TUF Privacy Policy

Last updated: 6 September 2026

1. About this policy

Thriving Under Fire Ltd (“TUF”, “we”, “us” or “our”) respects your privacy and complies with the New Zealand Privacy Act 2020.

This policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices and rights you have.

Personal information is information about an identifiable individual. It can include written information, photographs, audio or video recordings, emails, notes and online activity.

2. What personal information we collect

Depending on how you interact with TUF, we may collect:

  • Your name and contact details.

  • Your organisation, role and employment information.

  • Enrolment, attendance and membership information.

  • Purchase, invoice and payment information.

  • Enquiries, emails and other communications with us.

  • Survey responses, feedback and testimonials.

  • Information you share during workshops, coaching sessions, webinars or online communities.

  • Posts, comments and messages within TUF online communities.

  • Audio or video recordings and transcripts of sessions where recording has been notified.

  • Notes relating to enquiries, coaching, sales conversations and services provided.

  • Marketing preferences, including whether you have subscribed or unsubscribed.

  • Website information such as your IP address, browser, device information, pages visited and interactions with our website.

We do not normally receive or store your complete credit or debit card details. These are processed by our payment provider.

3. How we collect personal information

We normally collect information directly from you when you:

  • Visit our website or complete an online form.

  • Subscribe to our emails or download a resource.

  • Enquire about, purchase or use our services.

  • Enrol in a program, workshop, webinar or membership.

  • Participate in a recorded session.

  • Post or communicate within one of our online communities.

  • Contact us by email, telephone, video call, social media or another channel.

  • Complete a survey or provide feedback.

We may also receive personal information from:

  • Your employer or another organisation arranging or paying for your participation.

  • A person who refers or introduces you to us.

  • Publicly available professional or business sources.

  • Service providers acting on our behalf.

When we collect personal information about you from someone else, we will take reasonable steps to tell you about the collection when required by Information Privacy Principle 3A, unless an applicable exception applies.

4. Why we use personal information

We may use your personal information to:

  • Respond to enquiries and communicate with you.

  • Provide and administer our programs, workshops, memberships and other services.

  • Manage registrations, attendance, accounts and online-community access.

  • Process payments and maintain financial records.

  • Personalise and improve our services.

  • Provide coaching, support and follow-up.

  • Record, transcribe or summarise sessions where participants have been informed.

  • Conduct research and analysis using aggregated or de-identified information.

  • Send newsletters and information about our services where we have permission or are otherwise legally permitted to do so.

  • Maintain the security and integrity of our systems.

  • Meet our legal obligations and protect our legal rights.

  • Carry out another purpose you have authorised.

We will not use personal information for a materially different purpose without your authorisation unless permitted by law.

5. Programs, communities and recorded sessions

Some TUF programs include group discussions and online-community participation. Other participants may see your name, profile information and anything you choose to share within those spaces.

Please avoid sharing identifying or unnecessarily sensitive information about employees, customers or other third parties.

Some online sessions may be recorded or transcribed. We will tell participants when recording is taking place and explain who will have access to the recording.

Recordings and transcripts may include your name, image, voice and comments. We may use approved service providers, including transcription or AI-assisted tools, to process or summarise this information.

We will not use your identifiable image, recording, story or comments for promotional purposes without separate permission. We may use genuinely de-identified themes and feedback to improve or describe our services.

6. Employer-funded participation

If your employer or another organisation arranges or pays for your participation, we may provide that organisation with administrative information such as your enrolment, attendance or completion status.

We will not disclose the content of coaching discussions, personal reflections or online-community posts to your employer unless:

  • You have authorised us to do so.

  • This has been clearly agreed as part of the service.

  • Disclosure is required or permitted by law.

  • Disclosure is necessary to address a serious threat to someone’s health or safety.

7. Marketing communications

We may send you marketing emails or messages when you have consented to receive them or when the law otherwise permits us to do so.

