How we handle your information
Survey privacy notice · version 2026-10-30 · 3 Big Things
Taking part
This voluntary study explores organisational readiness to manage psychosocial risks. You can leave at any time. Questions marked required must be answered to complete the survey. Answers are saved as you continue, including unfinished responses.
Answers and contact details
We do not ask for your name or email in the answers. Answers include your role, business characteristics and, for an organisation invitation, an organisation code. Small groups and distinctive combinations can make people recognisable, so we cannot promise complete anonymity. Employers should not ask to see your personal reflection or use this study to assess individual employees.
Optional report, update and business-contact requests are stored in a separate contact database. These choices are not linked to an answer record. Newsletter permissions can be copied to the 3 Big Things website subscriber list; business-contact requests can be copied to our sales CRM (Microsoft Dataverse, hosted in Australia), where a later withdrawal is recorded as a permanent do-not-contact entry. Email ownership is not verified.
Reports and access
Your personal reflection uses a time-limited access link. Use “Finish and clear this reflection” on a shared device; downloaded copies remain on that device. Organisation and national reports require disclosure review before release. We withhold figures where reporting could expose individuals; a minimum group size alone cannot guarantee privacy.
Hosting and technical records
The application uses Netlify, separate Supabase databases in Sydney, and Amazon SES for email. Business-contact requests also use Microsoft Dataverse; our CRM includes an AI assistant that sends the records a staff member asks about to Anthropic, an AI provider in the United States. Copies and provider support access can involve overseas handling. Technical service providers process connection information to deliver and protect the service. We do not store IP addresses with survey answers. Abuse controls use keyed connection counters separately from answers. Provider logs and support access are separate from the survey database.
Carapace, an independent New Zealand security firm, tested the survey and reviewed its code in October 2026, before fieldwork. They found no way to reach anyone’s answers or contact details, and one low-severity gap in how often one page could be requested. We closed it before the survey opened.
Withdrawal, retention and questions
Use the unsubscribe link in a study email to withdraw contact permissions. Messages already accepted for delivery may still arrive. Withdrawal from emails does not remove survey answers: because we do not link your address to answers, we generally cannot identify which answers are yours. Unfinished responses are scheduled for removal after 30 days. Completed responses are retained for the study comparison, with an automated maximum of five years. Reflection access expires after 24 hours. Contact details, consent and withdrawal records are kept for a maximum of five years, the same as the study dataset, and are then deleted automatically; a withdrawal is honoured for as long as we hold any copy. Ask us about records copied to other systems.
For access, correction, withdrawal or a privacy concern, contact contact@3bigthings.co.nz. Tell us which contact permission or report you mean; please do not send sensitive survey answers by email.