Privacy Policy
Last updated: July 2026Our Commitment
Principled Limited respects your privacy and handles personal information in accordance with the Privacy Act 2020 and any other applicable New Zealand law.
Our work includes employment-relations consulting, workplace investigations, mediation and conflict resolution, employment advocacy, privacy advice, and fractional or outsourced people and culture services. This work will usually involve sensitive personal, employment and organisational information. We aim to collect only what we reasonably need, use it carefully, keep it secure and be transparent about how it is handled.
In this policy, we, us and our mean Principled Limited.
When This Policy Applies
This policy applies to personal information that we collect or hold through:
enquiries and communications with us;
our website and online services;
client engagements;
workplace investigations;
mediation and other conflict-resolution processes;
employment advocacy and dispute-resolution work;
fractional CPO, outsourced HR and people advisory services;
training, events and professional relationships; and
our dealings with suppliers, contractors and other business contacts.
For a particular engagement, we may also provide a more specific privacy or collection notice. That notice should be read alongside this policy.
The Information We May Collect
The information we collect depends on the service being provided. It may include:
your name and contact details;
your role, employer and professional details;
employment agreements, job descriptions, policies and personnel records;
information about workplace concerns, complaints, conduct, performance, health, relationships or employment disputes;
interview notes, statements, correspondence, recordings and documentary evidence;
information provided during mediation, negotiation or advocacy;
payroll, remuneration, leave and other employment information;
identity, qualification or background information where relevant;
billing, payment and transaction information;
information needed to identify and manage conflicts of interest;
information contained in emails, documents, photographs, audio, video or other material supplied to us;
publicly available professional or business information; and
technical information generated when you use our website, such as your IP address, browser information and website activity.
We do not intentionally collect personal information that is not reasonably necessary for our work.
How We Collect Information
We may collect personal information:
directly from you;
from a client who has engaged us;
from an employer, employee, representative, witness, complainant, respondent or other investigation participant;
from an advocate, lawyer, mediator, union, insurer, expert or other professional adviser;
from documents, systems or records to which we have been given authorised access;
from government agencies, courts, tribunals or dispute-resolution bodies;
from publicly available sources; and
through our website and service providers.
Where we collect information about you from someone else, we will take reasonable steps to notify you when required by law. There are circumstances in which notification may be unnecessary, impracticable, already completed by another person, or lawfully delayed or withheld.
Why We Use Personal Information
We may use personal information to:
respond to an enquiry or assess whether we can assist;
identify and manage actual or potential conflicts of interest;
provide our professional services;
plan, conduct and report on a workplace investigation;
facilitate a mediation or other resolution process;
advise or represent a client in an employment matter;
perform fractional CPO, outsourced HR or people advisory functions;
communicate with clients, participants, representatives and other relevant people;
prepare reports, correspondence, agreements and other work products;
administer engagements, maintain records and issue invoices;
meet professional, contractual, insurance and legal obligations;
protect or enforce legal rights and respond to complaints or claims;
maintain and improve our systems, security and services;
produce anonymised professional learning or statistical material; and
send professional updates where you have agreed to receive them or where otherwise permitted by law.
We do not sell personal information.
Who May Receive Information
Depending on the nature of the engagement, information may be disclosed to:
the client who engaged us;
people participating in an investigation, mediation, consultation or employment process;
an employee, employer, representative, advocate, lawyer, union or insurer;
a person responsible for making a workplace or organisational decision;
an expert, contractor or specialist assisting with the engagement;
an accountant, auditor, insurer or professional adviser;
a court, tribunal, mediator, regulator, government agency or law-enforcement body;
a technology, document-storage, communications, accounting or administrative service provider; or
another person where you have authorised the disclosure or where it is otherwise permitted or required by law.
We will limit disclosures to what is reasonably necessary for the relevant purpose.
Investigations
An investigation is not a confidential conversation between only the investigator and the person being interviewed. Information provided during an investigation may need to be put to another participant, included in an investigation report, or provided to the client so that the process is fair and the client can make an informed decision.
We will explain the applicable process and expected use of information to investigation participants.
Mediation and Facilitated Processes
Mediation and facilitated processes are conducted on the confidentiality terms agreed for that engagement. Those terms may contain exceptions, including where disclosure is authorised, required by law, necessary to implement an agreement or needed to address a serious risk to health or safety.
Advocacy
Information received while acting as an employment advocate may need to be disclosed to another party, MBIE Mediation Services, the Employment Relations Authority, the Employment Court or another relevant body.
