Great People Recruitment Ltd ("GPR", "we", "us") is committed to complying with the Privacy Act 2020, including Information Privacy Principle 3A, in force from 1 May 2026, when we collect, use, store, share and dispose of personal information. We are an independent Waikato-based recruitment consultancy, working with candidates and with clients across Waipā, the wider Waikato and other parts of New Zealand.

This policy explains what personal information we collect and how (including when we collect it from someone other than you), how we use and share it, how we keep it secure and for how long, and your rights to access, correct and complain about the handling of your information. We may update this policy from time to time; the current version will always be available on our website, dated below.

1. What is "personal information"?

'Personal information' is any information that relates to an identifiable individual. It includes, without limitation, names, contact details, address details, financial information, employment information, references, results of testing or checks, and personal preferences.

2. Information we collect directly from you

We collect personal information directly from you when you:

• register with us or complete any form, whether on paper, online, by phone or by email

• supply us with your CV or application

• attend an interview with us (in person, by phone or by video)

• undertake any testing or assessment we arrange as part of the recruitment process (ability, medical, personality or other tests)

• engage us as a client, including for billing and payment

• otherwise contact us or provide information to us, verbally or in writing

You are not required to provide us with your information. However, if you don't, or we are otherwise unable to collect it, this may affect our ability to represent you for recruitment purposes or to provide our services.

3. Information we collect from other sources (indirect collection)

As a recruitment consultancy, we often need to collect information about you from someone other than you. This is called indirect collection, and may include information from:

• referees you nominate, or former employers and colleagues

• background and verification checks, including the New Zealand Ministry of Justice, credit reporting agencies, and NZ or overseas qualification and registration bodies

• publicly available sources, such as LinkedIn or other professional and social media profiles

• a client, where they share feedback about your performance in a role we have placed you in

• immigration or right-to-work verification services

Where we collect your information this way, we will take reasonable steps, usually through this policy, your registration or engagement documents, or a follow-up message, to make sure you are aware that we have collected it, why, who we may share it with and your rights of access and correction, unless an exception in the Privacy Act 2020 applies (for example, because you have already been told, the information is publicly available, or telling you is not reasonably practicable).

4. How we use your information

We use your personal information to:

• verify your identity and the information in your application

• undertake reference checks, and NZ or overseas qualification, Ministry of Justice and credit checks, and to facilitate any testing or assessment, as part of the recruitment process

• provide recruitment services to you and to our clients

• bill you and collect any money owed to us, including processing card payments

• communicate with you about matters relevant to our business and services

• comply with our legal obligations.

• personalise and improve your experience on this website or the services we provide

• monitor website usage

• provide you with information from third parties that we think would be interesting.

We will comply with the Unsolicited Electronic Messages Act 2007 when communicating with you for marketing purposes. This means we will provide instructions for unsubscribing from such messages if you choose and assist you with unsubscribing on your request.

 5. Who we may share your information with

We do not sell your personal information. We may share it with:

• our clients, for the purpose of recruitment and placement

• referees, and background-check providers, including the Ministry of Justice, credit reporting agencies, and qualification or registration bodies

• IT, database, payment and software providers who support our recruitment services, some of whom may be located overseas

• providers of any AI-assisted tools we use — see section 6

• our professional advisers (for example, legal or accounting), regulators, and other parties where required or authorised by law.

6. Use of AI-assisted tools

We may use secure, reputable AI-assisted tools to support administrative tasks (such as note-taking, transcription, summarisation, drafting communications and recruitment administration) as well as recruitment management systems. These tools operate under human oversight and do not make recruitment decisions on our behalf, all placement and recruitment decisions are made by our team. We take reasonable steps to ensure that any such tool meets appropriate security and privacy standards, and that your information is not used to train third-party AI models.

7. Tracking devices and cookies

We use tracking technologies such as cookies to recognise your browser when you visit our website and to see which pages you visit. We use this to optimise our site and improve the experience for users. Cookies do not themselves identify you personally, although they do identify your browser. You can manage or disable cookies through your browser settings; if you do, some features of our website may not work as intended.

8. Links to third-party websites and social media

Our website contains links to websites owned and operated by third parties, which have their own privacy statements. We encourage you to review those statements, as we do not accept responsibility for the content or privacy practices of third-party websites. GPR uses Instagram, Facebook and LinkedIn; any information we capture through these channels is captured with your consent.

 9. Storage, security and overseas disclosure

We take reasonable steps to keep the personal information we hold secure. Electronic information is stored on a secure server located in Australia, in controlled facilities. Where your personal information is disclosed to a provider located overseas, we take reasonable steps to satisfy ourselves that the provider is subject to privacy standards that are comparable to those under the Privacy Act 2020. Physical documents are stored in a locked area until no longer required and are shredded once destroyed.

If we experience a privacy breach that has caused, or is likely to cause, serious harm, we will assess it in line with the Privacy Act 2020 and, where required, notify the Office of the Privacy Commissioner and the individuals affected as soon as practicable.

10. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose it was collected, or as required by law. As a guide:

• for candidates who are successfully placed, we retain information for up to two (2) years after the placement is confirmed, unless a longer period is needed (for example, during any applicable trial period, or for legal or tax purposes), after which it is deleted or destroyed

• for candidates who register with us but are not placed, we retain information for up to two (2) years so that we can consider you for future opportunities, unless you ask us to delete it sooner

• for client and supplier contacts, we retain information for as long as the business relationship continues, and for a reasonable period afterwards for legal or record-keeping purposes.

Physical information that is no longer required is shredded; electronic information that is no longer required is deleted or destroyed.

11. Your rights: access and correction

You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if you believe it is wrong. We will respond to requests within a reasonable timeframe (generally within 20 working days), and may take reasonable steps to verify your identity first. Where practicable, there is no charge for an access request, although we may charge our reasonable costs for a request that involves a large volume of information. If we do not agree that information should be corrected, we will take reasonable steps to note your view alongside the information.

You agree that any information you provide to us will be accurate, complete and up to date.

12. If you are not satisfied

If you have a concern about how we have handled your personal information, please contact us first at the details below so we can try to resolve it. If you remain unsatisfied, you also have the right to complain to the Office of the Privacy Commissioner, at privacy.org.nz or on 0800 803 909.

13. Contact us and changes to this policy

If you would like to request a copy of your information, ask for a correction, or ask any question about this policy, please contact us at linley@gprl.co.nz.

We may change this privacy policy from time to time and will publish the updated version on our website.

This Privacy Policy was last updated in July 2026.