Introduction

Domain Name Commission (“DNC”, “we”, “us”, “our”) is strongly committed to protecting personal information. This privacy statement explains how DNC collects, stores, uses and shares personal information and complies with the requirements of the Privacy Act 2020 ("Privacy Act").

If you cannot find the information you require in this privacy statement or you have any privacy concerns about the way in which DNC manages your personal information, then please contact us via the details at paragraph 12.

1. Applicability of, and acceptance to, this statement

1.1.This statement applies to all personal information about you which is collected or held by us.

1.2.By engaging with our website and services (regardless of whether you are interacting with us as a supplier, employee, DNC Board Member, job applicant, contractor, Registrar or Domain Name Holder of DNC, or for any other reason connected with our operations) you consent to your personal information being collected, held and used in accordance with this statement (or for any other use that you authorise).

2. Domain Name Registration and .nz Rules

2.1. Where you have registered a .nz domain name, the “.nz Rules” (accessible here) will apply to you. The .nz Rules contain several clauses relevant to the collection and use of your personal information by us in relation to your domain registration, and those rules form part of this statement.

2.2. Relevant clauses of the .nz Rules include (but are not limited to):

2.2.1. clause 2.3.5, which outlines the personal information you are required to provide to register a .nz domain name;

2.2.2. clause 6.2, which outlines the availability of, and the terms that apply to, the “Privacy Option” (as defined in the .nz Rules);

2.2.3. clause 8.3.2, which details the Registrar’s (as defined in the .nz Rules) obligations in respect of your personal information;

2.2.4. clauses 10.2 and 10.3, which outline in what circumstances personal information may be provided via the .nz data query search system; and

2.2.5. clause 10.2.5, which outlines the process for DNC to disclose information which has not been published to the applicability of the Privacy Option.

3. Collection of personal information

3.1. DNC may collect personal information about you where such collection is connected with one of DNC’s functions, activities or services, including when DNC:

3.1.1. receives enquiries or communications from you;

3.1.2. manages stakeholder relationships;

3.1.3. processes applications for funding support mediations, tikanga and cultural support under the .nz disputes resolution scheme;

3.1.4. receives submissions or feedback as part of public consultations;

3.1.5. administers recruitment and employment processes;

3.1.6. engages with the community through events, newsletters and other communications;

3.1.7. undertakes investigations to determine whether there has been a breach of the .nz Rules or other DNC-administered contract or policy; or

3.1.8. performs any other activity relevant to DNC’s operations.

3.2. DNC may collect your personal information from:

3.2.1. you, where you provide that information to us, whether that be via your interactions with our services or communications with us via phone or email, or you otherwise voluntarily provide that information to us;

3.2.2. Internet New Zealand Incorporated (“InternetNZ”), pursuant to the “Operating Agreement” in place between it and us (as available here).

3.2.3. our third-party identity verification service, where we have required you to verify your identity (in accordance with the .nz Rules);

3.2.4. other third parties, where you have authorised that your information may be shared with us; or

3.2.5. other sources, where the information is publicly available. 

3.3. Where we collect personal information from a third party, we will take reasonable steps to ensure that you are aware of the collection, the purpose for which it is being collected, the intended recipients, our contact details, the legal basis upon which we are authorised or required to undertake the collection, and your rights to access and correct the Personal Information (to the extent required by the Information Privacy Principle 3A of the Privacy Act).

3.4. We also store and use personal information of .nz domain name holders for the purpose of fulfilling our requirements under the Operating Agreement.

3.5. Depending on the service we are providing, the personal information we may collect when you engage with us includes:

3.5.1. your name and contact details;

3.5.2. demographic information that you provide to us;

3.5.3. any correspondence with DNC staff;

3.5.4. survey results and responses;

3.5.5. your comments and contributions on any of our forums;

3.5.6. your submissions on public consultations led by DNC;

3.5.7. information about your use of our website (explained further below); and

3.5.8. any other information necessary for us to provide you with our services and website.

