Kāhui Anamata Limited ("we", "us", "our") operates this website (anamatakahui.co.nz) and the four operational branches: Anamata Records, Research & Language, Creative Arts, and Technology & Development. This notice explains how we collect, hold, use, and disclose personal information when you interact with us.
We are committed to complying with the Privacy Act 2020 and the Information Privacy Principles (IPPs) it sets out. We also honour the principles of Te Mana Raraunga Māori Data Sovereignty as adopted by the Kāhui.
Depending on how you interact with us, we may collect:
| Source | Information collected |
|---|---|
Contact form (/contact) | Your name, email, message contents |
Account signup (/register) | Email, password (hashed), name, optional iwi affiliation, optional te reo proficiency |
| Authentication session | Encrypted JWT cookies (Supabase Auth), IP address |
Public opt-in directory (/artist) | Your name, role, iwi affiliation (when you opt in), bio |
| Research papers | Author names, affiliations, optional profile linkage, DOI metadata |
| Scholarship portfolio | Publicly listed recipient names, host institutions, project titles (only for awards you choose to disclose) |
| iwi gates & cultural metadata | Iwi names, kaitiaki contact info (with explicit consent from each iwi) |
| Cookies (locale, auth) | See Cookie policy |
Personal information is stored in Supabase (database hosted on AWS ap-southeast-2 in Sydney, with backup regions configurable). Authentication credentials are hashed with bcrypt; session tokens are encrypted JWTs held in HTTP-only cookies. Cultural metadata is held in a separate schema with row-level security scoped to kaitiaki-role users.
We do not use third-party analytics, ad networks, or tracking pixels. The platform ships with zero third-party cookies by default.
We do not sell personal information.
We may share information with:
You have the right to:
Exercise these rights via /privacy-controls (data export + withdrawal request form), or email privacy@anamatakahui.co.nz. We respond within 20 working days as required by the Privacy Act.
If you're not satisfied with our response, complain to the Office of the Privacy Commissioner.
Kāhui Anamata is a Māori-led collective. We collect information about kaumātua, whānau, hapū, and iwi only with appropriate kaitiakitanga and tikanga. Cultural information shared with us in confidence is handled in line with tikanga and with cultural advisor guidance where appropriate.
See /kaitiakitanga for the full Te Mana Raraunga CARE-aligned framework we operate under, including right of withdrawal, iwi consent lineage, and append-only consent log.
See our Cookie policy for what we set, why, and how to control it.
Supabase is hosted on AWS Sydney (ap-southeast-2). Vercel edge functions may process requests through the nearest region. By using the platform you consent to this processing. We do not transfer personal data to any other overseas recipients.
The platform is not directed at children under 13. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact privacy@anamatakahui.co.nz and we'll delete it within 30 days.
We may update this notice from time to time. The "effective date" at the top shows the latest revision. Material changes will be announced on the platform home page and announced via the data governance changelog (where applicable).
Privacy queries: privacy@anamatakahui.co.nz
Postal address: Kāhui Anamata Limited, [registered address], Aotearoa New Zealand.
This notice was drafted on 2026-07-22 based on the Anamata-Records template at /opt/data/anamata/legal/templates/privacy-notice.md and adapted for the Kāhui platform. Final wording should be reviewed by a qualified NZ lawyer before being relied upon as the operative privacy notice under the Privacy Act 2020.