Part A: Privacy Policy

1. Who we are

Origin Talent Limited (“Origin”, “we”, “our”, “us”) is committed to protecting the privacy of individuals whose personal information we collect during the recruitment process. This Privacy Policy outlines how we collect, use, disclose, and protect your personal information in accordance with the Privacy Act 2020 of New Zealand.

2. Who this policy applies to

This policy applies to personal information we hold about candidates, prospective candidates, referees, client contacts, and anyone else who interacts with us in connection with our recruitment services or our website.

3. What we collect

The personal information we collect depends on our relationship with you, but may include:

• Contact details: your name, email address, phone number and location.
• Career information: your CV, employment history, qualifications, professional memberships, remuneration and career preferences.
• Information from the recruitment process, such as interview notes, assessment and psychometric results, and reference feedback.
• Verification information, where relevant to a role and with your authorisation. This can include criminal record, credit, qualification, directorship and right-to-work checks.
• Client contact information: business contact details, role requirements and information relevant to our engagement.
• Technical information collected through our website, such as analytics data.

Some roles call for information of a more sensitive nature, such as health information relevant to the position. We collect this directly from you with your authorisation and only use it for the purpose it was provided.

4. How we collect it

We collect most personal information directly from you, through conversations, meetings, applications and the documents you give us. In line with normal recruitment practice we also collect information about you from other sources, including:

• Referees you nominate, where authorised by you.
• Publicly available professional sources such as LinkedIn, Seek, company websites, annual reports, professional registers and media.
• Verification and background checking providers, where checks are undertaken with your authorisation. These include the Ministry of Justice for criminal record checks, Immigration New Zealand for right-to-work verification, and universities and other qualification bodies.
• Our clients, where they refer or introduce you to us in connection with a role.
• Our professional networks, research and market mapping.

Where we collect personal information about you indirectly, we take reasonable steps to ensure you are aware that we have collected it, where it came from, why we collected it, and your right to access and correct it. In many cases this notification is provided through this policy; where required, we will also tell you directly.

5. Why we collect and use it

We collect and use personal information to:

• Assess your suitability for current and future opportunities and represent you to prospective employers.
• Match candidates to our clients’ roles and manage recruitment processes end to end.
• Conduct reference and background checks where relevant and authorised.
• Maintain our candidate and client relationships over time, including keeping in touch about opportunities and market developments.
• Prepare market intelligence and research for our clients, in a form that does not identify individuals without their knowledge.
• Operate, improve, and secure our business and systems.
• Meet our legal and regulatory obligations.

6. AI-assisted tools

We use AI-assisted tools as part of our recruitment processes to help us work more efficiently and deliver a better experience for candidates and clients. These tools may assist with tasks such as recording and transcribing meetings, summarising candidate information, preparing notes and documents, and supporting research.

Where your personal information is processed using these tools, we take reasonable steps to ensure this is done consistently with the Privacy Act 2020. This includes:

• Using established AI platforms on commercial terms with appropriate security and privacy controls.
• Ensuring your data is not used to train AI models.
• Restricting access to authorised Origin personnel only.
• Where generative AI is used for research, restricting prompts to publicly available sources and verifying information against its source before we rely on it.
• Ensuring all recruitment decisions are made by our consultants. AI tools support our processes; they do not make decisions about candidates.

We regularly review our use of AI-assisted tools to ensure they remain appropriate, secure, and consistent with this policy.

7. Who we share it with

We share personal information only where necessary for our recruitment services and in ways you would reasonably expect. This may include:

• Clients: we present candidate information to clients in connection with specific opportunities, and only with your knowledge.
• Referees and background checking providers, where checks are undertaken.
• Service providers who support our business, such as our recruitment database, cloud storage and communications providers, under appropriate confidentiality and security arrangements.
• Regulators, law enforcement, or other parties where required or permitted by law.

We do not sell personal information.

8. Our related brands

Origin Talent is part of a group of specialist recruitment brands that also includes Infinitas Talent and Luminous Talent. Where an opportunity held by one of our related brands may suit your experience and career interests, we may share your information with that brand so they can talk to you about it.

We only share information within the group where it is relevant to you, and the same privacy, confidentiality and security standards set out in this policy apply across all of our brands. If you would prefer that we did not share your information in this way, tell us and we will note it on your record.

9. Where information is stored

We use reputable cloud-based systems to store and manage personal information. Some of our providers store information on servers located outside New Zealand, primarily in Australia and the United States. Where personal information is held overseas, we take reasonable steps to ensure it is subject to safeguards comparable to those required by the Privacy Act 2020, including through our contractual arrangements with providers.

10. How long we keep it

We retain personal information for as long as needed for the purposes described in this policy. Recruitment relationships are often long term. An opportunity may come up months or years after we first meet, so we keep candidate information on our database.

You can request deletion of your information at any time, and we will action this unless we are required to retain it by law.

11. How we protect it

We take reasonable security safeguards to protect personal information against loss, unauthorised access, use, modification, or disclosure. These include access controls and authentication across our systems, encryption of data in transit and at rest through our providers, and confidentiality obligations for everyone who works with us. Further detail is set out in Part B of this document.

12. Scams and impersonation

Recruitment firms are sometimes impersonated in phishing and job scams. We will never ask you for payment, bank login details or remote access to your devices. If you are contacted by someone claiming to be from Origin and something feels off, contact us directly using the details below before responding.

13. Your rights

Under the Privacy Act 2020, you have the right to request access to the personal information we hold about you and to request correction of that information. You may also withdraw an authorisation you have given us, or ask us to delete your information, at any time.

To exercise any of these rights, contact us using the details below. We will respond within 20 working days, as required by the Privacy Act. If your request is refused for a reason permitted by law, we will tell you why in writing and explain your options.

If you have a concern or complaint about how we have handled your personal information, contact our Privacy Officer using the details below. We will investigate and respond within 20 working days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

14. Contact us

Origin Talent Limited

Ground Floor, Princes Court, 2 Princes Street, Auckland CBD 1010

09 302 0647

begin@origintalent.co.nz

origintalent.co.nz

Part B: Information Security Overview

This overview summarises the practical measures we apply to protect the personal and confidential information entrusted to us by clients and candidates.

1. Systems and infrastructure

Our candidate and client information is managed through established, cloud-based recruitment and business systems provided by reputable vendors that maintain independent security certifications and controls. We do not store candidate or client records on local servers.

2. Access control

Access to our systems is limited to Origin personnel and protected by individual user accounts and multi-factor authentication. Access to candidate and client information is on a need-to-know basis, and access is removed promptly when personnel leave the business.

3. Data in transit and at rest

Information held in our core systems is encrypted in transit and at rest by our providers. Candidate documents are shared with clients through secure channels rather than uncontrolled distribution.

4. Confidentiality

All Origin personnel are bound by confidentiality obligations covering client and candidate information. Client-specific information, including recruitment strategy, remuneration details, and organisational context, is treated as confidential and is not shared outside the engagement.

5. AI and technology governance

Where AI-assisted tools are used in our work, we select providers on commercial terms under which our data is not used to train their models, and the same confidentiality and security standards apply as to any other information we hold. A consultant reviews all output; no decisions about candidates are made by automated means.

6. Incident response

In the event of a privacy breach likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020, and take prompt steps to contain and remediate the breach.

7. Review

We review our privacy and security practices periodically and update this policy as our business and legal obligations evolve.