3.6. We also collect the following information about your use of our website (though please note we make no efforts to associate this with your identity):

3.6.1. basic device information (including the type of device you are using, and the operating system and web browser being used);

3.6.2. your IP address and the approximate location of that IP address;

3.6.3. the search terms you used;

3.6.4. the pages you accessed on our website and the links you clicked on;

3.6.5. the date and time you visited the site; and

3.6.6. the referring site (if any) through which you accessed our website.

3.7. To track and analyse website usage, we use tracking cookies through Google Analytics. If you prefer, you can opt out of the Google Analytics tracking cookies. This will not affect your ability to use our site. Our web analytics will also respect any “do not track” setting that you may already have on your browser. You can opt out of the Google Analytics tool by using the plugin available here: https://tools.google.com/dlpage/gaoptout.

3.8. DNC uses cookies on our website, specifically:

3.8.1. persistent Drupal cookies to manage logins;

3.8.2. persistent Google cookies to manage analytics as described above; and

3.8.3. persistent Cloudflare cookies to manage website security.

4. Using your personal Information

4.1. The primary purposes for which DNC collects, holds and processes personal information are:

4.1.1. for the purposes of “enforcing and facilitating compliance with policy that has been adopted in relation to the .nz Domain Name Space” and further activities outlined in the Operating Agreement;

4.1.2. for the purposes of monitoring, investigating, enforcing and encouraging compliance with the .nz Rules, .nz Authorisation Agreement and the Connection Agreement.

4.1.3. our third-party identity verification service ("APLYiD"), where we have required you to verify your identity (in accordance with the .nz Rules);

4.1.4. assisting with complaints and enquiries received by the DNC

4.1.5. to comply with the applicable clauses of the .nz Rules (as further detailed in paragraph 4.3);

4.1.6. for recruitment purposes;

4.1.7. for general management and reporting purposes, such as maintaining a register of stakeholders and invoicing and account management;

4.1.8. improving our website and the delivery of our services;

4.1.9. conducting internal statistical analysis;

4.1.10. complying with any requirements of law or regulation, or where we believe that the disclosure is in line with obligations under the Privacy Act; and

4.1.11. for any purposes authorised by you or the Privacy Act.

4.2. If you choose not to provide us with the personal information we have requested, we may be unable to provide you with our website or our services, including providing professional services to you, responding to your requests, paying your invoices, or processing your application for employment.

4.3. Under clause 4 of the Operating Agreement, DNC has been granted various rights by InternetNZ to data (including personal information) relating to .nz domain registrations. These rights are granted to allow DNC to provide “Oversight Services” (as defined in the Operating Agreement). We encourage you to review the provisions of clause 4 of the Operating Agreement carefully so you are aware of the implications of these rights in relation to your personal information.

5. DNC Newsletter

5.1. We send a newsletter to you using the personal information we hold about you. This occurs via email

5.2. You are entitled to unsubscribe from this newsletter from us at any time. This can be done by clicking “unsubscribe” in the footer of the newsletter received by you from us, or by contacting us via the details at paragraph 12 stating that you wish to be removed from the mailing list.

6. Disclosure of personal information

6.1. DNC may disclose your personal information to:

6.1.1. InternetNZ;

6.1.2. Dialpad, Inc., which supports our telephony system, and which stores recordings of telephone calls for the purposes of training and record keeping;

6.1.3. any business that supports our website and services, including any person that hosts or maintains any underlying IT system or data centre that we use to provide our website or other services, any payment providers, any fraud detection partners, marketing and advertising partners, and customer support partners;

6.1.4. other third parties (for anonymised statistical information);

6.1.5. any person who can require us to supply your personal information by law (such as a regulatory or government authority);

6.1.6.    the public, where you make a submission to DNC as part of any public consultation process (as per Schedule 1 of the .nz Rules), or where the outcomes of any dispute between you and us are required to be published (as per Schedule 2 of the .nz Rules); or

6.1.7.    any other person authorised by you.

