Privacy statement.

What is a privacy statement?

This statement explains how Dobbie collects, uses, looks after, and shares personal information when we deal with people outside our team. That includes our clients and the people who work for them, the people we meet on site, our suppliers, people who contact us or use our website, and job applicants.

We have a separate privacy statement for our own employees and contractors. This one is for everyone else we deal with in our engineering work.

We are committed to handling your personal information lawfully, fairly, and openly, in line with the Privacy Act 2020 and its Information Privacy Principles.

Our privacy commitment

We take reasonable steps to make sure the personal information we handle is:

• collected only for a genuine and lawful business purpose
• collected fairly and without being unreasonably intrusive
• used and shared only for the purpose we collected it for, or as the law otherwise allows
• kept accurate, up to date, and secure
• kept only for as long as we reasonably need it
• available to you for access and correction under the Privacy Act 2020

When you give us personal information, please only give us someone else's information if you are authorised to do so, give us only what is reasonably needed, make sure it is accurate and complete, and tell us promptly if anything changes or is wrong. Avoid sending us sensitive personal information we do not need. Contact us promptly if you want to raise a privacy concern or you think information has been lost or accessed by mistake.

Who this statement covers

This statement applies to personal information we handle about people outside our team, including:

• current, former, and prospective clients
• employees, representatives, and other people who work for our clients
• people we meet when we attend client or project sites
• supplier and service-provider contacts
• people who visit or use our website
• people who make enquiries or get in touch with us
• job applicants
• visitors to our offices, events, or work locations
• anyone else we deal with in connection with our engineering consultancy work

When we collect personal information

We collect personal information across a range of everyday business situations, including when providing engineering consultancy services, when visiting client or project sites, when responding to enquiries, when administering accounts, when recruiting, when people use our website, and when managing health, safety, and site access.

Examples of the specific situations in which we collect personal information:

• Engineering services: when engaged to provide engineering, advisory, design, project, investigation, or related consultancy services; when communicating with a client or project team; when preparing proposals, reports, designs, assessments, or deliverables; when coordinating with contractors, consultants, utilities, or authorities; and when administering contracts, projects, variations, invoices, and payment arrangements.
• Site visits: when our people attend sites for inspections, surveys, investigations, or assessments; meetings, inductions, or site-access processes; health, safety, incident, hazard, or emergency management; and site security, identification, or visitor management.
• Enquiries and relationships: when people contact us by email, phone, website form, or other channels; when requesting information, proposals, or services; and when providing feedback or correspondence.
• Accounts and administration: when setting up or managing client or supplier accounts; when processing invoices or payments; and when maintaining contact databases and relationship records.
• Recruitment: from job applicants and referees during our recruitment and hiring processes.
• Website and digital systems: when people visit or use our website or online services, submit online forms, or interact with our systems.
• Health, safety, and access: when managing site access and visitor records, verifying identity or authority, recording incidents or hazards, and meeting our workplace health and safety obligations.

How we collect personal information

Where we can, we collect personal information directly from the person concerned: through meetings, emails, calls, forms, applications, correspondence, site processes, website interactions, and other direct dealings. When we collect information directly from you, the Privacy Act generally requires us to take reasonable steps to tell you why we are collecting it and your rights of access and correction.

We may also collect personal information indirectly, including from clients and the people who work for them, employers or organisations you represent, contractors and other project participants, referees, recruitment agencies, public registers or other publicly available sources, professional advisers, service providers acting on our behalf, and other third parties where we are authorised or the law allows. Where we collect personal information about you indirectly, we take reasonable steps to let you know as required by Information Privacy Principle 3A, unless an exception applies.

What personal information we collect

The types of personal information we collect depend on the situation. Examples include:

• Client and project work: name, job title, employer, business address, email, phone number, project role, communications, meeting records, instructions, approvals, and project contact details.
• Site visits and site activities: name, employer, role, location details, visitor and sign-in records, identification details, induction records, licence or competency details, incident or hazard information, health and safety information relevant to site access, and CCTV footage at our office premises.
• Enquiries and relationships: name, organisation, contact details, the subject of your enquiry, correspondence, meeting notes, preferences, and records of our interactions.
• Accounts and administration: billing contact details, purchase order details, bank or payment contact information, credit-related information where appropriate, and transaction and account records.
• Recruitment: CVs, cover letters, qualifications, employment history, references, work eligibility information, interview notes, and related recruitment material.
• Websites and digital systems: IP address, browser or device information, website usage, cookie-related information, form submissions, and login or system interaction records.
• Security and access: identity or authority information, access permissions, visitor logs, security records, and system usage data.
• Complaints, disputes, and legal matters: complaint details, investigation material, witness or contact information, correspondence, and claims-related information.

How we use personal information

We may use personal information to:

• provide engineering consultancy and related services
• communicate with clients, project teams, suppliers, applicants, and others
• verify identity, role, authority, or instructions
• manage projects, site attendance, deliverables, and client relationships
• assess and respond to enquiries, requests, and complaints
• administer contracts, procurement, accounts, and payments
• recruit and assess job applicants
• maintain our business records and relationship management systems
• protect health, safety, security, systems, premises, and people
• improve our services, systems, website performance, and operations
• carry out reporting, analytics, quality assurance, and planning
• obtain professional advice and manage insurance matters
• establish, exercise, or defend legal rights and claims
• meet our legal, regulatory, and professional obligations
• carry out any other use you have authorised, or that the law permits

AI and your information

We use approved AI tools to help us deliver our services and run our business, for example to draft, summarise, analyse, organise, and search information. An engineer always reviews AI output before it is used in your work.

Where we use AI in connection with personal information, we apply privacy and security safeguards, confidentiality controls, internal approval and usage controls, and provider or contractual controls where appropriate. We only handle your information through approved AI tools in ways that are consistent with this statement and the law.

Our separate AI Policy explains in detail how we use AI, what information goes into AI tools, what we will not do, where your information goes, and the choices you have, including the right to opt out. Please read the two documents together.

Who we share personal information with

We may share personal information where the law permits or requires it. Any sharing stays subject to any specific confidentiality obligations we have agreed about a client's confidential information.

Depending on the situation, we may share personal information with:

• clients and their representatives
• contractors, subcontractors, and consultants
• other project participants
• suppliers and service providers
• IT, cloud, software, and approved AI providers
• document management, hosting, communications, and collaboration providers
• payment, banking, finance, and administration providers
• professional advisers, including lawyers, accountants, and auditors
• insurers, brokers, and claims advisers
• recruitment agencies, referees, and assessment providers
• regulators, government agencies, statutory authorities, and industry bodies
• courts, tribunals, dispute resolution bodies, and law enforcement agencies
• a purchaser, successor, or counterparty in connection with a business reorganisation, sale, or transaction
• anyone else you have authorised, or that the law permits or requires

We do not share personal information more widely than is reasonably necessary for the purpose.

Sending information overseas

Some of the service providers and systems we use store or process personal information outside New Zealand, including in Australia, the United States, the European Economic Area, and Canada.

Where we disclose personal information to an overseas recipient for that recipient's own purposes, we only do so where the Privacy Act 2020 allows, and we rely on the cross-border safeguards in Information Privacy Principle 12.

If you don't give us information

If you choose not to give us information we reasonably need, we may not be able to:

• respond to your enquiry
• provide our services
• progress a project
• grant site or system access
• consider an application
• process a payment or administrative request
• otherwise deal with you effectively

How we protect and retain your information

We take reasonable steps to protect the personal information we hold against loss, and against unauthorised access, use, change, disclosure, and other misuse. That includes requiring appropriate privacy and security safeguards from the service providers who handle personal information on our behalf.

We keep personal information only for as long as we need it for the purpose we collected it, and for as long as our professional, legal, and insurance obligations require or permit, which for our engineering work includes the period we remain liable for our designs. When we no longer need it, we take reasonable steps to delete, dispose of, or return it. Because we run routine backups across our files, email, and document systems, copies may remain in our secure backup systems for a time and cannot always be fully removed.

Your rights

Under the Privacy Act 2020, you can ask for access to the readily retrievable personal information we hold about you, and you can ask us to correct it. We may ask you to confirm your identity before we respond, and we will consider and answer your request in line with the Act.

To make an access or correction request, please contact our Privacy Officer using the details below. Please give us enough detail to identify you and the information you want to access or correct.

Complaints

If you have a privacy concern or complaint, please contact us first so we have the chance to look into it and respond. Please include your name and contact details, details of your concern or complaint, any relevant dates, correspondence, or supporting information, and the outcome you are seeking.

If we cannot resolve your concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

Website and digital use

When you use our website or digital channels, we may collect technical and usage information such as your device, browser, IP address, access times, pages visited, the contents of online forms, and cookie-related information.

We may use that information to operate and secure our website and digital systems, understand how our site is used, improve performance, content, and user experience, troubleshoot issues, and support analytics and administration.

Our website measurement uses Cloudflare Web Analytics, a cookieless service: it counts page views and enquiry-form submissions in aggregate, without cookies, cross-site tracking, or personal profiles.

Where we link to third-party sites or platforms, those third parties have their own privacy statements and practices, and this statement does not cover them.

Changes to this statement

We may update this statement from time to time. The most current version is the one we make available through our usual external channels. The revision is shown at the top of this statement.