Chapter Privacy Policy

ISACA Auckland Chapter Privacy Policy

Last Updated: [July 2026] 

1. Introduction

The ISACA Auckland Chapter ("we", "us", or "the Chapter") is committed to protecting your privacy and complying with the New Zealand Privacy Act 2020. This Privacy Policy describes how we collect, use, share, and retain personal information you provide via our website at https://engage.isaca.org/isacaauckland (the "Site") or through other interactions with the Chapter.

Member information is collected and hosted by ISACA International via the Engage platform (engage.isaca.org). The Chapter accesses this information to manage its activities, and may for operational purposes download member contact details to tools including Google Workspace. This policy describes how the Chapter handles personal information it accesses or holds in that capacity. . For information about how ISACA International handles your personal information, please refer to their Privacy Statement at https://www.isaca.org/privacy-notice.

2. Collection of Personal Information

We collect personal information only where it is for a lawful purpose connected with our functions or activities as a professional organisation, and only where the collection of that information is necessary for that purpose.

• Information Collected Directly: We collect information such as your name, email address, phone number, payment details, and business/home addresses when you register for exams, events, or membership.

• Information Collected From Others: We will collect personal information directly from you unless an exception in the Privacy Act 2020 applies, such as where the information is publicly available, where you have authorised collection from another source, required for law enforcement purposes or where direct collection is not reasonably practicable.

• Purpose of Collection: We access and use this data to manage event attendance, plan Chapter activities, and contact members about upcoming events, training opportunities, and Chapter news. We do not use member information for commercial marketing purposes.

• Mandatory vs. Optional Information: Where information is not strictly required for a service, we will identify it as optional. If you choose not to provide mandatory information, we may be unable to provide certain services to you.

• Passive Collection: We use cookies and IP tracking to gather non-identifying information about Site usage (e.g., browser type, operating system) to improve our digital services. You may configure your browser to refuse cookies; however, some features of the Site may not function correctly if you do so.     

• Notification When Collecting Information Directly (IPP3): when personal information is collected from you in connection with Chapter activities, we take reasonable steps to ensure you are aware of:
  • the purpose for which the information is being collected;
  • the intended recipients of the information;
  • whether providing the information is voluntary or required by law;
  • the consequences (if any) of not providing the information;
  • the name and address of the agency collecting the information and the agency that will hold the information.

• Manner of collection (IPP4): We will collect personal information only by lawful means and in a manner that does not unreasonably intrude unreasonably on your personal affairs.

3. Use and Disclosure of Information (IPP10 and IPP11)

We use your information for the purposes for which it was collected or as permitted by law, unless an exception in the Act applies. We will not use personal information for unrelated commercial purposes, and we will not share it with third parties beyond what is described in this policy. 

• Third-Party Service Providers: We may share information with vendors who perform services on our behalf, such as exam testing agencies, training providers, hosts of venues and events, and credit card processors.

• Internal Sharing: Access to member information held in the Chapter’s systems is restricted to appointed board members only. Information is not shared with Chapter volunteers beyond what is necessary for a specific activity, and only with the member’s knowledge where practicable.

• Public Disclosure: If you are an event speaker or attendee, your name and affiliation may be included in event rosters publicly disclosed to sponsors or other attendees. We will not disclose personal information unless the disclosure is for a purpose directly related to the purpose for which the information was obtained.

4. Overseas Disclosure (IPP 12)

As a chapter of a global organisation, the Chapter’s activities involve the processing of personal information by overseas parties. The following overseas disclosures occur in the normal course of the Chapter’s operations:

1. ISACA International (USA) - Engage platform: Member data is hosted and administered by ISACA International in the United States via the Engage platform. The Chapter accesses this data to carry out its functions. The Chapter relies on ISACA International's contractual data protection commitments as the basis for this transfer. Members who do not wish their information to be held in the US should contact ISACA International directly.

• Google Workspace (USA): The Chapter uses Google Workspace for internal collaboration, including email and file storage. Member information accessed or downloaded by board members may be processed through Google’s infrastructure, which may be located outside New Zealand. The Chapter relies on Google's Data Processing Amendment as the basis for this transfer. Access to the Chapter’s Google Workspace is restricted to appointed board members.

5. Security and Data Breach Notification

We take reasonable steps to protect personal information we hold against loss, use, unauthorised access, modification disclosure or misuse. These measures include access controls restricting member data to appointed board members, use of organisational (rather than personal) accounts for Chapter business, and deletion of downloaded member lists once no longer needed. However, no system is entirely without risk, and members should be aware that internet-based communications carry inherent limitations.

• Mandatory Breach Notification: While we strive to protect your data, if a privacy breach occurs that we believe has caused (or is likely to cause) serious harm, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, in accordance with our statutory obligations under the Privacy Act 2020.

6. Retention of Information

Your primary membership record is held by ISACA International and is subject to their retention practices. The Chapter does not control that record. Where the Chapter holds local copies of member information, such as downloaded contact lists used for event management, those copies are deleted as soon as the purpose for which they were obtained has been fulfilled. Board members are responsible for ensuring compliance with this requirement. When information is no longer needed, it is securely deleted or de-identified.

7. Your Rights: Access and Correction

Under the Privacy Act 2020, you have the right to request access to and correction of any personal information we hold about you.

• Access: You may request a copy of your personal information held by the Chapter.

• Correction: If you believe any information we hold is incorrect, you may ask us to correct it. Registered users may also update their profiles directly through the Site.

• Requests: To exercise these rights, please contact our Privacy Officer (details below). We will respond to your request within 20 working days.

8. Privacy Officer

The Chapter has appointed the Chapter Secretary as our designated Privacy Officer. The Privacy Officer is responsible for ensuring the Chapter complies with the Privacy Act and handling all privacy-related inquiries and complaints.

Contact Details:

• Role: Chapter Secretary / Privacy Officer

• Email: secretary@isaca.org.nz

Complaints and Escalation: If you are not satisfied with our response to a privacy concern, you have the right to make a complaint to the Office of the Privacy Commissioner (OPC).

9. Policy Changes

We may update this policy from time to time to reflect changes in our practices or legal requirements. Where changes are material, we will notify members directly by email and post the updated version on our Site. The date of the most recent update appears at the top of this policy.