Privacy policy

This policy covers oerg.org.nz. It does not cover anything that happens in person , or on the social media pages we link to, which have their own privacy terms .

Who we are

Oruawharo Emergency Response Group, 11 Oruawharo Road, Oruawharo. Phone 029 773 9085. Email kirstie@oerg.org.nz.

We are the agency responsible for personal information collected through this site. If you want to talk to someone about privacy, use the address above.

What we collect

Nothing. There is no form on this website — no contact form, no sign-up, no registration — so there is nowhere for you to type your name, your address or anything else, and we do not ask you for any of it.

There is nothing on this site for you to sign up to and nothing to pay for, so we never collect a password or a card number from you. Our own volunteers sign in to a separate area, described below.

If you get in touch by phoning one of the numbers on this site, or by emailing one of the addresses on it, then of course we have whatever you tell us — but that is a phone call or an email between you and us, not something this website collected.

Why we collect it

We don't. If you contact us directly, we use what you tell us to reply to you and to help you, and for nothing else. We do not use your details for marketing, we do not add you to a mailing list, and we do not sell, rent or trade personal information to anyone.

What we don't do

This site carries no advertising tags and no tracking pixels. There is no Google Analytics, no Meta pixel and no third-party script of any kind. Nothing on this site follows you to other websites, and nothing about your visit is sent to another company.

We do count how many people read our pages. That happens entirely on our own server and is described under counting page views below.

We also deliberately don't use reCAPTCHA or a similar captcha service, because it would send information about you to an overseas provider. Where this site needs to tell a person from a bot — at our own volunteers' sign-in page — it does so entirely on our own server.

Cookies

The public pages of this site set no cookies at all. You can read every page here without one.

One cookie exists, named oerg_session, and it appears only inside the volunteers' sign-in area described below — never on a page open to the public. It holds a random session identifier and nothing else: no personal information, no tracking, and it is deleted when the browser is closed.

Counting page views does not use a cookie, so there is no cookie banner on this site and nothing for you to accept or refuse.

Counting page views

We keep a simple count of how often each page is read, so we know which parts of the site are useful and when people are looking. It runs on our own server. Nothing is sent to an analytics company, and no information about your visit leaves us.

For each page view we record the date and time, which of our pages it was, and whether the visitor was using a phone, a tablet or a computer. If you followed a link from another website we record the name of that website — for example google.com — but never the page you came from, and never anything you searched for.

If the page you asked for does not exist, we also record the address you asked for, so we can find broken links and fix them. We leave off anything after a question mark, and if the address looks as though it contains an email address or a phone number, that part is blanked out before it is stored. The address is deleted after 90 days.

We do not store your IP address, and we do not set a cookie to count you. So that we can tell one visit from ten page views, we store a short scrambled code worked out from your connection and your browser. That code is rebuilt from scratch every day, so it cannot be used to recognise you tomorrow, it cannot be used to follow you over time, and it cannot be turned back into your address. It is not linked to your name, your email, or anything you have ever sent us.

We count taps as well as pages. If you tap one of our phone numbers, one of our email addresses, or a link that takes you to another website — our Facebook group, for instance — we record that one of those was tapped, and the date and time. We do not record who tapped it, what page you were on, or anything that happens after you get there: once you are on another company's website, what you do is between you and them. This is the only part of our counting that needs a script running in your browser, so if you have JavaScript turned off, or a blocker on, it simply does not happen — nothing else about the site changes.

We also count how many of our visitors are not people at all — search engines and AI assistants reading the site — because we would like to be found by both. We work that out from the name the visiting software gives for itself, and we do not keep that name for ordinary visitors. It tells us nothing about you, and a name we do not recognise is simply counted as a person.

These counts are kept for up to 400 days, so we can compare one season with the same season a year earlier, and are then deleted automatically. Only our own management can see them, and what they see is totals — never one person's activity, because we do not hold it.

Our staff area

Part of this site is a password-protected area our staff sign in to. It is not open to the public and nothing you send us through the contact form appears in it.

For each staff account we hold a name, a work email address, a role, and the time of the most recent sign-in. Passwords are never stored — only a one-way cryptographic hash, which cannot be turned back into the password. Accounts are created and removed by our system administrator, and are deleted or disabled when someone no longer needs access.

If you are a staff member and want to see or correct what is held about your account, ask the site administrator, or use the contact details at the end of this page.

Our server logs

Our server keeps a short technical log so we can tell whether the site is working. It is written to record what happened, not what you submitted — it deliberately contains no names, email addresses, phone numbers or message text.

Your IP address is never stored in readable form. Where we need to recognise repeat requests from the same connection — to stop a bot flooding the contact form — we store a one-way salted hash of the address, which cannot be turned back into the original. Logs are automatically deleted after 30 days.

Who can see what you send us

Because this site has no form, nothing you send reaches us through the website itself. An email or a phone call goes to our own mailbox or our own phone and is read or answered by the volunteers who handle enquiries. Beyond that:

• Our hosting provider operates the servers this website and its email run on, and can technically access what is stored there.
• Our website administrator maintains the site for us. They act on our behalf and under our instructions, and in the course of keeping the site and its email working they can reach what is stored on it. Information held by an agent in this way is treated under the Privacy Act as held by us, not as having been given to someone else.

We don't disclose your information to anyone else unless you ask us to, or the law requires it.

Where your information is stored

This website is hosted on servers provided by Hostinger. Depending on the region our hosting is provisioned in, information you send through the site may be stored on servers outside New Zealand. Where that is the case, we rely on our provider's contractual commitments to protect it to a standard comparable to the Privacy Act.

How long we keep it

Emails you send us are kept only while they are useful — long enough to deal with your enquiry and any follow-up — and are then deleted. Technical logs are deleted automatically after 30 days.

Keeping it safe

The site is served over an encrypted HTTPS connection. Our configuration and credentials sit outside the publicly reachable part of the server, and the log directory cannot be fetched over the web.

No website can promise perfect security, but we don't hold sensitive information here, and we don't keep more of it or keep it longer than we need.

Seeing or correcting your information

Under the Privacy Act you have the right to ask us what personal information we hold about you, to get a copy of it, and to ask us to correct it if it's wrong. Email kirstie@oerg.org.nz or phone 029 773 9085 and we'll sort it out. We may need to check who you are first. There's no charge, and we'll respond within 20 working days.

You can also ask us to delete an email you've sent us, and we will unless we need to keep it for a legal reason.

If you're not happy

Tell us first and we'll try to put it right. If you're still not satisfied you can complain to the Office of the Privacy Commissioner: privacy.org.nz, or 0800 803 909.

Changes to this policy

If we change how this site handles personal information, we'll update this page at the same time. This version was last reviewed on 14 October 2026.