Institutional Privacy & Data Protection Policy

Effective Date: 1 January 2026
Last Reviewed: March 2026

RESEARCH AND COMMUNICATIONS GROUP LIMITED (referred to herein as "the Company", "RCG", "we", "us", or "our", NZBN: 9429032992106, Company No. 2071353) is committed to safeguarding the privacy and confidentiality of personal, corporate, and diagnostic information entrusted to us by client organizations, researchers, and portal visitors.

1. Statutory Framework and Jurisdiction

Our data processing practices adhere strictly to the Privacy Act 2020 (New Zealand) and the Information Privacy Principles (IPPs) outlined therein. Where our advisory practice engages with international clients or users residing within the European Union, Australia, or California, we also uphold compliance with the General Data Protection Regulation (EU GDPR), Australian Privacy Principles (APPs), and the California Consumer Privacy Act (CCPA/CPRA).

2. Categories of Information Collected

We collect information only to the extent necessary to provide management consulting, research dissemination, and institutional communication:

• Direct Inquiries & Engagement Records: Full name, professional title, corporate entity, institutional email address, telephone contact, and scope requirements submitted via our consultation forms.
• Diagnostic & Assessment Inputs: Aggregated organizational parameters (e.g. employee range, strategic priorities) provided within our interactive diagnostic tools.
• Technical & Log Data: IP address, browser user-agent, operating system, referring URL, and session timestamps collected automatically to maintain server security and prevent malicious traffic.
• Commercial Billing Information: Corporate invoicing details, tax identification numbers, and banking details required for formal consulting engagements.

3. Purpose and Legal Basis for Processing

We process collected data exclusively under the following lawful bases:

• Performance of a Contract: Reviewing inquiries, preparing formal advisory proposals, and delivering consulting deliverables.
• Legitimate Interests: Maintaining network security, preventing fraudulent activity, and refining research monographs.
• Legal Compliance: Satisfying statutory record-keeping obligations under New Zealand corporate, tax, and anti-money laundering legislation.

4. Institutional Confidentiality & Non-Disclosure

Information is shared only with trusted technical service providers (e.g., ISO-certified cloud hosting infrastructure, banking networks) bound by strict confidentiality and data protection covenants.

5. Data Retention and Archival

Diagnostic records and consultation inquiries are retained only for the duration necessary to satisfy the commercial engagement or as required by New Zealand tax and corporate law (typically seven years for financial engagement records).

6. Your Statutory Privacy Rights

Depending on your jurisdiction, you possess the right to:

• Request access to personal data held about you by our practice.
• Request the correction of inaccurate or incomplete records.
• Request the erasure of personal records ("Right to be Forgotten"), subject to statutory compliance retention.
• Object to or restrict specific data processing activities.
• Lodge a complaint with the New Zealand Office of the Privacy Commissioner (OPC) at www.privacy.org.nz or your national data protection authority.

7. Contact the Data Protection Officer

To exercise your rights or submit inquiries regarding our privacy standards, contact: