Privacy Notice
The Everyone Project Aotearoa (TEPA)
How The Everyone Project collects and uses your personal information under the Privacy Act 2020 (New Zealand)
Version 1.0 — 01 July 2026
At a glance
| Who we are | The Everyone Project ("TEP") — the trading name of Every1data Limited. We build and operate the TEPA tool and we are the agency responsible for the personal information collected through it under the Privacy Act 2020. See section 1 for our contact details and our Privacy Officer. |
|---|---|
| What TEPA is | TEPA is an industry wide initiative to understand more about the people participating in your industry, for example their demographics and their experience of work. We typically collect this information directly from you through a short survey. |
| Why we're giving you this | So you understand what information we collect, why, how we protect it, and the choices and rights you have. This notice helps us meet our obligations under the Privacy Act 2020. |
| Your privacy, in short | Taking part is voluntary and every question is optional. We only collect what we need. We won't disclose the personal information you provide to anyone (including your employer) or use it for any purpose you haven't agreed to. The personal information you provide is encrypted, kept confidential and stored in New Zealand. You can view, change or delete this at any time. If you have any concerns you can contact us, and you can complain to the Office of the Privacy Commissioner. |
Sections
1. Who we are and how to contact us
The Everyone Project ("TEP", "we", "us") is the trading name of Every1data Limited. We operate the TEPA tool and we are the agency responsible for the personal information processed through it under the Privacy Act 2020.
| Operator / agency | Every1data Limited, trading as The Everyone Project (registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom). Because we offer TEPA to people in New Zealand, we are carrying on business in New Zealand and are subject to the Privacy Act 2020. |
|---|---|
| Privacy Officer / contact | Our Privacy Officer can be contacted at [email protected] For help using TEPA, contact [email protected]. |
2. Who this notice is for
This notice applies to three groups of people. Find the section that applies to you.
| Group | Who this means |
|---|---|
| A. Contributors | People invited to share — or who volunteer to share — information about themselves through TEPA, usually because they have contributed (paid or unpaid) to a screen project registered on the tool. Contributors may include children and other young or vulnerable people — see section 13. |
| B. Organisation users | Employees, contractors and representatives of organisations that use TEPA — typically project companies, funders and broadcasters — and the people they invite. |
| C. Website visitors | Anyone who visits the TEPA marketing and sign-in pages. |
3. What personal information we collect
3A. Contributors
From organisations that engage you:
Contact information — your name and email address.
Role information — the project you contributed to and your role (e.g. job title).
From you:
Your survey answers (self-reported information) — only if you choose to provide this. This may include demographic information about yourself, your work and your experience of equity and inclusion. Some of this is information many people regard as sensitive, so we give it extra protection (see sections 6 and 10).
Usage information — basic information about how you use TEPA, to operate, secure and improve it.
Support information — anything you give us when you contact us for help.
No government identifiers. We do not collect or use any government-issued identifier (such as an IRD number).
3B. Organisation users
Account / contact information (name, work email, role information, organisation, login details); information about the projects you register; usage information; and support information. We do not knowingly collect sensitive information about organisation users.
3C. Website visitors
Device and connection data and cookies. Strictly necessary cookies make the site work; we also use limited analytics cookies to understand and improve how the site is used.
4. Where we get your information
Directly from you — when you complete a survey, create an account, contact us or use TEPA.
From the organisation that engaged you — when they register their projects on TEPA.
From other authorised users — when they invite you or add you to an account.
Automatically — through cookies, server logs and usage analytics.
Limited public sources — for example, public project credits, where we have a proper basis to do so.
When we receive your details from someone else. When an organisation gives us your contact and role information, we take reasonable steps to let you know — usually in the invitation we send you and through this notice — that we hold your information, why, who we are, and your rights to access and correct it. This is how we meet our obligations when we collect your information indirectly.
5. How and why we use your information
We only use your information for the purposes for which it was collected, or a directly related purpose you would reasonably expect, unless you agree otherwise or the law allows it. We use it to:
invite contributors and run the voluntary survey;
with your consent, collect and analyse your survey answers to produce anonymised reporting and benchmarks;
provide TEPA to organisation users and manage their access;
operate, secure, support and improve the tool; and
meet our legal and accountability obligations.
The reporting produced by TEPA is anonymised to ensure we do not share personal information (see section 10).
If you have taken part before. If you have already provided survey answers, we use your existing record to link you to additional projects organisations have associated you with without asking you to complete the survey again. We tell you each time this happens, and you can choose — project by project — not to have your information associated with any project.
6. Your survey answers and your consent
When you submit your answers, you consent to us using them only to: (a) create reports and analysis on the industry workforce, without identifying you; (b) seek further consents or information from you; (c) maintain and improve our service; and (d) remind you that we hold this information. These are the same uses set out in the collection notice shown to you in the survey.
We only collect your survey answers with your consent. Before you decide, we tell you what we are asking for and why.
Your consent is captured on your own device before your answers are sent to TEPA. You can try the survey first and decide whether or not to contribute at the end.
You can skip any question, choose "prefer not to say", or decline altogether — it does not affect anything else.
You can change your mind at any time and delete your answers by signing in, or by contacting us.
Your survey answers are protected by client-side field-level encryption — meaning even our authorised database administrators cannot access them — and reporting is anonymised so that you cannot be identified (see section 10).
7. Who we share information with
We do not sell your personal information and we do not share your survey answers with anyone other than you. We share other personal information only where necessary and lawful:
| Recipient | Purpose and safeguards |
|---|---|
| Our service providers (agents / sub-processors) | We use a small number of trusted service providers that act only as our agents under written contracts requiring equivalent protection (for example, cloud hosting, email, user support, sign-in and security services). They hold information only as our agent, so this is not a "disclosure" under the Privacy Act (see section 8). |
| Organisations using TEPA | Access only to (i) information they provided themselves and (ii) anonymised reporting that is not personal information. They are contractually prohibited from trying to re-identify anyone. They never see your survey answers. |
| Professional advisers; regulators, courts and law enforcement | Where we need professional advice, or where required by law, court order or to protect legal rights. We do not share survey answers with advisers. |
| A successor organisation | If our business or assets are reorganised or transferred, your information may pass to the successor under the same protections. |
8. Where your information is held (including outside New Zealand)
We store your personal information in New Zealand. Your survey answers and other personal information you provide are held at rest in Microsoft's New Zealand data-centre region.
Application processing. The part of TEPA that runs the service (the application/API) currently operates in Microsoft Azure's Australia region. This is a processing layer, not where your data is stored at rest, and your survey answers remain securely protected throughout.
Some other information. Some other information (such as contact, account, support, email-delivery and sign-in details) is handled by our service providers' systems located in Australia and the European Union — places whose privacy laws provide protection comparable to New Zealand's (Australia's Privacy Act 1988 and the EU GDPR). Our network and security provider (Cloudflare) operates across a global edge network; any information passing through it is in transit only, and your personal information remains secure and protected as it transits.
How we protect it. These providers hold information only as our agent, under written contracts requiring comparable safeguards. Holding by an agent is not a "disclosure" or cross-border transfer under the Privacy Act, and we remain responsible for your information.
9. How long we keep your information
We do not set fixed retention periods. We keep personal information only for as long as we are using it for a purpose described in this notice, review it periodically, and then securely delete it or fully anonymise it. Contributors can delete their personal information they provide at any time. We keep an internal retention policy that records how we apply these rules.
10. How we keep your information safe
We take the security of your information seriously. Our measures are kept under review to maintain best practices and currently include:
An information security management system certified to ISO/IEC 27001.
Encryption of personal information in transit and at rest, with client-side field-level encryption of your survey answers.
Differential privacy and related privacy preservation techniques applied to all reporting outputs.
Access controls and audit logging appropriate to the sensitivity of the information.
Storage of your personal information in highly secure Microsoft data centres in New Zealand.
Regular security testing, monitoring, staff training and confidentiality undertakings.
A documented breach-response process; where a breach is likely to cause serious harm we will notify the Office of the Privacy Commissioner (via NotifyUs) and affected individuals as soon as practicable, as required by the Privacy Act 2020.
11. Your rights and choices
TEPA is designed to give you direct control:
View and download — sign in to see and download your information.
Correct or update — edit your survey answers directly.
Link or not — choose to unlink or link your survey answers from projects you are associated with on a project by project basis.
Delete — delete your survey answers at any time; you can choose to keep your contact details so we respect your contact preferences.
Stop being invited — unsubscribe from invitations at any time.
In addition to these self-service options, under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it. You can exercise these rights free of charge by contacting our Privacy Officer (section 1); we will respond as soon as reasonably practicable and within the statutory timeframe. We may need to verify your identity first, to protect your information.
We will periodically remind you that we hold your information and how you can update or delete it. See section 14 for how we handle automated processing.
12. Māori data, iwi and Māori Data Governance
TEPA collects and reports information about Māori — including iwi affiliation and Māori descent — and we recognise this information is a taonga that deserves particular care. New Zealand privacy law does not set separate rules for Māori data, but we treat it as warranting a high standard of protection. Our approach is led by the principles of Māori Data Sovereignty and the Māori Data Governance framework developed by Te Kāhui Raraunga.
13. Children and young people
Contributors can include children, such as child actors. Some survey questions are not asked of people under 16. Where a contributor is under 16 or otherwise cannot give consent for themselves, a parent, guardian or authorised agent can provide consent and complete the survey on their behalf, and TEPA provides engagement flows designed for this. Communications and wording are written to be clear and age-appropriate. If you are a parent or guardian and believe we have collected your child's information without appropriate consent, please contact us (section 1).
14. Automated decision-making
We do not make any solely automated decisions about you that have a legal or similarly significant effect. We use automated processing to:
categorise personal information for reporting purposes;
apply differential privacy and other privacy-protecting techniques to data before reporting;
classify and prioritise support requests; and
detect and limit abusive or suspicious activity (for example, rate-limiting or temporary suspensions).
Where any of this could meaningfully affect you, a person is involved before a decision is taken.
15. Changes to this notice
We may update this notice from time to time — for example if our processing or the law changes. The current version and date are shown at the top of this document. We will notify active users of material changes by email or through TEPA.
16. How to make a complaint
Please contact our Privacy Officer first (section 1) so we can try to put things right. You also have the right to complain to the Office of the Privacy Commissioner — privacy.org.nz (0800 803 909).
17. Definitions
| TEP / we | The Everyone Project, the trading name of Every1data Limited — the agency responsible for personal information collected through TEPA. |
|---|---|
| TEPA / the tool | The Everyone Project Aotearoa — the New Zealand deployment of TEP's tool for measuring and reporting workforce inclusion in the screen sector. |
| Contributor | An individual who has contributed (paid or unpaid) to a project registered on TEPA or expects to. |
| Survey answers (self-reported information) | Information you choose to provide about yourself in the survey and any follow-up, or when you edit it later. It does not include information about you that we receive from anyone else (such as your name, email and role provided by the organisation that engaged you). |
| Differential privacy | A method of adding carefully calibrated random noise to results so that individual contributions cannot be reverse-engineered or re-identified. |
| Agent | An organisation that holds or processes information on our behalf and on our instructions (for example, our cloud, email, support, identity and security providers). |