Privacy Policy
Last updated: 1 June 2025
1. Introduction
("we", "us" or "our") operates the website calvessianroyalstay.com (the "Website") and the physical hotel-casino property known as Calvessian, located in Auckland, New Zealand. We are committed to protecting the personal information of everyone who visits our Website, submits a reservation enquiry or otherwise interacts with us online.
This Privacy Policy explains what personal information we collect through the Website, why we collect it, how we use and protect it, who we share it with, how long we keep it, and what rights you have in relation to it. Please read this policy carefully before using the Website or providing us with any personal information.
By using the Website you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please refrain from using the Website.
2. Data Controller
The data controller responsible for personal information collected through this Website is:
| Legal entity | |
|---|---|
| Registered address | |
| Company registration number | 9684217 |
| GST / VAT number | 174-638-521 |
| Privacy enquiries | info@calvessianroyalstay.com |
Any questions, requests or complaints relating to this Privacy Policy should be directed to us using the contact details above.
3. Personal Information We Collect
We collect personal information only to the extent necessary to provide the services and functionality available through the Website. The categories of personal information we may collect are set out below.
3.1 Information You Provide to Us
When you complete a contact form, reservation enquiry or any other web-based submission, we may collect:
- Full name
- Email address
- Telephone number
- Postal or billing address
- Preferred arrival and departure dates
- Room type or accommodation preferences
- Number of guests and any special requests
- Payment card details (where submitted via a secure payment interface)
- Any other information you voluntarily include in a free-text field
Please note that our casino facilities are open only to guests who have attained the minimum age of 18 years. If you include information in a reservation enquiry that relates to casino access, we will process that information solely for the purpose of administering your enquiry.
3.2 Information Collected Automatically
When you visit the Website, certain technical information is collected automatically by our servers and any analytics or cookie technologies we operate. This may include:
- IP address and approximate geographic location derived from it
- Browser type and version
- Operating system
- Device type and screen resolution
- Referring URL and exit pages
- Pages viewed, links clicked and time spent on each page
- Date and time of each visit
- Cookie identifiers and similar tracking data (see Section 7)
3.3 Special-Category Personal Data
We do not intentionally collect special-category personal data through the Website. If you voluntarily include such information in a free-text field, we will process it only to the extent strictly necessary to respond to your enquiry and will delete it once the purpose is fulfilled.
4. Purposes and Legal Bases for Processing
New Zealand's Privacy Act 2020 governs the collection, use and disclosure of personal information in New Zealand. The table below sets out the purposes for which we process your personal information and the applicable legal basis or principle under that Act.
| Purpose | Categories of information used | Legal basis / Privacy Act principle |
|---|---|---|
| To respond to reservation enquiries and manage bookings | Contact details, booking preferences, payment information | Processing is necessary to take steps at your request prior to, or in performance of, a contract for accommodation services |
| To send booking confirmations, pre-arrival communications and post-stay follow-ups | Contact details, booking details | Performance of contract; or our legitimate interest in providing you with relevant service communications directly related to your stay |
| To process payments and prevent fraud | Payment card details, contact details, device information | Performance of contract; compliance with legal obligations relating to financial record-keeping; our legitimate interest in fraud prevention |
| To send marketing communications about the property, offers and events | Contact details, booking history | Your consent, which you may withdraw at any time (see Section 9) |
| To analyse Website usage and improve our online services | Device and browsing data, cookie identifiers | Your consent where required by applicable rules; our legitimate interest in understanding how the Website is used so that we may improve it |
| To comply with legal and regulatory obligations | All categories as required by applicable law | Compliance with legal obligations imposed on us under New Zealand law |
| To handle complaints and resolve disputes | Contact details, correspondence records | Our legitimate interest in resolving disputes and protecting our legal position |
Where we rely on legitimate interests as the basis for processing, we have considered whether those interests are overridden by your interests or fundamental rights and concluded that they are not. You may contact us at any time to request further information about this balancing assessment.
6. Disclosure of Your Personal Information
We do not sell your personal information to third parties. We may share your information with the following categories of recipients, strictly as necessary for the purposes described in Section 4:
6.1 Service Providers and Processors
We engage third-party companies to assist us in operating the Website and delivering our services. These providers act on our instructions and are not permitted to use your personal information for their own purposes. Categories include:
- Cloud hosting and server infrastructure providers
- Payment processing and fraud prevention service providers
- Reservation management and property management system providers
- Email delivery and customer communication platform providers
- Website analytics providers
- Customer support platform providers
6.2 Professional Advisers
We may share your personal information with lawyers, accountants, auditors and insurers where necessary for the conduct of our business or the protection of our legal rights.
6.3 Law Enforcement and Regulatory Bodies
We may disclose personal information to government authorities, law enforcement agencies or regulators where required or permitted to do so by applicable New Zealand law, or where disclosure is necessary to protect the safety or rights of any person.
