering suppression files.

• Administer security requirements, including data and systems security.

• Conduct financial management and control.

• Meet any of our legal, regulatory, and risk management obligations.

Supporter and research profiling

We may use your personal information to undertake research to gather further information about you from publicly accessible sources. This helps us gain a better understanding of your background, interests, and preferences, in order to improve our communications and interactions with you and to provide information about our work and activities which we consider may be of interest to you.

Marketing

We will contact you by email with targeted marketing communications to let you know about our work and activities that we consider may be of particular interest to you, and to ask for donations or other support.

Website analytics

We use cookies on our Site, which may collect your personal information. We use Google Analytics to analyse how visitors use our website — including which pages are visited, how long visitors spend on the site, and how they arrived. We also use HubSpot to assess the performance of our email communications. For more information on how we use cookies, please see our Cookies Policy.

We are required to have one or more lawful grounds to process your personal information. We use your personal information on the following bases:

(1)  Consent

We will ask for your consent to use your information to send you electronic communications such as newsletters updating you about our work. Where we rely on your consent, you are entitled to withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

(2)  Contractual relationships

Sometimes it will be necessary to process personal information so that we can enter into or perform a contract with you. For example, if you apply for employment with us.

(3)  Legal obligations

Sometimes we will be required to process your personal information to comply with legal obligations that are binding on us. We will only do so when strictly necessary.

(4)  Legitimate interests

Under the Privacy Act 2020 (Information Privacy Principles), we ensure that personal information is collected for lawful purposes connected with our civic research, and processed fairly and transparently with informed consent.

Where we rely on legitimate interests, you are entitled to object to our processing on this ground. If you wish to do so, please contact us using the details above.

The majority of our work does not involve children or young people. Where our research does include participants under the age of 18, this is currently limited to specific polling and focus group projects, and we handle this data differently depending on the participant’s age, as set out below.

We do not knowingly collect personal information from anyone under the age of 18 unless collected as part of an exceptional research project that has sought specific consent. If we discover we hold personal information about someone below that age, we will delete it within a reasonable period.

Research Involving Children Aged 15 or Younger

Where our research involves participants aged 15 or younger, we only proceed with the consent of a parent, or another responsible adult acting in place of a parent, such as a teacher for a school-based project.Before this research takes place:

• We record the name, relationship to the child, and role of the responsible adult giving consent.

• We give the responsible adult enough information about the project, in plain language, for them to make an informed decision on the child’s behalf.

• Where the subject matter is sensitive, we take additional safeguarding steps, which may include a responsible adult being present during the research itself.

Where research involves sensitive topics or children, researchers will undergo relevant safety and background checks prior to contact.

Research Involving Young People Aged 16 and 17

Where our research involves participants aged 16 or 17, we may rely on their own informed consent, provided they have been given enough information to understand what taking part involves. For research on more sensitive subject matter, we may still involve a parent or other responsible adult, even where this is not strictly required at this age.

Before this research takes place:

• Where a responsible adult is involved, we record their name, relationship, and role in the same way as for younger participants.

• We take the same additional safeguarding steps as above where the subject matter warrants it.

• Researchers present will have had DBS checks ahead of any contact with children.

Where this research involves sensitive personal information, we collect and protect it in compliance with the Privacy Act 2020 and our internal data protection framework.

Our Tomorrow Trustees and Advisory Panels

Our Tomorrow is governed by a Board of Trustees and supported by independent Expert Advisory Panels (covering Policy Integrity, Economics, Climate, Te Tiriti, and Data & Ethics). Personal data is reviewed in de-identified or aggregated form by advisory panels to ensure neutral presentation of policy options.

Third-party service providers

We share personal data with trusted service providers who process data on our behalf, including our research partners (e.g., Kantar), cloud storage (Google Workspace), and technical infrastructure providers. These providers are bound by strict contractual obligations and privacy standards.

