Privacy statement

Privacy Statement

www.degreeapprenticeships.nz Version 1.3.1 — Effective date: 6 August 2026

1. Introduction

This Privacy Statement explains how Mischewski Consulting collects, uses, stores, and protects the personal information you provide when using the Degree Apprenticeships NZ website and self-assessment tool at www.degreeapprenticeships.nz (the Site).

We are committed to handling your information in accordance with the Privacy Act 2020 (New Zealand). Please read this statement carefully before submitting any information through the Site. By using the self-assessment tool and providing your consent where requested, you acknowledge that you have read and understood this statement.

This statement covers:

the self-assessment wizard and the report it generates;
static resource pages and PDF downloads; and
any other interaction you have with the Site.

It does not cover third-party websites that may be linked from the Site.

2. Who We Are

The Site is operated by:

Mischewski Consulting Operator: Brenden Mischewski NZBN 9429031165013 Email: brenden@mischewski.co.nz

Mischewski Consulting is the data controller for any personal information collected through the Site. References to "we", "us", or "our" in this statement mean Mischewski Consulting.

3. What We Collect

3.1 Information You Provide

When you complete the 12-screen self-assessment wizard, you may provide the following information:

Institution and programme details — the name of your tertiary institution and the programme you are assessing.
Contact person details — a contact person's name and role within your organisation.
Contact email address — this is optional. If provided, it is stored alongside your submission.
Programme context — descriptive information about your programme's design and delivery.
Learner counts — approximate numbers of learners enrolled in or contemplating the programme.
Employer partner information — details about workplace partners involved in your programme. This field is optional and can be completed using anonymised descriptions if you prefer not to name specific employers.
Workplace evidence percentages — self-assessed data about the proportion of learning that takes place in the workplace.
Scoring responses — your answers to the assessment questions across the wizard's domains.
Free-text reflections — your own narrative commentary on strengths, gaps, and next steps.

You also make consent choices during the wizard. All three consents are required to use the tool:

Consent to the assessment framing — you must confirm that you understand the tool is a self-assessment aid, not an accreditation decision or formal certification.
Consent to storage — you must consent to your responses being stored in order for a report to be generated.
Consent to research use — you must consent to your de-identified responses being used for sector research, publications, and evaluation of the tool itself (see Section 4.3 for what this means in practice, and Section 4.4 for our de-identification commitment).

If you do not wish to agree to any one of these, please do not submit the wizard. You can still read the rest of the Site, including the Providers Guide and other resources, without providing any information.

3.2 Information We Collect Automatically

The Site uses Umami Analytics, a privacy-focused, cookieless analytics service, to understand aggregate use of the Site. Umami records information such as pages viewed, referral source, browser and device category, approximate country, and selected interactions with Site features. Umami does not use tracking cookies or track visitors across websites.

We do not send names, email addresses, institution or programme details, assessment answers, free-text responses, report identifiers, access tokens, or deletion tokens to Umami. Tokenised report and deletion pages are excluded from analytics collection. We do not use Google Analytics or advertising analytics platforms.

Standard web server logs (IP address, browser type, pages requested, timestamps) may be retained by our hosting provider, Vercel, in the ordinary course of hosting services. These logs are not linked to your assessment submission.

3.3 Information We Do NOT Collect

We do not send any data you enter to any artificial intelligence (AI) or large language model (LLM) API. All scoring, recommendations, narrative text, and milestone plans are generated by deterministic TypeScript code running on our servers. No third-party AI service receives your data.
We do not collect payment information (there is no charge to use the tool).
We do not collect information about learners as individuals. The tool asks about programme-level data and learner counts only.
We do not use tracking cookies or fingerprinting technologies.

4. Why We Collect Your Information

We collect and use your information for the following purposes.

4.1 To generate your readiness report

Your responses are processed to calculate domain scores, generate narrative commentary, and produce a milestone plan. The report is made available at a unique tokenised URL that only you hold.

4.2 To allow you to retrieve and delete your report

We store a report access token and a separate delete token associated with your submission so that you can return to view your report or request its deletion.

4.3 For research and tool evaluation

Because degree apprenticeships are a new pathway in New Zealand, we use submission data — in de-identified form — for sector research, publications, and evaluation of this tool. In practice, this means:

Sector research — analysis of readiness patterns across the tertiary sector (for example, which domains are most commonly rated as constraints, how programmes at different qualification levels compare, how confidence in workplace evidence varies across institutions). Findings may be shared in reports, articles, presentations, or peer-reviewed publications intended to help the sector.
Tool evaluation — analysis of how the tool is being used, whether its scoring and recommendations are accurate and useful, and what should change in future versions.

Use of your information for research is a condition of using the tool, not an optional choice. If you do not want your de-identified responses used for research, please do not submit the wizard.

4.4 De-identification commitment

Before any submission data is used for research or shared beyond report generation, we remove or aggregate any information that could reasonably identify you, your institution, or a specific programme. This includes:

Names — the institution name, programme name, contact person's name, and any names entered in free-text fields.
Email addresses — the contact email if you provided one.
Employer partners — named employer partners are aggregated to sector or size categories.
Free-text reflections — quoted only where the quote itself does not reveal the source (for example, generic statements about workplace evidence practices), or paraphrased.
Any other detail that, alone or in combination with other information, would allow a reader to identify a specific institution or person.

We will not publish, share, or present research findings in a form that identifies a specific institution or individual without that party's prior written consent. Aggregate statistics (for example, "across 47 submissions, the median score for the funding and sustainability domain was 1.4") are considered de-identified for this purpose.

4.5 What we do not do

We do not use your information for marketing, advertising, profiling, or any purpose not described above.

