Privacy policy

• Candidates: people asked to complete a background check through v’chex.
• People who order and manage checks: staff of organisations that use v’chex, and of screening providers.
• Visitors to vchex.com.

From candidates, depending on the checks you’re asked to complete:

• your name, any previous names, date and place of birth, gender, email and mobile number
• your address history
• your employment history, referees’ contact details and qualifications
• photos of your identity document, and the details read from it
• your consent, and your answers to questions such as whether you’d like your own copy of your Ministry of Justice report
• the results and reports of your checks

From people who order and manage checks: your name, work email and phone number, role, the checks you order, and what you do in the portal.

When you use v’chex: if you sign in, a cookie keeps you signed in. We log key actions, such as submissions and document uploads, with the IP address they came from. vchex.com doesn’t use advertising or analytics cookies, or any tracking.

• From you, through your secure link or the v’chex portal.
• From the organisation asking for your check. It gives us your name, contact details and the checks to run. We tell you this in your invitation email and before you start, as the Privacy Act requires when information comes from someone other than you.
• From others involved in a check, depending on the checks: the Ministry of Justice, credit reporting agencies, your referees and education providers.

• To carry out the background checks you’ve been asked to complete, and give the results to the organisation that asked for them.
• To confirm your identity, including reading the details on your identity document.
• To run v’chex: sending invitations, codes and notifications, and helping you when you need it.
• To keep v’chex secure and investigate misuse.
• Where the law requires it.

We use personal information only for the purpose it was collected for. We don’t sell it, or use it for marketing.

• The organisation that asked for the check. It sees your results and reports, and each report opens only after the person opening it agrees to handle it under the Privacy Act 2020: using it only for this check, sharing it only with people who need it, and storing and disposing of it securely.
• Organisations that carry out part of a check, such as the Ministry of Justice, credit reporting agencies, referees and education providers. Each receives only what it needs.
• Service providers that run v’chex for us, such as hosting, storage and email.
• Anyone else only where the Privacy Act permits or requires it.

• Information is encrypted in transit and when stored.
• Candidate links are personal and expire after 7 days. Coming back to a saved form needs a six-digit code sent to the candidate’s email, valid for 10 minutes.
• Access is limited by role: organisations see only their own checks, and screening staff see only the checks their role allows.
• Every report opens only after the privacy agreement described above.
• Key actions are logged, so access and changes can be traced.

• Photos of identity documents are securely deleted 90 days after the candidate submits.
• Everything else is kept only as long as it’s needed for the check and the requesting organisation’s records, or as the law requires, and then securely deleted.

You can ask to see the personal information we hold about you, and ask us to correct it. Email privacy@vchex.com. We’ll respond as soon as reasonably practicable, and within 20 working days, as the Privacy Act requires. If we can lawfully withhold anything, we’ll tell you why.

Candidates can also ask for their own copy of their Ministry of Justice report when completing their form.

If personal information is lost, or accessed or disclosed without authority, we act straight away to contain it and assess the risk of serious harm. If serious harm is likely, we notify the Office of the Privacy Commissioner and the people affected as soon as practicable.

Contact our Privacy Officer at privacy@vchex.com.

You can also raise a concern with the Office of the Privacy Commissioner at privacy.org.nz.

We review this policy at least once a year, and after any significant change to the law or to how v’chex works. The date at the top shows when it last changed.

v’chex is operated by Templeman & Associates Limited.