Talent Grid Limited (NZBN: 9429051450724) ("TalentGrid", "we", "us", or "our") is committed to protecting the security, confidentiality, and integrity of personal information and data processed through our platform. This Data Security Policy outlines the technical and organisational measures we implement to safeguard your data.
This policy complies with the New Zealand Privacy Act 2020, specifically Information Privacy Principle 5 (IPP 5), which requires agencies to protect personal information through appropriate security safeguards.
2. Scope
This policy applies to all:
Personal information collected, stored, or processed by TalentGrid
Systems, applications, and infrastructure used to operate the TalentGrid platform
Third-party service providers who process data on our behalf
TalentGrid employees, contractors, and authorised personnel with access to data
3. Data Classification
We classify data into the following categories to apply appropriate security controls:
3.1 Highly Sensitive Data
Authentication credentials (passwords, API keys, tokens)
Banking and payment information
Police vetting results
Health information
IRD numbers and tax details
3.2 Sensitive Data
Professional credentials and qualifications
Contact details (email, phone, address)
Employment history and references
Shift records and timesheets
Communication between users
3.3 General Data
Public profile information (where user has chosen to share)
Aggregated, anonymised analytics data
Non-identifying usage statistics
4. Technical Security Measures
4.1 Encryption
Data in Transit: All data transmitted between users and our servers is encrypted using TLS 1.2 or higher (HTTPS)
Data at Rest: Sensitive data stored in databases is encrypted using AES-256 encryption
Password Storage: User passwords are hashed using bcrypt with salt before storage; passwords are never stored in plain text
API Communications: All API endpoints require encrypted connections
4.2 Access Controls
Authentication: Multi-factor authentication (MFA) is required for administrative access
Role-Based Access: Access to data is restricted based on job function and need-to-know basis
Least Privilege Principle: Users and systems are granted the minimum permissions necessary
Session Management: Automatic session timeout after periods of inactivity
Audit Logging: All access to sensitive data is logged and monitored
4.3 Infrastructure Security
Cloud Hosting: Platform hosted on secure, professionally managed cloud infrastructure with ISO 27001 certification
Firewalls: Network firewalls protect against unauthorised access
Intrusion Detection: Automated systems monitor for suspicious activity
DDoS Protection: Distributed denial-of-service mitigation measures in place
Regular Updates: Security patches and updates applied promptly to all systems
4.4 Application Security
Secure Development: Code reviewed for security vulnerabilities before deployment
Input Validation: All user inputs validated and sanitised to prevent injection attacks
Secure deletion methods used to destroy data when no longer required
Database records securely wiped and overwritten
Physical media destroyed using certified destruction methods
10. Compliance and Certification
TalentGrid is committed to maintaining compliance with:
New Zealand Privacy Act 2020
Health Information Privacy Code 2020 (where applicable)
Payment Card Industry Data Security Standard (PCI DSS) where applicable
Industry best practices for information security
11. Continuous Improvement
Security is an ongoing process. We continuously review and update our security measures to address:
Emerging threats and vulnerabilities
New technologies and attack vectors
Changes to regulatory requirements
Lessons learned from security incidents
Industry best practices and standards
12. Reporting Security Concerns
If you identify a security vulnerability or have concerns about data security:
Talent Grid Limited - Security Team
Email:
General Email:
Address: Auckland, New Zealand
We appreciate responsible disclosure and will investigate all reports promptly and confidentially.
13. Changes to This Policy
This Data Security Policy may be updated periodically to reflect changes in our security practices or regulatory requirements. Material changes will be communicated via email and platform notifications.