5. Legal Basis for Processing

New Zealand's Privacy Act 2020 governs how we handle personal information. Our collection and use of your information is based on your consent, which you give explicitly at three points in the wizard:

consent to the assessment framing (that the tool is a planning aid, not an accreditation decision);
consent to have your data stored and a report generated; and
consent to de-identified research use.

All three consents are required to submit the wizard. You may withdraw your consent to storage at any time by requesting deletion of your submission (see Section 10). Once your submission has been deleted, its underlying data will no longer be included in any new research analysis. Analysis and outputs that were already produced from de-identified aggregate data before deletion cannot be recalled, because the aggregate no longer contains identifiable information about you. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

6. How Long We Keep Your Information

We retain identifiable submission data — including the generated report, the institution name, programme name, contact details, and full free-text responses — for a default period of 24 months from the date of submission. A scheduled purge job runs each day and deletes any submissions that have passed this 24-month cutoff.

You may request deletion of your submission at any time before that period expires by using the delete token provided on your report page, or by contacting us at brenden@mischewski.co.nz.

De-identified data derived from submissions (as described in Section 4.4) may be retained indefinitely, because it can no longer be used to identify you or your institution.

7. Who We Share Your Information With

We do not sell, rent, or trade your personal information to any third party.

We share your information only with the following service providers who act as data processors on our behalf:

Supabase — our database provider. Your submission data is stored in Supabase's managed PostgreSQL service. Supabase processes data only on our instructions and is subject to its own privacy and security standards.
Vercel — our hosting provider. Vercel serves the Site and handles web requests. Vercel may retain standard server logs as described in Section 3.2.
Umami — our cookieless analytics provider. Umami processes limited technical usage data to provide aggregate Site statistics. Umami Cloud operates infrastructure in the United States and European Union.

We do not share your information with any marketing platforms, advertising networks, data brokers, or government agencies except where required by law.

8. Where Your Data Is Stored

Your submission data is stored in a Supabase Postgres database hosted in the AWS Asia Pacific (Seoul) region in the Republic of Korea. Supabase operates the database on our behalf.

Storing data outside New Zealand engages the overseas disclosure provisions of the Privacy Act 2020 (Information Privacy Principle 12). We are satisfied that Supabase provides comparable privacy protections to those available in New Zealand, and we take reasonable steps to ensure your information is protected when stored overseas. If we move to a different storage region in the future, we will update this statement.

9. Cookies and Analytics

The Site uses Umami Analytics to collect aggregate usage statistics without tracking cookies. The analytics configuration excludes URL query strings and tokenised report and deletion pages. We do not send information entered into the self-assessment tool to Umami, and we do not use Google Analytics, Facebook Pixel, advertising pixels, or cross-site tracking technologies.

10. Your Rights Under the Privacy Act 2020

The Privacy Act 2020 gives you the following rights in relation to your personal information:

Right of access — You may request a copy of the personal information we hold about you. To do this, email brenden@mischewski.co.nz with your submission's public ID (shown on your report page) or your contact email address if you provided one.

Right of correction — If you believe information we hold about you is inaccurate, you may request that we correct it. Contact brenden@mischewski.co.nz with details of the correction sought.

Right to deletion — You may request deletion of your submission at any time by:

using the delete token link on your report page; or
emailing brenden@mischewski.co.nz and quoting your submission's public ID.

We will process deletion requests within a reasonable time (generally within 10 working days).

We will respond to any privacy rights request within 20 working days as required by the Privacy Act 2020.

11. Security

We take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure. Our security measures include:

TLS encryption — all data in transit between your browser and the Site is encrypted using TLS.
Server-side database access only — the browser never talks to the database directly. All reads and writes go through our server-side code, which authenticates to the database using a service role credential held only in server environment variables. Row-level security is enabled on the submissions table as an additional safeguard.
Tokenised report links — your report is not publicly listed or indexed. It is accessible only via a URL that includes a unique public_id and access_token generated at the time of your submission. The delete token is a separate, distinct credential. Requests to the report or delete API endpoints without the correct token are rejected.
No client-side secrets — service role credentials for the database are never exposed to the browser or included in client-side code.
Rate limiting — the submission endpoint enforces per-IP and per-day rate limits to protect against automated abuse.
Automated retention purge — identifiable submissions older than 24 months are deleted from the database by a scheduled job that runs daily.

No security measure is completely infallible. If you become aware of a security concern relating to the Site, please notify us at brenden@mischewski.co.nz.

12. Children

The Site and self-assessment tool are designed for tertiary providers and adult learners. They are not intended for use by anyone under the age of 16. We do not knowingly collect personal information from individuals under 16. If you believe a person under 16 has submitted information through the Site, please contact us so we can delete it.

13. Independent Status

The Site and tool are independent products operated by Mischewski Consulting, not affiliated with NZQA, TEC, or MoE. Nothing on the Site constitutes an accreditation decision, a funding decision, or a formal readiness certification.

14. Changes to This Statement

We may update this Privacy Statement to reflect changes to our practices, the law, or our services. When we do, we will update the version number and effective date at the top of this page. Continued use of the Site after a change is published constitutes acceptance of the updated statement.

15. Contact and Complaints

For any questions, requests, or concerns about this Privacy Statement or our data handling, please contact:

Brenden Mischewski Mischewski Consulting Email: brenden@mischewski.co.nz

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner:

Website: https://www.privacy.org.nz
Phone: 0800 803 909

Version 1.3.1 — Effective date: 6 August 2026 Mischewski Consulting — www.degreeapprenticeships.nz

← Return to home