Introduction
RotoruaNZ Limited (“we”, “us”, “our”) takes the privacy of people visiting and using this website (https://www.rotoruanz.com/) (“Website”) and engaging with our services very seriously.
“Personal Information” means any information that can directly or indirectly identify you or another person.
This Privacy Policy describes how we collect, use, disclose, and store your Personal Information when you visit our Website, make bookings, subscribe to updates, or otherwise interact with us, in accordance with the requirements set out in the Privacy Act 2020 (the “Privacy Act”). The Privacy Act is supervised by the New Zealand Privacy Commissioner (https://www.privacy.org.nz/). This Privacy Policy should be read in conjunction with our Website Terms and Conditions.
Technical Infrastructure
Our Website is managed by AKQA, an international communications agency with a New Zealand office. The CMS (Xperience by Kentico) is hosted on Azure Managed Cloud services.
What Personal Information We Collect
We only collect Personal Information necessary to carry out our functions as Rotorua’s regional destination marketing and economic development organisation. This includes:
Contact and Identity Details: Full name, screen name, email address, physical address, phone number, and country or region when you complete forms, register for updates, or contact our team.
Booking and Itinerary Details: When you purchase or book products, activities, or services through our ‘Book Here’ platform, we collect your name, contact details, travel dates, itinerary details, and transaction history.
Payment Information Handling: All online payment transactions are processed through secure, accredited third-party payment gateways. RotoruaNZ does not receive, view, or store full payment card details or card security numbers.
Enquiries and Community Submissions: Information, messages, or comments you submit via contact forms, message boards, or voluntary surveys.
Website Analytics and Device Information: Automated technical information collected via cookies, log files, tags, and pixels, including IP address, browser type, device information, general geographic location, referring websites, and interaction patterns.
1. Purpose and Use of Your Information
We collect and use your Personal Information for clear, lawful business purposes, including:
Fulfilling Bookings and Reservations: Processing transactions, ticketing, and activities requested by you, including sharing necessary booking details with chosen local tourism and accommodation operators to confirm your reservations.
Destination Marketing and Economic Development: Supporting sustainable economic growth across the Rotorua district by analysing aggregated visitor trends, preferences, and demand patterns.
Direct Communications: Delivering newsletters, seasonal updates, or notices where you have opted in. Every promotional communication includes a clear and functional ‘Unsubscribe’ facility.
Website and Digital Platform Improvement: Evaluating aggregated website usage data to refine site architecture, improve content accessibility, and safeguard network performance.
Stakeholder Support and Service Delivery: Responding to public inquiries, resolving issues, and gathering voluntary community and visitor feedback.
Information Sharing and Disclosure
We do not sell, rent, or trade your Personal Information. We only disclose Personal Information where permitted under the Privacy Act 2020, including to:
Contracted Local Operators: Tourism, hospitality, transport, and event operators chosen by you during the booking process, strictly to fulfil your booked services.
Approved Service Providers: Trusted vendors supporting our technical systems and operations under written confidentiality and privacy agreements (e.g., Azure cloud hosting, Kentico CMS developers, HubSpot, and MailChimp).
Statutory and Legal Authorities: Regulatory or law enforcement agencies where disclosure is required by law, court order, or to prevent serious threats to public health or personal safety.
Overseas Disclosures (Privacy Principle 12): Where cloud services or platform providers store or process data outside New Zealand, we ensure they are subject to comparable privacy safeguards or binding standard contractual clauses meeting New Zealand legal requirements.
2. Storage, Security, and Retention
We employ appropriate administrative, technical, and physical safeguards to protect Personal Information from loss, misuse, unauthorised access, modification, or disclosure. Access is restricted strictly to authorised personnel with a verified operational requirement.
We retain Personal Information only for as long as required to achieve the operational purposes for which it was gathered, or as mandated by statutory record-keeping frameworks, including the Public Records Act 2005 and council retention schedules.
Use of Artificial Intelligence (AI): RotoruaNZ may use approved AI-enabled tools to support operational research, drafting, communications, and data analysis. Where AI systems interact with Personal Information:
Privacy-by-Design: Stringent privacy, security, and access controls are applied prior to deployment.
Human Oversight: Meaningful human review is maintained; AI tools are never used to make solely automated decisions that determine or materially affect individuals' legal rights, access, or opportunities.
Protection of Inputs: We do not permit enterprise or personal information to be used to train external public AI models without explicit assessment and contractual approval.
Your Rights: Access and Correction
Under Principles 6 and 7 of the Privacy Act 2020, you have the right to request: confirmation of whether we hold Personal Information about you, access to that information, and correction where information is inaccurate, incomplete, or out of date.
Making a Request: You may lodge a request by writing to our Privacy Officer at [email protected]. We will acknowledge and formally decide on your request as soon as reasonably practicable, and no later than 20 working days following receipt.
Where a correction is declined, you have the right to request that a statement of the correction sought be attached to the disputed record. Refusals and Statements of Correction: If statutory grounds under the Privacy Act prevent us from releasing information, or if we decline a requested correction, we will explain our reasoning for that.
3. Contact Details and Complaints
If you have any questions regarding this Privacy Policy or wish to raise a privacy concern, please contact our Privacy Officer:
Privacy Officer
RotoruaNZ Limited
Email: [email protected]
Postal Address: Private Bag 3007, Rotorua 3046, New Zealand
If you are dissatisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner:
Office of the Privacy Commissioner
Online: https://www.privacy.org.nz/your-rights/how-to-complain/
Enquiry Line: 0800 803 909
Administration
The Chief Executive is responsible for the administration, interpretation, and application of this policy.