Privacy Policy

This Privacy Policy explains how Step By Step Training Limited (“Step By Step”, “we”, “us”) collects, uses, holds, and shares personal information in connection with our training services. It applies to all parties who interact with Step By Step, including learners, trainers, Purchasers, and other stakeholders.

Step By Step is committed to respecting your privacy and handling personal information in accordance with the Privacy Act 2020 (New Zealand).

1. Who we are

Step By Step Training Limited is a New Zealand-based NZQA-registered private training establishment delivering digital skills, literacy and numeracy, and vocational training services to adult learners across Aotearoa New Zealand.

Step By Step works with independent contractor trainers and with Purchasers, including vocational service providers such as ACC, government agencies, employers, and other referral funders, who fund and commission training through Step By Step.

2. What information we collect

2.1 Learner information

To deliver training services, Step By Step collects personal information about learners, including:

• name and contact details including phone, email, and address
• referral information, including the programme under which training is being funded
• training needs, goals, and learning history
• session records, progress notes, attendance, and completion information
• care or safety indicators, where provided by a Purchaser and necessary to support appropriate trainer matching and safe delivery. This information is limited to what is necessary for safe training delivery
• device delivery information, including delivery address where a device is being loaned in connection with training, collected with the learner’s consent

2.2 Trainer information

To manage trainer engagement and service delivery, Step By Step collects personal information about trainers, including:

• name and contact details
• qualifications, accreditations, and professional experience
• police vetting information where required for network eligibility
• training activity and session reporting information
• health and safety declaration completion status
• payment information for the purpose of trainer settlement

2.3 Purchaser information

To manage the referral and funding relationship, Step By Step holds contact details for Purchaser representatives.

2.4 Other information

Step By Step also holds scheduling and communication records, health and safety incident and hazard reports, complaint records, and NZQA assessment and moderation records.

3. How we use this information

Step By Step uses personal information to:

• deliver and support training services to learners
• assess learner training needs and track programme progress
• match learners with appropriate trainers, considering location, availability, and any care or safety indicators
• communicate with learners, trainers, and Purchasers about training
• facilitate device delivery where applicable
• settle trainer payments and manage service delivery
• meet NZQA attestation and reporting obligations
• meet contractual and reporting obligations to Purchasers
• manage health and safety, including incident investigation and reporting to WorkSafe New Zealand where required
• improve our services and systems

4. Training data: ownership and licence

Trainer assessment activity data and learner assessment outcome data are owned by the trainer and learner respectively. Step By Step holds a limited licence to use that data for two purposes only:

• NZQA attestation – submitting assessment results to NZQA for credit reporting purposes, as required under Step By Step’s obligations as a registered training establishment
• Funder reporting – providing verified outcomes data to funding bodies such as ACC as required under the applicable funding contract

Step By Step will not share trainer or learner assessment data for any other purpose without the express prior consent of the trainer or learner to whom the data relates.

5. Who we share information with

Recipient	Purpose	Basis
Independent contractor trainers	Information necessary for safe and effective training delivery, including learner name, contact details, relevant care or safety indicators, and device delivery address where applicable.	Necessary for training delivery; consent for device delivery address.
Purchasers	Progress reports, session summaries, and outcome data required under the applicable funding contract.	Contractual obligation; limited to what the contract requires.
NZQA	Assessment results and moderation data for credit reporting.	NZQA attestation obligations under limited licence.
WorkSafe New Zealand	Notifiable event reports where required.	Legal obligation under the Health and Safety at Work Act 2015.
Other service providers	Secure systems used to manage training and coordination. All providers are contractually bound to handle data only as directed by Step By Step.	Operational necessity; data processing agreements in place.

Step By Step only shares information when necessary to deliver services or meet legal or contractual obligations. Step By Step does not sell personal information to third parties.

6. Storage and security

Step By Step takes reasonable steps to protect personal information from loss, misuse, unauthorised access, modification, or disclosure. Our measures include:

• use of secure digital systems for CRM, reporting, and communications
• controlled access to learner information, with trainers receiving only the information relevant to their specific training engagements
• organisational processes for handling, storing, and disposing of data appropriately
• device security: Step By Step-issued or loaned training devices are wiped, reinstalled, and reset between users to ensure no personal information is retained from one learner to the next

7. Trainer responsibilities for personal information

Independent contractor trainers who receive personal information about learners must:

• handle that information in a confidential and secure manner
• use it only for the purpose of delivering the approved training engagement
• not retain learner information beyond what is needed for the active engagement
• take reasonable steps to protect any information accessed or stored on personal devices
• report any privacy breach or concern to Step By Step promptly

8. Retention

Step By Step retains personal information for as long as necessary to fulfil the purposes described in this policy and to meet legal and regulatory obligations. In general, training records are retained for at least 7 years following completion of a programme to meet NZQA and funder audit requirements. When personal information is no longer required, Step By Step will securely delete or destroy it.

9. Your rights: access and correction

Under the Privacy Act 2020 (NZ), individuals have the right to request access to personal information Step By Step holds about them, and to request correction of any inaccurate or misleading personal information.

Requests can be made by contacting Step By Step at privacy@stepbystep.co.nz. Step By Step will respond within the timeframe required by the Privacy Act 2020.

10. Complaints about privacy

If you have concerns about how your personal information is handled by Step By Step, please contact us through our Complaints process. If you are not satisfied with Step By Step’s response, you may contact the Office of the Privacy Commissioner at privacy.org.nz.

11. Updates to this policy

Step By Step may update this Privacy Policy from time to time. Where a material change is made, we will notify affected parties with reasonable advance notice. The current version of this policy is always accessible on this website.

12. Contact

Step By Step Training Limited
admin@stepbystep.co.nz