Privacy Policy

1. About This Policy

1.1 This privacy policy applies to the collection, use, storage, and disclosure of personal information by Te Rūnanganui o Ngāti Porou (TRONP) in connection with the Ngāti Porou Register (“the Register”), including through the O-RA registration platform accessible at app.o-ra.io (“the Platform”), the ngati porou website at ngatiporou.com/registration (“the Website”), and any paper-based registration processes

1.2 For the purposes of this policy, unless the context requires otherwise:

“you” and “your” refer to you as a person registering, or registered, as a member of Ngāti Porou, or accessing the Website or Platform;
“we”, “our”, and “us” refer to Te Rūnanganui o Ngāti Porou and include our employees, contractors, representatives, and other authorised personnel;
“the Act” means the Privacy Act 2020, and includes the Privacy Amendment Act 2025;
“IPP” means the Information Privacy Principles under the Act;
“Māori data” means personal information that is about Māori, created by Māori, or of particular significance to Māori individuals, whānau, hapū, and iwi;
“personal information” has the meaning given to that term in the Privacy Act 2020;
“Trust Deed” means the Amended and Restated Trust Deed of Te Rūnanganui o Ngāti Porou (2018), as amended from time to time;
“O-RA” means the Original Registry Application, a platform operated by Identity Connection Evolution Limited, which hosts the Register on our behalf.

2. Acknowledgement of Māori Rights Over Māori Data

2.1 We recognise and uphold:

The right of Ngāti Porou whānau, hapū, and iwi to exercise rangatiratanga (self-determination and authority) over their own data;
That Māori data sovereignty requires the application of tikanga specific to the collection and use of Māori data;
That all data is exclusively stored and operated within Aotearoa New Zealand, with 100% New Zealand-owned and -operated IT infrastructure;
The importance of Māori data governance through our documentation, training, and tools to safeguard Māori data and the communities from which it derives;
The collective nature of Māori data and its connections across whānau, hapū, iwi, and te taiao;
Our role as kaitiaki (stewards), not owners, of Māori data entrusted to us by our people.

2.2 We acknowledge that for whānau, hapū, and iwi, data , particularly whakapapa , is not merely individual information but a taonga with sensitivities of critical importance. We commit to ensuring that any data processing we undertake does not undermine, exploit, or misrepresent Māori knowledge, identity, or relationships, but instead supports Māori wellbeing, autonomy, and self-determination.

2.3 In addition to the legal protections of the Act, the principles of Māori data sovereignty and governance apply to our handling of all data on the Register.

3. Information We Collect

3.1 When you register as a member of Ngāti Porou, whether online through O-RA, by paper form, or with the assistance of a Registry Officer, we may collect the following personal information:

Your full name (including any aliases), title, gender, and date of birth;
Your contact details, including postal address, physical address, email address, and phone number;
Proof of identification, such as a New Zealand driver licence, passport, firearms licence, 18+ card, or birth certificate;
Your whakapapa (a minimum of three generations), including names, gender, waka, iwi, hapū, and marae affiliations of your tūpuna;
Your primary marae and Rohenga Tīpuna affiliation;
Additional details such as te reo Māori proficiency level, employment status, occupation, and qualifications;
Business ownership information and NZBN details (if applicable);
Spouse and tamariki details (if you choose to provide them);
A profile photograph (optional);
Supporting documents, such as whakapapa certification and declaration forms;
Your preferred contact method (email or post); and
Any correspondence or messages exchanged with us through O-RA or other channels.

3.2 If you access the Website or Platform, we may also collect browsing activity information, including your IP address, geographical location, internet service provider, browser type, device information, and pages visited. This information is collected through cookies and server logs.

4. How We Collect Your Information

4.1 We collect your personal information directly from you when you complete a registration (online or on paper), update your profile, submit a membership application, or contact us.

4.2 We may also collect personal information about you from a whānau member who manages profiles on your behalf (for example, a parent registering tamariki under 18 years of age, or a whānau profile manager acting for kaumātua). Where this occurs, the person providing your information is responsible for ensuring they have your authority or the appropriate authority to do so.

