RASCALS – After-School Care & Leisure Services

How RASCALS Protects Your Privacy

RASCALS is committed to respecting the privacy and dignity of children, whānau, staff, and our wider community. We collect and use personal information only when it is necessary to care for children safely, communicate effectively, and meet our legal responsibilities.

What information we collect

• Enrolment and contact details

   

• Attendance records

   

• Medical and emergency information

   

• Incident or accident information

   

• Information needed to support children’s wellbeing

   

How information is used and protected

• Information is collected fairly and for clear purposes

   

• Access is limited to authorised staff

   

• Information is stored securely

   

• Information is shared only when appropriate, consented to, or legally required

   

Your rights

• You can ask to access information held about you or your child

   

• You can request corrections

   

• You will be informed if a serious privacy breach occurs

   

The full Privacy & Information Management Policy begins below.

Full Privacy & Information Management Policy

1. Purpose

The purpose of this policy is to ensure that all personal information collected, used, stored, shared, and disposed of by RASCALS is managed in a lawful, fair, and respectful manner.

RASCALS is committed to protecting the privacy, dignity, and rights of all children, families, staff, volunteers, contractors, and stakeholders.

2. Scope

This policy applies to:

• All RASCALS staff, volunteers, contractors, and management

   

• All personal and sensitive information collected or held by RASCALS

   

• All information relating to children and young people participating in RASCALS programmes

   

3. Legislative Framework

RASCALS complies with:

• The Privacy Act 2020

   

• The Information Privacy Principles (IPPs)

   

• Any other legislation relating to the collection, use, and protection of personal information

   

4. Principles of Information Collection

RASCALS ensures that:

• Personal information is collected for a clear, lawful, and specific purpose

   

• Only information necessary for service delivery, safety, or legal compliance is collected

   

• Information is collected fairly, transparently, and respectfully

   

• Individuals are informed about:

   

  • What information is being collected

     

  • Why it is being collected

     

  • How it will be used

     

  • Who may have access to it

     

5. Information Relating to Children and Young People

When collecting information about children or young people, RASCALS will:

• Take extra care to ensure collection is fair and appropriate

   

• Avoid collecting information that is unreasonably intrusive

   

• Ensure information is suitable for the child’s age, development, and service needs

   

• Where appropriate, collect information through parents or caregivers

   

• Store children’s information with heightened security and restricted access

   

6. Use and Disclosure of Information

RASCALS will:

• Use personal information only for the purpose it was collected

   

• Not disclose personal information to third parties unless:

   

  • Consent has been provided, or

     

  • Disclosure is required or permitted by law, or

     

  • There is a serious risk to health or safety

     

Access to personal information is limited to authorised personnel only.

7. Access to and Correction of Information

Individuals have the right to:

• Request access to personal information held about them or their child

   

• Request correction of information that is inaccurate, incomplete, or out of date

   

RASCALS will:

• Respond to requests within a reasonable timeframe

   

• Make corrections where appropriate

   

• Record requested corrections if a correction is disputed

   

8. Storage and Security of Information

RASCALS ensures that:

• Physical records are stored in locked cabinets or secure locations

   

• Digital records are protected by passwords and appropriate security measures

   

• Access is restricted to authorised personnel

   

• Reasonable steps are taken to prevent loss, misuse, or unauthorised access

   

8A. Client Record-Keeping

RASCALS maintains accurate, up-to-date records to support safe programme delivery, legal compliance, and continuity of care.

Records Maintained

RASCALS maintains the following client records where applicable:

• Child Enrolment & Informed Consent Forms

   

• Attendance Registers

   

• Incident and Accident Reports

   

• Medication Consent Forms and Medication Logs

   

• Individual Support Plans

   

• Relevant communication records relating to child safety or wellbeing

   

Purpose of Record-Keeping

Client records are maintained to:

• Ensure children’s safety and wellbeing

   

• Support supervision and risk management

   

• Meet OSCAR and legal compliance requirements

   

• Maintain accurate attendance and programme records

   

• Provide evidence of service delivery where required

   

Access to Records

• Access to client records is restricted to authorised personnel only.

   

• Parents and caregivers may request access to their child’s records in accordance with the Privacy Act 2020.

8B. Information Technology & Cyber-Security Measures

RASCALS implements proportionate information technology and cyber-security safeguards to protect personal information, including:

• Password-protected devices and accounts

   

• Strong password requirements for authorised users

   

• Restricted user access based on role and need

   

• Secure cloud-based storage systems with controlled sharing permissions

   

• Automatic device locking and screen security

   

• Regular software and system updates

   

• Secure Wi-Fi networks with appropriate protection

   

• Immediate revocation of system access when staff cease employment

   

Staff are instructed not to store service information on personal devices unless authorised and secured.

9. Information Retention and Disposal

RASCALS retains personal and client records only for as long as required for lawful, operational, safety, and funding compliance purposes.

Client records are retained for a minimum of 7 years following the conclusion of service delivery, unless a longer retention period is required by law.

When records are no longer required:

• Physical documents are securely shredded

   

• Electronic files are permanently deleted from secure systems

   

RASCALS ensures that disposal of records protects confidentiality and prevents unauthorised access.

10. Privacy Breaches

RASCALS will:

• Respond promptly to suspected or actual privacy breaches

   

• Take immediate steps to contain and minimise harm

   

• Assess whether the breach is a serious privacy breach

   

• Notify affected individuals where required

   

• Report serious privacy breaches to the Privacy Commissioner as required by law

   

• Record all privacy breaches and actions taken

   

11. Responsibilities

Privacy Officer

RASCALS has appointed a Privacy Officer in accordance with the Privacy Act 2020.

The Privacy Officer is responsible for:

• Overseeing compliance with privacy legislation

   

• Ensuring privacy policies and procedures are implemented and maintained

   

• Acting as the first point of contact for privacy enquiries, complaints, and access or correction requests

   

• Managing privacy breaches and determining notification requirements

   

• Ensuring staff receive appropriate privacy training

   

Privacy Officer: Thomas Cashen

Privacy Contact: privacy@raglanrascals.co.nz

Management

Management is responsible for ensuring this policy is implemented, monitored, and reviewed.

Staff and Volunteers

Staff and volunteers must comply with this policy at all times and report any privacy concerns or breaches immediately.