‍Our commercial electronic messages will identify TUF and provide a clear way to unsubscribe. You may unsubscribe at any time using the link in the message or by contacting us.

‍New Zealand’s anti-spam rules require consent, identification of the sender and a functioning unsubscribe facility for commercial electronic messages. Department of Internal Affairs

Unsubscribing from marketing will not prevent us from sending essential messages about a service or membership you are currently using.

8. Who we may share information with

We may provide personal information to:

  • People working for or with TUF who need it to provide our services.

  • Website, email, CRM, payment, accounting and cloud-storage providers.

  • Online learning, community, video-conferencing and webinar providers.

  • Transcription, analytics and approved AI-assisted service providers.

  • Professional advisers such as accountants, lawyers and IT support providers.

  • Government, regulatory or law-enforcement authorities where required or permitted by law.

  • Another person or organisation you have authorised.

These providers may only receive the information reasonably necessary to perform their services.
We do not sell or rent personal information.

9. Information processed outside New Zealand

‍Some of our service providers may store or process personal information outside New Zealand.

‍Where a provider acts on our behalf, we remain responsible for the information as required by the Privacy Act. Where personal information is otherwise disclosed overseas, we will take reasonable steps to ensure it receives safeguards comparable to those provided by New Zealand privacy law.

Information Privacy Principle 12 requires appropriate protection when personal information is disclosed outside New Zealand. Cloud providers acting solely as agents are treated somewhat differently, but TUF still remains responsible for information it places with them. Office of the Privacy Commissioner

‍10. How we protect personal information

We take reasonable steps to protect personal information from loss, unauthorised access, disclosure, alteration and misuse.

These steps may include:

  • Limiting access to people who need the information.

  • Using password protection and multi-factor authentication where available.

  • Using reputable service providers.

  • Keeping software and systems reasonably secure.

  • Securely deleting or de-identifying information when it is no longer required.

  • Responding promptly to suspected privacy or security breaches.

No internet or storage system is completely secure, but we will take safeguards that are reasonable for the nature and sensitivity of the information.

11. How long we keep information

We retain personal information only for as long as it is reasonably needed for the purpose for which it was collected, or to meet legal, tax, accounting or dispute-resolution requirements.

Retention periods may differ depending on the type of information. When information is no longer required, we will take reasonable steps to delete it securely or de-identify it.

12. Privacy breaches

If a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as we are practically able, as required by the Privacy Act 2020.

This notification requirement is an important addition under the 2020 Act. Office of the Privacy Commissioner

13. Accessing and correcting your information

You may ask us to:

  • Confirm whether we hold personal information about you.

  • Provide access to personal information we hold about you.

  • Correct information that is inaccurate or incomplete.

We may need to verify your identity before responding. In some circumstances, the Privacy Act allows or requires us to withhold particular information.

If we do not make a correction you request, you may ask us to record a statement of correction with the information.

To make a request, contact our Privacy Officer using the details below.

14. Cookies and website information

Our website may use cookies and similar technologies to:

  • Operate and secure the website.

  • Remember settings and preferences.

  • Understand how visitors use the website.

  • Measure the effectiveness of communications and advertising.

You can control cookies through your browser settings and, where available, our website’s cookie controls. Disabling some cookies may affect how the website operates.

Third-party websites linked from our website have their own privacy policies. We recommend reviewing those policies before providing them with personal information.

15. Changes to this policy

We may update this policy when our services, technology or legal obligations change.

The current version will be published on our website with its effective date. If we make a significant change affecting how we use personal information, we will take reasonable steps to bring it to the attention of affected people and obtain authorisation where required.

16. Contacting us

Thriving Under Fire Ltd has appointed a Privacy Officer.

Privacy Officer

John Faisandier
Thriving Under Fire Ltd
Email: admin@tuf.co.nz
Address: 126 Brougham St
Mt Victoria
Wellington 6011

If you believe we have not handled your information appropriately, please contact us so we can investigate.

You may also make a complaint to the Office of the Privacy Commissioner.

‍ ‍