Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Data you provide directly

• Contact & enquiry data: Full name, email address, phone number, message content and preferences when you submit an enquiry or booking request form.
• Event registration data: Name, email, dietary requirements or accessibility needs when registering for resort-hosted events.
• Correspondence data: Any data you include in emails or communications sent to us.

2.2 Data collected automatically

• Technical data: IP address, browser type and version, operating system, referring URLs, pages visited and time spent collected via server logs and analytics.
• Cookie data: Session identifiers, preference settings and analytics tokens. See Section 8 for full details.

We do not collect special category data (health, race, political opinions, etc.) unless you voluntarily provide it in a message, for example dietary requirements.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)): Processing your enquiry and arranging travel or event services.
• Legitimate interests (Art. 6(1)(f)): Website analytics, fraud prevention and improving our services.
• Consent (Art. 6(1)(a)): Email marketing communications (if you opt in). You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): Compliance with New Zealand law, tax obligations and regulatory requirements.

4. How We Use Your Data

• To respond to your travel or accommodation enquiry.
• To process and coordinate hotel, event or resort-property bookings on your behalf.
• To send you service-related communications (booking confirmations, updates).
• To send marketing emails about luxury hotel offers or events only if you have specifically opted in.
• To improve our website through aggregated analytics.
• To comply with applicable legal and regulatory obligations.

5. Data Sharing and Third Parties

We do not sell, rent or trade your personal data. We share data only in the following limited circumstances:

• Hotel and resort operators: Only the information necessary to make a reservation on your behalf (name, dates, preferences). These operators are data processors acting under our instruction.
• Email service providers: For delivery of transactional and marketing emails, under GDPR-compliant data processing agreements.
• Analytics providers: Aggregated, anonymised usage data to improve website performance.
• Legal authorities: Where required by New Zealand or EU law, court order or regulatory demand.

6. Data Retention

• Enquiry and booking data: Retained for 5 years after service completion for legal and accounting compliance under New Zealand law.
• Marketing consent records: Retained until you withdraw consent, plus 1 year for audit purposes.
• Website analytics: Aggregated data retained for 26 months; individual session data retained for 14 months.
• Correspondence: Retained for up to 3 years unless a legal obligation requires longer retention.

7. Your Rights Under GDPR

As a data subject under EU/EEA law, you have the following rights:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
• Right to restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: Withdraw marketing consent at any time without affecting prior processing.

To exercise any right, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the New Zealand supervisory authority: Office of the Privacy Commissioner (New Zealand) privacy.org.nz.

8. Cookies

We use cookies and similar technologies to operate the website and improve your experience. Cookies are small text files stored in your browser.

8.1 Types of cookies we use

• Essential cookies: Required for the website to function (session management, age verification state, cookie consent preference). These cannot be disabled.
• Analytics cookies: Used to understand how visitors interact with the website (pages visited, time on site, referral sources). Data is aggregated and anonymised.
• Preference cookies: Store your language preference and filter selections.

8.2 Managing cookies

You can control and delete cookies through your browser settings. Disabling analytics or preference cookies will not prevent you from using the website, but some personalisation features may not work. For comprehensive cookie management, see your browser's help documentation.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. These include encrypted data transmission (HTTPS/TLS), access controls and regular security reviews. However, no internet transmission is entirely secure, and we cannot guarantee absolute security.

10. International Data Transfers

Where we use third-party services based outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs). We do not transfer data to countries lacking adequate protection without such safeguards.

11. Minors

This website is strictly for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected] and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the website after a policy update constitutes acceptance of the revised policy.

13. Contact & Data Protection Officer

For any privacy-related questions, requests or complaints: