We collect personal information so we can deliver services like executive coaching, team development, leadership programmes, strategy facilitation, relationship optimisation, 360 surveys and psychometric assessments.

We collect and use your information with your consent, or where required to deliver services you’ve agreed to.

Depending on the service, this may include:

• Your name, role and contact details
• Information about your organisation or team
• Your responses to surveys, assessments or questionnaires
• Notes from coaching sessions or workshops
• Feedback or evaluation data.

We only collect what we need to deliver our services effectively, and we’ll always explain the purpose at the time.

Most of the time, we collect personal information directly from you – for example, when you:

• Complete a survey, questionnaire or assessment
• Take part in coaching, feedback interviews or group sessions
• Chat with us through our website.

Sometimes we get information from others, such as:

• The organisation that referred you (e.g. your employer or prospective employer)
• Your colleagues (e.g. 360 surveys)
• Your manager (e.g. to define the outcomes we’re working to)
• Referees (e.g. for recruitment purposes)
• Assessment platforms we use to deliver psychometric tools.

We’re upfront about what we’re collecting and why, and we’ll ask before using your information for any other purpose.

We retain health records securely for a minimum of 10 years, in line with the Health (Retention of Health Information) Regulations 1996. As the data controller, Winning Performance remains responsible for the security and privacy of all records, including those stored in the cloud (e.g. via Dropbox). Risk management measures include version control, password protection, and limiting access strictly to authorised users.

We store all personal information securely using Dropbox for Business, which includes:

• Two-factor authentication (2FA) to prevent unauthorised access
• Version history and file recovery, so changes or deletions can be tracked or reversed
• Access restrictions, meaning only Shanel Winning can view your personal file(s)
• Audit logs, providing transparency into file access and edits.

Dropbox is used in a way that aligns with the New Zealand Privacy Act, the Psychologists Board’s privacy guidelines, and international health data standards (e.g. HIPAA) where applicable.

Notes taken on tablets are synced to Dropbox for Business, ensuring they are protected by the same encryption, version control, and access restrictions as all other client files.

We also use trusted third-party systems to support scheduling, communication, and document management. This includes:

• Acuity Scheduling – used for booking appointments and, in some cases, collecting personal information via consent forms (e.g. your name) and intake forms (e.g. related to requests for recruitment psychometrics). Information entered into Acuity is stored securely on their platform and only accessed by Winning Performance for the purpose it was collected. You can see their privacy policy here: https://help.acuityscheduling.com/hc/en-us/articles/16726357347981-Data-privacy-and-Acuity-Scheduling.
• Google Workspace – used for email and video communication and sharing documents (e.g. calendar invites, reports, or summaries). Sensitive client information is only sent in line with our privacy obligations.
• Microsoft Office – used for preparing documents (connected to Dropbox for Business).

We use only secure, well-established platforms with appropriate access controls, and we take care to ensure that data collected through these systems is used and stored in line with this privacy policy.

We do not store client data on personal devices.

We sometimes use professional printing services to produce workbooks for strategy sessions, leadership programmes, or team workshops. These may include names, organisational context, or activity content. We work with reputable providers, share only what’s needed, and ask that materials are handled confidentially. Printed workbooks are securely stored when not in use and disposed of responsibly.

Physical files are stored securely at our office, which remains locked when unattended. Older records may be boxed and archived in a private storage area (e.g. attic) that is not readily accessible to others. Files are retained in line with our legal and ethical obligations and securely destroyed when no longer required.

Our website uses Tawk.to live chat to make it easy for you to reach us.

Here’s what you should know:

• Tawk.to automatically collects IP addresses of site visitors to provide chat support.
• No personally identifying information is stored unless you actively start a chat or enter your details (e.g. name or email).
• Any details you provide are stored securely on Tawk.to’s systems. You can view their privacy policy here: https://www.tawk.to/privacy-policy/.

We do not currently use Google Analytics or other third-party tracking tools.

We use the following secure platforms to deliver psychometric assessments, 360s and surveys:

• Hogan Assessments: https://www.hoganassessments.com/privacy-policy/
• Pearson: https://www.pearson.com/en-us/privacy-center/privacy-notices.html
• Profiling for Success: https://profilingforsuccess.com/privacy.php
• Appraisal 360: https://www.appraisal360.co.uk/pages/privacy-and-cookies-policy/
• SurveyMonkey: https://www.surveymonkey.com/mp/legal/privacy/

Each third-party assessment platform maintains its own security and privacy policies. Winning Performance selects tools that are secure, purpose-fit, and compliant with the New Zealand Privacy Act and Psychologists Board guidelines. We only use them in ways that align with informed consent and our privacy commitments.

In some cases, assessments may be set up or administered by a trained assessment coordinator working under the supervision of Shanel Winning. To carry out their role, these coordinators may temporarily access limited personal information – such as your name, email address, job title and assessment status or results – for operational purposes like setting up access, checking completion, or compiling results. They only access information needed to complete the task and are bound by strict confidentiality at all times.

We do not collect or store your passwords for these sites, and we only receive assessment results necessary to support the service you’ve agreed to.

To protect your privacy, we verify your identity before releasing any personal information to you or anyone else. While we aim to be transparent, we may be legally permitted to withhold certain types of information, such as evaluative material used in recruitment. We will explain the reason for any such refusal and your rights to challenge it.

We may also discuss non-identifying information (e.g. themes or anonymised examples) with a supervisor as part of our ethical responsibilities and continuing professional development. This never includes names or identifying details unless you have given permission.

We only share your personal information:

• With people you’ve given us permission to share it with
• When it’s necessary to deliver the service you’ve asked for
• Or when we’re legally required to, or if there is a serious risk to you or someone else’s safety.

Assessment results and reports are intended to support development and recruitment decisions. They are provided with the understanding that they will be used professionally, ethically, and within the scope of informed consent. They should be interpreted in consultation with the psychologist who prepared them and considered alongside other relevant information. They are not intended to be used as the sole basis for decisions such as hiring, promotion, or role suitability. Reports are considered valid for 12-18 months from the date of assessment, after which they should be reviewed or reassessed before further use.

Notes may be taken during coaching sessions, feedback conversations, development planning meetings, or review discussions to help track key themes and outcomes. In most cases, a summary or report is provided to the client organisation. Coaching notes are confidential and securely stored, and are not shared unless legally required or to prevent serious harm.

We may also contact you from time to time after we’ve worked together – either to check in, invite feedback on the impact of our services, or to see if we can be of further assistance. These are occasional, personalised check-ins (not mass mailings), and you’re always welcome to opt out at any time.

We keep personal information only as long as needed to:

• Deliver the service you’ve engaged us for
• Meet ethical obligations (e.g. file retention for psychologists)
• Comply with legal requirements.

After that, information is securely deleted or archived.

Where client organisations receive assessment reports, they are asked to store them securely, use them appropriately, and either return or securely dispose of them when no longer needed. We also outline these expectations in our Client Terms, which are shared as part of the engagement process.

As a sole practitioner, Winning Performance (led by Shanel Winning) has arrangements in place to ensure the secure storage and appropriate transfer of client records to another registered psychologist in the event of serious illness, incapacity, or death.

You can ask to:

• See the personal information we hold about you
• Correct any errors
• Request deletion – although in most cases, psychologists are legally required to retain health records for at least 10 years from the date of last contact.

We will respond to access or correction requests within 20 working days and verify your identity before releasing any information. In some cases (e.g. recruitment reports), we may be allowed to withhold evaluative material – if so, we’ll explain why.

We may use non-identifying information (e.g. themes or statistics) to:

• Evaluate the impact of our services
• Improve our tools or programmes
• Provide insights to clients about group patterns.

We never share names, quotes or identifying details without permission.

We occasionally mention client organisations we’ve worked with in proposals, case studies, on our website or social media. This is always with prior permission. If you’d prefer we don’t mention your organisation, just let us know.

We may update this Privacy Statement from time to time to reflect changes in legal requirements, the platforms we use, or the services we provide. The most current version will always be available on our website. If the changes are significant and affect your rights, we’ll notify you directly where possible.

We’re committed to treating your information with care and respect.

If you have questions about your privacy or how your data is managed, please feel free to contact me.

You can also contact the Office of the Privacy Commissioner at https://www.privacy.org.nz for more information or to lodge a complaint.

Ngā manaakitanga, Shanel

Shanel Winning
Founder and Director
Registered Psychologist and Executive Coach

www.winningperformance.co.nz