Privacy Policy
Last updated 12 March 2026
This policy explains what personal information Tidal Veranda Hospitality Limited collects, why we collect it, who sees it, how long we hold it, and what you can do about all of that. It is written to comply with the New Zealand Privacy Act 2020 and its thirteen information privacy principles.
1. Who we are
Tidal Veranda Hospitality Limited, NZBN 9429051764023, of 112 Marine Parade, Mount Maunganui, Tauranga 3116, Bay of Plenty, New Zealand. We are the agency responsible for the personal information described here.
Privacy enquiries: [email protected] or +64 7 575 2840, asking for the Privacy Officer.
2. What we collect
| Information | When | Why |
|---|---|---|
| Name, email, phone | Booking or enquiry | To answer you and hold a reservation |
| Address, country | Check-in | Required guest register |
| Payment card details | Booking, check-out | To take a deposit and settle the account — handled by our payment provider, not stored by us |
| Dates, room type, guests | Booking | To give you the room you asked for |
| Dietary needs, accessibility needs | You tell us | To feed you properly and to put you in the right room |
| Vehicle registration | If you park with us | Car park management |
| Date of birth, ID type | Entry to The Rangataua Room | Legal age verification under the Gambling Act 2003 |
| Self-exclusion records, photograph | If you self-exclude | To honour the exclusion you asked for |
| CCTV footage | Public areas, continuously | Safety of guests and staff, and a legal requirement in the gaming venue |
| Website analytics | Only with your consent | To see which pages are read |
We collect information directly from you wherever we can. Where it reaches us another way — a booking agent, a company arranging a conference, a travel agent — we treat it exactly as if you had given it to us yourself.
We do not require you to identify yourself to browse this website, to walk into the restaurant or the bar, or to enquire about a room by telephone.
3. Age verification and gaming records
Where we check identification at the door of The Rangataua Room, we look at the document and record only that a check was carried out and what type of document was shown. We do not photocopy, scan or photograph identification documents, and we do not keep your licence number.
Where a person self-excludes, we hold their name, the period of exclusion, a photograph taken with consent, and the record of the request. This is held securely, seen only by staff who need it to honour the exclusion, and destroyed when the exclusion period ends.
4. Why we may share it
We do not sell personal information, and we do not share it for anyone else's marketing. We disclose it only:
- to service providers acting on our instructions — our property management system, payment processor, email provider and IT support — each bound to protect it and to use it only for what we asked;
- where required by New Zealand law, including to the Department of Internal Affairs in relation to the gaming venue, and to the Police where there is a legal basis;
- to protect the safety of a person, where there is a serious threat;
- with your authorisation, including where you ask us to arrange something on your behalf — a charter, a restaurant, a transfer.
Some of our providers store data on servers outside New Zealand, including in Australia and the European Union. Before information leaves the country we satisfy ourselves that it will be protected by comparable safeguards, as principle 12 of the Act requires.
5. How long we keep it
| Record | Held for |
|---|---|
| Website enquiry with no booking | 24 months |
| Booking and guest register | 7 years — tax law |
| Financial and payment records | 7 years — tax law |
| CCTV footage | 31 days, then overwritten, unless part of an incident |
| Self-exclusion records | The exclusion period, then destroyed |
| Marketing list | Until you unsubscribe, then removed within 5 working days |
| Incident and host responsibility log | 7 years — Gambling Act requirements |
6. Your rights
Under the Privacy Act 2020 you may:
- Ask what we hold about you and receive a copy. We respond within 20 working days and there is no charge.
- Ask us to correct it if it is wrong. If we disagree, you can require us to attach your statement of correction to the record, and we will.
- Withdraw consent to marketing at any time — every email has an unsubscribe link, and telling any member of staff also works.
- Complain, first to us and then to the Privacy Commissioner.
Write to [email protected]. We may need to confirm who you are before we hand over records, which is in your interest.
7. Security
Information is held on access-controlled systems, encrypted in transit, and available only to staff whose job requires it. Payment card details are entered directly into our payment provider's system and are never written down, emailed, or stored on our own servers. Paper records — registration cards, exclusion forms — are kept in a locked office and destroyed by shredding.
If a privacy breach occurs that is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner as the Act requires, and we will tell you what we are doing about it rather than only that it happened.
8. Cookies
This website sets a small number of cookies. Analytics and marketing cookies are off until you switch them on. The detail is in the Cookie Policy.
9. Children
This website is not directed at children, and access to it is restricted to visitors aged 20 and over. We do not knowingly collect information from anyone under 20 through this site. Children are of course welcome in the hotel, and the information we hold about a family booking is held in the name of the adult who made it.
10. Complaints
Write to us first — [email protected] — and we will reply within 20 working days. If you are not satisfied, the Office of the Privacy Commissioner will look at it independently:
- privacy.org.nz
- 0800 803 909
- PO Box 10094, Wellington 6143
11. Changes
When this policy changes we update the date at the top. Where a change materially affects how we use information we already hold, we will tell the people affected directly rather than rely on them re-reading this page.