Engaging Principled Limited does not, by itself, mean that communications are protected by legal professional privilege.
Working within Client Organisations
When providing fractional CPO, outsourced HR or similar services, we may access information held in a client’s systems.
Depending on the engagement:
the client may remain responsible for the information as the organisation that collected and controls it; and
we may handle that information on the client’s behalf and in accordance with the client’s lawful instructions, policies and security requirements.
We will access only the information reasonably required to perform the agreed role.
Service Providers and Overseas Storage
We use reputable service providers for functions such as email, cloud storage, document management, accounting, communications, website hosting and information security.
Some providers may store or process information outside New Zealand. Where the Privacy Act requires it, we will take reasonable steps to ensure that information disclosed overseas is subject to privacy safeguards comparable to those applying in New Zealand.
The use of an overseas cloud service to store or process information on our behalf does not necessarily mean that the information has been disclosed to that provider for its own purposes.
Artificial Intelligence and Automated Tools
We may use approved technology, including artificial-intelligence-assisted tools, to support administrative work, organise information, transcribe authorised recordings or assist with drafting and analysis.
We will not knowingly place identifiable or confidential matter information into a publicly accessible artificial intelligence service.
Where an approved tool processes personal information, we will consider the sensitivity of the information, the purpose of the processing, contractual protections, storage location, access controls and whether the information can first be removed or anonymised.
Professional judgement and responsibility remain with Principled Limited. We will not rely solely on an automated tool to make a material finding, recommendation or decision about an individual.
Security
We take reasonable technical and organisational steps to protect personal information against loss, unauthorised access, alteration, disclosure or other misuse.
These measures may include:
password-protected devices and systems;
multi-factor authentication;
encryption and secure cloud services;
access controls based on business need;
secure transfer and sharing methods;
software and security updates;
secure disposal of physical and electronic records;
confidentiality requirements for contractors and service providers; and
procedures for responding to suspected privacy or security incidents.
No method of electronic storage or transmission is entirely risk-free. Please contact us before sending highly sensitive information if you would like to agree on a secure transfer method.
Retention and Disposal
We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, or to meet legal, contractual, insurance and legitimate professional requirements.
Unless a different period is required or agreed, we will ordinarily retain a closed client or matter file for up to seven years. Some information may be retained for a shorter or longer period because of:
the nature of the engagement;
a client’s lawful instructions;
an ongoing dispute, proceeding, complaint or investigation;
an applicable statutory or contractual requirement;
insurance or professional-risk requirements; or
the need to maintain a limited conflicts record.
When information is no longer required, we will securely delete, destroy, return or anonymise it where reasonably practicable.
Access and Correction
You may ask us to confirm whether we hold personal information about you and request access to or correction of that information.
To make a request, contact our Privacy Officer using the details below. We may ask you to verify your identity or authority.
Your right of access is subject to the Privacy Act. In some circumstances, information may be withheld—for example, where release would involve an unwarranted disclosure of another person’s affairs, reveal confidential evaluative material, prejudice certain proceedings, create a serious safety risk or breach legal professional privilege.
If we do not make a correction you have requested, you may ask us to attach a statement of correction to the information.
Privacy Breaches
If a privacy breach occurs, we will take reasonable steps to contain it, assess its effects and reduce the risk of harm.
Where the breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, unless a lawful exception applies.
Website Information and Cookies
Our website may use cookies and similar technologies to operate properly, understand website use and improve the user experience.
You may be able to restrict cookies through your browser settings. Doing so may affect some website functions.
Our website may contain links to websites operated by other organisations. We are not responsible for their privacy practices and recommend reviewing their privacy statements before providing them with personal information.
Marketing Communications
We may send you professional updates, invitations or information about our services where you have requested them or where permitted by law.
You can unsubscribe at any time by using the unsubscribe function in the communication or contacting us.
We will not use information obtained through an investigation, mediation or advocacy matter for marketing.
Complaints
Please contact us first if you have a concern about how we have handled your personal information. We will consider the concern and respond within a reasonable time.
You may also make a complaint to the New Zealand Office of the Privacy Commissioner.
Our Privacy Officer
Our Privacy Officer is:
Aston Moss
Principled Limited
Email: aston@principled.co.nz
Telephone: +64 21 272 7866
Postal address: 26 Muripara Avenue, Point Chevalier, Auckland 1022, New Zealand
Changes to this Policy
We may update this policy when our services, systems or legal obligations change.
The current version will be published on our website with its effective date. Where a change materially affects an existing engagement, we will take reasonable steps to bring it to the attention of affected people.