6.4 Business Transfers
In the event of a merger, acquisition, restructuring or sale of all or part of our business, your personal information may be transferred to the relevant successor entity. We will ensure that appropriate confidentiality and data-protection obligations are in place before any such transfer takes place.
7. International Transfers of Personal Information
We are based in New Zealand and primarily process your personal information within New Zealand. Some of our service providers may be located in, or process information in, countries outside New Zealand, including Australia and countries in the European Economic Area or the United States.
Where we transfer personal information outside New Zealand, we take steps to ensure that recipients provide a comparable level of protection to that required under the New Zealand Privacy Act 2020. These steps may include:
- Transferring to countries recognised by the New Zealand Privacy Commissioner as providing an adequate level of protection;
- Entering into contractual arrangements with the recipient that impose data-protection obligations consistent with New Zealand law;
- Relying on other lawful transfer mechanisms as permitted under applicable law.
You may request further information about the safeguards applicable to a specific international transfer by contacting us at info@calvessianroyalstay.com.
8. Retention of Personal Information
We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, resolve disputes and enforce our agreements. The criteria we use to determine retention periods include:
- Reservation enquiries that do not result in a booking: Enquiry records are retained for up to 12 months from the date of the enquiry, after which they are securely deleted unless you have consented to receive ongoing marketing communications.
- Confirmed bookings and guest records: Information relating to a completed stay is retained for a period of seven years from the date of checkout in accordance with our accounting and legal record-keeping obligations under New Zealand law.
- Payment records: Retained for seven years in accordance with applicable financial legislation.
- Marketing consent records: Retained for as long as you remain subscribed and for a reasonable period thereafter to evidence your consent or opt-out.
- Website analytics data: Aggregated or anonymised analytics data may be retained indefinitely as it no longer constitutes personal information. Cookie-based identifiers are retained in accordance with the retention period disclosed in our cookie consent interface.
- Complaint and dispute records: Retained for the duration of the relevant limitation period under New Zealand law.
When personal information is no longer required, we securely delete or anonymise it in accordance with our internal data-management procedures.
9. Security of Your Personal Information
We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. These measures include:
- Transmission of sensitive data over encrypted (TLS/SSL) connections
- Access controls limiting personal information to authorised personnel only
- Regular review of our information-security practices and systems
- Staff training on privacy and data-handling obligations
- Contractual security requirements imposed on third-party service providers
While we take all reasonable precautions, no method of transmission over the internet or electronic storage is entirely secure. We cannot guarantee absolute security and encourage you to use secure networks when submitting personal information online.
If we become aware of a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required under the Privacy Act 2020.
10. Your Privacy Rights
Under the New Zealand Privacy Act 2020, you have the following rights in relation to personal information we hold about you:
| Right | Description |
|---|---|
| Right of access | You may request confirmation of whether we hold personal information about you and, if so, a copy of that information together with details of how it is used. |
| Right of correction | You may request that we correct personal information that is inaccurate, incomplete, misleading or not up to date. |
| Right to withdraw consent | Where processing is based on your consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. |
| Right to object to direct marketing | You may opt out of receiving marketing emails from us at any time by clicking the unsubscribe link in any marketing communication or by contacting us directly. |
| Right to complain | You have the right to make a complaint to the Office of the Privacy Commissioner if you believe we have not handled your personal information in accordance with the Privacy Act 2020 (see Section 12). |
To exercise any of the above rights, please contact us using the details set out in Section 11. We will respond to your request within 20 working days of receipt, as required under the Privacy Act 2020. In some circumstances we may need to verify your identity before processing your request.
11. Responsible Gaming and Age Verification
Calvessian's casino facilities are restricted to individuals aged 18 years and over. When you submit a reservation enquiry that includes a request related to casino access, we may use the personal information you provide to verify that you meet this minimum age requirement.
For information on responsible gaming guidance, self-exclusion tools and support resources available in New Zealand, the Department of Internal Affairs provides publicly accessible information at its official website. We encourage any guest who believes they may be experiencing difficulties related to gaming to consult those publicly available resources.
12. Contact Us
If you have any questions about this Privacy Policy, wish to exercise a privacy right or wish to raise a concern about how we handle your personal information, please contact our privacy team:
Privacy Team —Email: info@calvessianroyalstay.com
We will acknowledge your enquiry promptly and aim to resolve it within 20 working days. Where a request is complex or we receive a large volume of requests, we may take up to an additional 20 working days and will notify you accordingly.
13. Complaints to the Office of the Privacy Commissioner
If you are not satisfied with our response to a privacy concern, you have the right to make a complaint to the Office of the Privacy Commissioner of New Zealand, which is the independent body responsible for overseeing compliance with the Privacy Act 2020 and providing guidance and complaint resolution services to individuals and organisations in New Zealand.
Contact details and complaint submission procedures for the Office of the Privacy Commissioner are available on its official website at www.privacy.org.nz.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or applicable legal requirements. When we make a material change, we will update the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.
Continued use of the Website following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms. Where changes are significant, we may also notify you by email if we hold a current email address for you.