Commissioned research clients

Where research is commissioned by a client organisation, anonymised or aggregated research outputs may be shared with that client. Identifiable research data is not shared with commissioning clients without your explicit consent. Where a client organisation is involved, this will be disclosed to you at the point of recruitment into the research.

Legal and regulatory disclosure

We may disclose personal data to regulatory authorities, law enforcement bodies, or courts where we are required to do so by law or where we determine it is necessary to protect our legal rights.

Other research institutions and member organisations

We may share personal information with other research institutions undertaking similar research or with other organisations that respondents indicate they are members of. However, we will only ever share this data in anonymised form unless the individual provides explicit consent to share identifiable information.

We have put in place appropriate and proportionate technical and organisational measures to prevent the loss, destruction, misuse, alteration, unauthorised disclosure of, or access to your personal information.

Focus group participant data is shared with us via password-protected documents and stored directly in our secure cloud-based document management system, specifically to avoid the transmission of personal data by email. Focus group recordings are downloaded from Zoom and deleted from that platform before being uploaded to Rev for secure storage.

Your information is accessible only by authorized team members and trustees of Our Tomorrow, and we ensure strict compliance with data handling protocols.

What Happens If There Is a Data Breach

If we become aware of a privacy breach affecting your personal information, we will investigate promptly in accordance with our security procedures and obligations under the Privacy Act 2020. Where a privacy breach causes (or is likely to cause) serious harm, we will notify the Office of the Privacy Commissioner (OPC) as required by law, as well as notifying affected individuals directly where appropriate.

Our Tomorrow stores and processes data primarily within New Zealand. However, our infrastructure service providers (such as Jotform, Google, or Supabase) may involve holding or transferring data overseas. Where cloud services or international research collaborators (such as international deliberative polling partners) require data transfers outside New Zealand, we ensure that the recipient entity provides comparable safeguards to those under the New Zealand Privacy Act 2020 (IPP 12), or that explicit consent has been obtained. While we are actively working towards full alignment and compliance with Māori Data Sovereignty principles across all data hosting solutions, we have not yet reached full compliance across our entire infrastructure.

If you would like further information about the safeguards we use for international transfers, please contact us using the details above.

Third-party links

We link from our Site to other websites. This Privacy Policy does not cover third-party websites and we are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any external websites you visit via the  links shared.

We keep your personal information only for as long as is necessary for our purposes, taking into account its relevance to our business and our legal and regulatory obligations. The retention periods below may be extended where we are required to retain data to comply with a legal obligation or to defend a legal claim.

• Research participant contact details and screening data: 12 months from the date of the research session, unless the participant has consented to being contacted for future research, in which case until consent is withdrawn.

• Focus group and interview recordings: up to six years from the date of the session, in line with the consent obtained via our Focus Group Consent Form.

• Focus group participant files (password-protected documents): deleted within two months of the focus group taking place.

• Unsuccessful recruitment candidate records: up to three years from notification of the outcome of the selection process.

• Donor and supporter records: seven years from the date of the last donation or interaction, in line with financial record-keeping obligations.

• Marketing and newsletter subscribers: until consent is withdrawn or, where we rely on legitimate interest, until an objection is raised and upheld.

Under the New Zealand Privacy Act 2020, you have rights regarding your personal information:

• Right to be informed: You have the right to know how your personal information is collected, stored, and used.

• Right of access: You can request confirmation of whether we hold personal information about you and request access to that information.

• Right of correction: You have the right to request correction of any inaccurate or out-of-date personal information we hold about you.

• Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time.

To exercise any of your privacy rights, please contact us at contact@ourtomorrow.nz. For further information about your rights under New Zealand privacy law, please visit the Office of the Privacy Commissioner at privacy.org.nz.

You also have the right to make a complaint to the Office of the Privacy Commissioner if you believe we have not handled your personal information properly. Contact details can be found at privacy.org.nz/your-rights/making-a-complaint.

We keep this Privacy Policy under regular review and reserve the right to amend it from time to time by posting an updated version on our Site, including where required by changes in applicable law. We will notify you of any material changes to this Policy by email where we hold your contact details.