Privacy statement

Privacy Statement

www.degreeapprenticeships.nz Version 1.0 — Effective date: 2026-04-21

1. Introduction

This Privacy Statement explains how Mischewski Consulting collects, uses, stores, and protects the personal information you provide when using the Degree Apprenticeships NZ website and self-assessment tool at www.degreeapprenticeships.nz (the Site).

We are committed to handling your information in accordance with the Privacy Act 2020 (New Zealand). Please read this statement carefully before submitting any information through the Site. By using the self-assessment tool and providing your consent where requested, you acknowledge that you have read and understood this statement.

This statement covers:

the self-assessment wizard and the report it generates;
static resource pages and PDF downloads; and
any other interaction you have with the Site.

It does not cover third-party websites that may be linked from the Site.

2. Who We Are

The Site is operated by:

Mischewski Consulting Operator: Brenden Mischewski NZBN 9429031165013 Email: brenden@mischewski.co.nz

Mischewski Consulting is the data controller for any personal information collected through the Site. References to "we", "us", or "our" in this statement mean Mischewski Consulting.

3. What We Collect

3.1 Information You Provide

When you complete the 13-screen self-assessment wizard, you may provide the following information:

Institution and programme details — the name of your tertiary institution and the programme you are assessing.
Contact person details — a contact person's name and role within your organisation.
Contact email address — this is optional. If provided, it is stored alongside your submission.
Programme context — descriptive information about your programme's design and delivery.
Learner counts — approximate numbers of learners enrolled in or contemplating the programme.
Employer partner information — details about workplace partners involved in your programme. This field is optional and can be completed using anonymised descriptions if you prefer not to name specific employers.
Workplace evidence percentages — self-assessed data about the proportion of learning that takes place in the workplace.
Scoring responses — your answers to the assessment questions across the wizard's domains.
Free-text reflections — your own narrative commentary on strengths, gaps, and next steps.

You also make consent choices during the wizard:

Required consent — you must confirm that you understand the tool is a self-assessment aid, not an accreditation decision or formal certification, before your responses are stored.
Required consent for storage — you must consent to your responses being stored in order for a report to be generated.
Optional consent for anonymised analysis — you may optionally consent to your anonymised responses being used in aggregate analysis to improve the tool. Selecting "no" does not affect your ability to generate a report.

3.2 Information We Collect Automatically

The Site currently collects minimal technical data. We may in future add Plausible Analytics, a privacy-preserving, cookieless analytics service. If we do, we will update this statement to reflect that. Plausible does not collect personal data, does not use cookies, and does not send data to advertising networks.

We do not currently use Google Analytics or any other behavioural analytics platform.

Standard web server logs (IP address, browser type, pages requested, timestamps) may be retained by our hosting provider, Vercel, in the ordinary course of hosting services. These logs are not linked to your assessment submission.

3.3 Information We Do NOT Collect

We do not send any data you enter to any artificial intelligence (AI) or large language model (LLM) API. All scoring, recommendations, narrative text, and milestone plans are generated by deterministic TypeScript code running on our servers. No third-party AI service receives your data.
We do not collect payment information (there is no charge to use the tool).
We do not collect information about learners as individuals. The tool asks about programme-level data and learner counts only.
We do not use tracking cookies or fingerprinting technologies.

4. Why We Collect Your Information

We collect and use your information for the following purposes:

To generate your readiness report. Your responses are processed to calculate domain scores, generate narrative commentary, and produce a milestone plan. The report is made available at a unique tokenised URL that only you hold.
To allow you to retrieve and delete your report. We store a report access token and a separate delete token associated with your submission so that you can return to view your report or request its deletion.
To improve the tool (only if you have given optional consent). Where you have opted in, your anonymised responses may be included in aggregate analysis to understand how the tool is being used and to improve its scoring logic and recommendations.

We do not use your information for marketing, advertising, profiling, or any purpose not described above.

5. Legal Basis for Processing

New Zealand's Privacy Act 2020 governs how we handle personal information. Our collection and use of your information is based on your consent, which you give explicitly at two points in the wizard:

consent to have your data stored and a report generated; and
(optionally) consent to anonymised analysis.

Where you have given consent, you may withdraw it at any time by requesting deletion of your submission (see Section 9 below). Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

6. How Long We Keep Your Information

We retain submitted assessment data, including the generated report, for a default period of 24 months from the date of submission. At the end of this period, submissions are purged from the database.