6.2.  When disclosing personal information:

6.2.1. we will only authorise the recipient to use your personal information on an as-needed basis;

6.2.2. we will make reasonable enquiries with the recipient as to what protections they have in place to safeguard your personal information, and how those safeguards comply with the Privacy Act;

6.2.3.    to the extent the recipient is not located in New Zealand, we will only make such disclosure where we believe on reasonable grounds that the recipient is subject to privacy laws that, overall, provide comparable safeguards for your personal information as those safeguards available to you in New Zealand (or otherwise as permitted by the Privacy Act); and

6.2.4.    the DNC will take necessary steps to protect this information, which may include validating/ verifying the identity of the individual who has requested the information (including when you request your own information).

6.3. Where your personal information is disclosed pursuant to paragraph 6.1.5, we may notify you of this fact where appropriate in the circumstances. When deciding whether to do so is appropriate, we will be guided by the principles of the Privacy Act and any relevant law or regulation under which the information has been requested.

7. Social networking and forums

7.1. We utilise social networks, including X, Facebook, and LinkedIn, to communicate with the public about our work. When you communicate with us using these services, the social networking service may collect your personal information for its own purposes. We encourage you to familiarise yourself with the privacy statements of each social media site prior to sharing personal information to those sites.

7.2. We use widgets (or icons) from ShareThis, which facilitates the sharing of pages/links from our website across various social networks, including Facebook, X and LinkedIn. These services may track your use of our website on those pages where their widgets (or icons) are displayed. If you are logged in to those services (including any Google service) while using our site, their tracking will be associated with your profile with them. You may configure how these social networks utilise your profile in the settings of those social networks, which prevents DNC from having access to your profile information. In any case, we access but do not store or manage this profile information provided by these social networks.

7.3. Social network services have their own privacy statements which are independent of ours. They do not have any access to the personal information we hold on our systems.

7.4. Where you engage with any public forums or commenting features on our website, the information you post (including any username) can be viewed by other users of our website. If you choose to utilise any such features of our website, please be conscious of the information that you provide in doing so. 

8. Storage and security

8.1. We store your personal information in accordance with our obligations under the Privacy Act and take reasonable steps to ensure the security of your personal information.

8.2. We may use third-party providers to store and process our data. We store most of the personal information we collect and generate electronically on Amazon AWS servers located in Sydney, Australia. We use Microsoft Services for our email and other specialist tools for office productivity. We also use Google Services and Cloudflare services. This means that the personal information we hold may be transferred to, or accessed from, countries other than New Zealand.

8.3. We take all reasonable steps to ensure the personal information we collect is protected against loss, unauthorised access and disclosure or any other misuse.

8.4. We ensure that our third-party data processors can meet our privacy and security requirements.

8.5. We have taken steps to ensure that our website is secure. We use the secure HTTPS data transfer protocol for the transmission of data and our site holds an SSL certificate from a trusted organisation. Despite this, the Internet is not in itself a secure environment and we cannot give an absolute assurance that your information will be secure at all times. 

9. Retention

9.1. We retain personal information for as long as is necessary for the purpose for which it was collected and in accordance with our internal policies.

9.2. Personal information may be held for extended periods where required by law or regulation, and as necessary in order to defend our legal rights.

10. Your privacy rights

10.1. You have the right to request access to and correction of any personal information we hold about you at any time by contacting us using the contact information below. Please note that these rights are subject to the exceptions set out in the Privacy Act.

10.2. Please note that when you wish to exercise your rights under paragraph 10.1, we will take reasonable steps to verify your identify before acting upon your request.

10.3. You can complain to the Privacy Commissioner if you believe your rights have been breached.

11. Effect of and changes to this Privacy Statement

11.1. We reserve the right to update this privacy statement at any time by publishing an updated version on our website. When we do so, we will update the revision date at the top of this statement accordingly, and the amended privacy statement will apply from that revision date.

11.2. Accordingly, we encourage you to review this privacy statement periodically to stay informed about how we are dealing with and protecting your personal information. Any amended statement will apply whether or not we have given you specific notice of any change.

12. Contact Information

12.1. To request access to or correct any personal information, or if you have any other questions regarding the DNC Privacy Statement, please contact us by:

• • • • • completing the enquiry form here:
        • writing to us at PO Box 11-881, Manners Street, Wellington 6142