4.3 In accordance with the Act, if we collect your personal information indirectly (from a source other than you), we will take reasonable steps to notify you as soon as practicable of the fact and purpose of the collection, who will receive it, our contact details, and your rights of access and correction.

4.4 We may also hold personal information that was transferred from our previous registration systems, including the register maintained under the Māori Trust Boards Act 1955, as provided for in rule 7.1 of the First Schedule to the Trust Deed.

5. Purpose of Collection

5.1 We collect and use your personal information for the following purposes:

To maintain the Ngāti Porou Register in accordance with the Trust Deed, including the First Schedule (Membership of Ngāti Porou and Ngāti Porou Register);
To process and assess your membership application, including verification of whakapapa by the Ngāti Porou Membership Committee (rule 4 of the First Schedule);
To determine your eligibility for elections, voting, and participation in Ngāti Porou affairs, including your Rohenga Tīpuna affiliation (Second Schedule);
To communicate with you about your registration, application status, and Ngāti Porou pānui (notices), events, and developments;
To administer grants, distributions, and other entitlements available to registered members;
To provide your name and address to your affiliated marae, where you have consented to this sharing or where it is permitted under rule 7.4 of the First Schedule;
To make the Register available for inspection by adult members of Ngāti Porou during business hours, subject to any privacy protection policies adopted by TRONP (rule 7.3 of the First Schedule);
To comply with our legal obligations, including under the Act, the Trust Deed, and where authorised, to provide information to government agencies such as Statistics New Zealand and the Electoral Office;
To improve our services, website, and registration processes through statistical analysis and research (using de-identified or aggregated data where possible).

6. Tamariki (Children) Information

6.1 Tamariki aged 17 years and under may be registered by a parent or authorised whānau member through the O-RA Platform. In accordance with rule 6.3 of the First Schedule, it is the responsibility of a parent or guardian of a person under 18 years to ensure that person’s name is included on the Register.

6.2 We collect limited personal information about tamariki, including their name, gender, date of birth, and residential address. Tamariki information is held within their parent’s or guardian’s profile and is not independently accessible. We do not use tamariki data for any purpose other than maintaining the Register and supporting whānau connection.

6.3 Once a tamaiti turns 18, they are encouraged to apply for their own membership and create their own independent O-RA account.

7. Disclosure of Personal Information

7.1 We may disclose your personal information to the following parties:

Identity Connection Evolution Limited (O-RA), as our platform provider, for the purpose of hosting and operating the Register. O-RA’s use of your personal information is governed by its own privacy statement and its contractual obligations to TRONP;
The Ngāti Porou Membership Committee, for the purpose of reviewing and deciding on membership applications (rule 4 of the First Schedule);
Your affiliated marae, where you have consented to the sharing of your name and address, or where permitted under rule 7.4 of the First Schedule. Marae that receive such information may only use it for purposes in connection with that marae;
Adult members of Ngāti Porou, to the extent that the Register is made available for inspection during business hours in accordance with rule 7.3 of the First Schedule, subject to any privacy protection policies adopted by TRONP;
Third-party service providers who assist us with communications, data cleansing, or IT services, provided they are bound by confidentiality obligations and operate within New Zealand;
Election service providers, including the Chief Returning Officer, for the conduct of Ngāti Porou elections in accordance with the Second Schedule;
Government agencies, where required or authorised by law, including Statistics New Zealand and the Electoral Office where you have given your authorisation; and
Any other party, where you have provided your express consent.

7.2 We will not sell, trade, or rent your personal information to any third party.

7.3 Where data concerns Māori individuals or whānau, we will consider the collective and cultural context of that data before any disclosure and provide opportunities for Māori governance oversight.

8. Cookies and Website Browsing

8.1 The Website and the O-RA Platform may use cookies. A cookie is a small data file sent to your device when you visit a website, which allows us to gather information such as the date, time, duration, and frequency of your visits, and the pages you access.

8.2 We use cookies for the following purposes: storing and honouring your preferences and settings; enabling you to sign in; analysing how the site performs; understanding overall visitor activity; and other legitimate operational purposes.

8.3 Cookies do not personally identify you unless you are logged in to an account.

8.4 You can configure your web browser to accept, reject, or be notified about cookies. Refer to your browser’s help menu for instructions. If you choose not to accept cookies, we will not use them for your visit except to record that you have not consented.

9. Overseas Parties

9.1 Your data is stored and processed exclusively within New Zealand, using New Zealand-owned and -operated infrastructure, in accordance with our commitment to Māori data sovereignty.

9.2 In the unlikely event that a third-party provider based overseas is engaged, we will take reasonable steps to ensure they are subject to comparable privacy safeguards to those in the Act, and we will assess how tikanga, data sovereignty, and Māori governance concerns are addressed by that provider.

10. Storage and Security

10.1 We are committed to keeping your personal information secure. We take all reasonable steps with physical, technical, organisational, and electronic security measures to protect your personal information against loss, damage, misuse, unauthorised access, erroneous disclosure, alteration, and destruction.

10.2 Personal information is held in secure electronic databases operated by O-RA within New Zealand. Access to the Register is controlled through permission levels, ensuring that only authorised TRONP staff can view and manage member records.

10.3 Our security, storage, and deletion practices reflect both high-grade technical standards and tikanga-aligned protocols for cultural integrity.

10.4 You are responsible for ensuring the security of your own login credentials and any personal information held on your devices.

11. Access and Correction

11.1 You have the right under the Act to request a copy of the personal information we hold about you, and to request that we correct any information that is inaccurate, incomplete, or out of date.

11.2 You can update your personal details, contact information, and whānau information at any time by logging in to your O-RA account at app.o-ra.io.

11.3 To request access to or correction of your personal information, or if you are unable to update your details online, please contact us at: registrations@tronp.org.nz

11.4 To ensure the integrity and safety of member information, we will verify your identity before disclosing information, and we will only disclose information where our internal procedures are satisfied and where we are entitled by law to do so.

11.5 In accordance with rule 7.3 of the First Schedule, the Register is available for inspection during business hours by all adult members of Ngāti Porou, subject to any policies adopted by TRONP for the protection of private information.

11.6 Our governance framework ensures that whānau, hapū, and iwi interests may also be engaged where relevant, to ensure integrity and culturally appropriate handling.

12. Data Retention and Disposal

12.1 We retain your personal information on the Register for as long as you remain a registered member of Ngāti Porou.

12.2 For declined applications, personal information is retained for a minimum period of two years to allow for reapplication with new evidence, or for dispute under clause 27 of the Trust Deed (Dispute Resolution). After this period, the information will be securely disposed of unless a dispute or reapplication is pending.

12.3 For deceased members, the profile is updated to reflect their status in accordance with our procedures. In line with clause 26.1 of the Trust Deed (Archiving of Records), records are retained for a minimum period of seven years. Whakapapa information may be retained indefinitely as part of the collective record, given its significance as a shared taonga for current and future generations.

12.4 For archived or inactive profiles, data is retained in accordance with clause 26 of the Trust Deed, which provides that records may be held for longer than seven years where TRONP considers they contain information that is still required.

12.5 When personal information is no longer required and no legal or tikanga-based reason for retention applies, it will be securely destroyed or de-identified in accordance with the Act.

13. Complaints

13.1 If you are not satisfied with our response to a privacy request, or if you believe we have interfered with your privacy, you have the right to make a complaint to the Office of the Privacy Commissioner. You can contact the Privacy Commissioner at www.privacy.org.nz or by calling 0800 803 909.

14. Changes to This Policy

14.1 This privacy policy may be updated from time to time. The revised version will be published on the Website and the Platform, with the date of the latest update noted above.

14.2 We encourage you to review this policy periodically. By continuing to use the Platform or Website after any changes, you acknowledge and accept the updated policy.

Te Rūnanganui o Ngāti Porou

Ngāti Porou Registration Privacy Policy