You may request deletion of your submission at any time before that period expires by using the delete token provided on your report page, or by contacting us at brenden@mischewski.co.nz.

Aggregated, anonymised data derived from submissions where you gave optional consent may be retained indefinitely, as it cannot be used to identify you.

7. Who We Share Your Information With

We do not sell, rent, or trade your personal information to any third party.

We share your information only with the following service providers who act as data processors on our behalf:

Supabase — our database provider. Your submission data is stored in Supabase's managed PostgreSQL service. Supabase processes data only on our instructions and is subject to its own privacy and security standards.
Vercel — our hosting provider. Vercel serves the Site and handles web requests. Vercel may retain standard server logs as described in Section 3.2.

We do not share your information with any marketing platforms, advertising networks, data brokers, or government agencies except where required by law.

8. Where Your Data Is Stored

Your submission data is stored in a Supabase Postgres database. At the time this statement was written, the most likely storage region is Singapore. Supabase may make the Sydney (Australia) region available as an alternative, and we may move to that region without further notice — both Singapore and Sydney are reputable cloud infrastructure locations operated to high security standards.

Storing data outside New Zealand engages the overseas disclosure provisions of the Privacy Act 2020 (Information Privacy Principle 12). We are satisfied that Supabase provides comparable privacy protections to those available in New Zealand, and we take reasonable steps to ensure your information is protected when stored overseas.

9. Cookies and Analytics

The Site does not currently use cookies for tracking or analytics. If we add Plausible Analytics in future, it will operate without cookies and without collecting personal data — we will update this statement before enabling any analytics service. We do not use Google Analytics, Facebook Pixel, or any other third-party tracking script.

10. Your Rights Under the Privacy Act 2020

The Privacy Act 2020 gives you the following rights in relation to your personal information:

Right of access — You may request a copy of the personal information we hold about you. To do this, email brenden@mischewski.co.nz with your submission's public ID (shown on your report page) or your contact email address if you provided one.

Right of correction — If you believe information we hold about you is inaccurate, you may request that we correct it. Contact brenden@mischewski.co.nz with details of the correction sought.

Right to deletion — You may request deletion of your submission at any time by:

using the delete token link on your report page; or
emailing brenden@mischewski.co.nz and quoting your submission's public ID.

We will process deletion requests within a reasonable time (generally within 10 working days).

We will respond to any privacy rights request within 20 working days as required by the Privacy Act 2020.

11. Security

We take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure. Our security measures include:

TLS encryption — all data in transit between your browser and the Site is encrypted using TLS.
Row-level security — Supabase row-level security (RLS) policies restrict database access so that only authorised queries can read or write your data.
Tokenised report links — your report is not publicly listed or indexed. It is accessible only via a URL that includes a unique public_id and access_token generated at the time of your submission. The delete token is a separate, distinct credential.
No client-side secrets — service role credentials for the database are never exposed to the browser or included in client-side code.
Authenticated administration — any administrative access to the database requires authentication.

No security measure is completely infallible. If you become aware of a security concern relating to the Site, please notify us at brenden@mischewski.co.nz.

12. Children

The Site and self-assessment tool are designed for tertiary providers and adult learners. They are not intended for use by anyone under the age of 16. We do not knowingly collect personal information from individuals under 16. If you believe a person under 16 has submitted information through the Site, please contact us so we can delete it.

13. Independent Status

The Site and tool are independent products operated by Mischewski Consulting, not affiliated with NZQA, TEC, or MoE. Nothing on the Site constitutes an accreditation decision, a funding decision, or a formal readiness certification.

14. Changes to This Statement

We may update this Privacy Statement to reflect changes to our practices, the law, or our services. When we do, we will update the version number and effective date at the top of this page. Continued use of the Site after a change is published constitutes acceptance of the updated statement.

15. Contact and Complaints

For any questions, requests, or concerns about this Privacy Statement or our data handling, please contact:

Brenden Mischewski Mischewski Consulting Email: brenden@mischewski.co.nz

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner:

Website: https://www.privacy.org.nz
Phone: 0800 803 909

Version 1.0 — Effective date: 2026-04-21 Mischewski Consulting — www.degreeapprenticeships.nz

← Return to home