Who we are
The National Bureau for Non-Governmental Organisations (the Bureau) is the data controller for personal information collected through this site. We are a department within the Ministry of Internal Affairs.
What we collect and why
We only collect what we need to deliver each service. The categories below cover everything on the public site.
- Complaint submissions: name, email, phone, and the description of your concern. We also store the IP address and browser of the device you submit from. We use this to investigate the complaint and to confirm receipt.
- Anonymous complaints: when you choose anonymous, we do not store your name or contact details. We still record the IP address as part of basic abuse prevention.
- Contact form messages: name, email, and the content of your message. We keep these only for as long as needed to respond.
- Server logs: every site visit is logged with a timestamp, the page you requested, your IP address, and your browser identifier. Logs are kept for 90 days for security and incident response.
Cookies and similar technologies
The site uses a small number of cookies. None of them tracks you across other sites. See our cookies notice for the full list and how to manage them.
Who we share with
We share information only when the law requires it or when it is needed to deliver the service you asked for. This means our infrastructure providers, the Ministry of Internal Affairs where escalation is appropriate, and law enforcement when statutory disclosure obligations apply.
We do not sell, rent, or trade personal information for marketing purposes.
How long we keep information
Records related to NGO and CBO regulation are kept for as long as the NGO Act 2016 requires. Complaint records are retained for the duration of any related investigation, and afterwards in line with our records retention schedule. Server logs are kept for 90 days unless a security incident requires a longer retention.
Your rights
The Data Protection and Privacy Act 2019 gives you the right to:
- be told what personal information we hold about you
- see a copy of that information
- ask us to correct something that is wrong
- ask us to delete information when there is no lawful reason to keep it
- complain to the Personal Data Protection Office about how we handle your data
To exercise any of these rights, write to us using the details on the contact page. We will respond within the timelines set by the Act.
Children
The site is not directed at children. We do not knowingly collect personal information from anyone we believe to be under 18. If you believe a child has shared personal information with us, contact us and we will delete it.
Changes to this notice
We will update this notice when our practices change. The date below shows the version that is currently in force.