Privacy Policy
Company Registration Number: 9429046927
GST Number: NZ 138-472-964
Website: calvessianroyalretreat.com
Privacy enquiries: info@calvessianroyalretreat.com
Last updated: 20 June 2025
1. Introduction
("we", "us", "our") operates the Calvessian Royal Retreat hotel and casino located in Christchurch, New Zealand, and maintains the website at calvessianroyalretreat.com ("the Website"). We are committed to protecting the personal information of every person who visits, browses or interacts with our Website.
This Privacy Policy explains what personal information we collect through the Website, why we collect it, how we use and protect it, with whom we share it, how long we retain it, and what rights you hold in respect of your information. It applies solely to processing activities connected with the Website and the services described on it.
This Policy is issued in compliance with the Privacy Act 2020 (New Zealand) and the Information Privacy Principles contained within it. By using the Website you acknowledge that you have read and understood this Policy.
2. Data Controller
The data controller responsible for your personal information is:
| Legal entity | |
|---|---|
| Registered address | |
| Company number | 9429046927 |
| GST number | NZ 138-472-964 |
| Privacy contact | info@calvessianroyalretreat.com |
All enquiries, requests and complaints relating to this Policy should be directed to the contact address above. We will acknowledge receipt of your communication within five working days and endeavour to respond fully within twenty working days.
3. Personal Information We Collect
We collect personal information only to the extent necessary for the purposes described in this Policy. The categories of information we may collect through the Website are set out below.
3.1 Contact and Reservation-Request Information
When you submit an enquiry, reservation request or contact form through the Website, we collect the information you provide, which may include:
- Full name
- Email address
- Telephone number
- Postal address or country of residence
- Intended arrival and departure dates
- Room or accommodation type preferences
- Number of guests and any specific guest requirements you choose to disclose
- Preferred payment method category (actual payment card details are handled exclusively by our authorised payment processor and are not stored on our systems)
- Any additional information you voluntarily include in a free-text message field
3.2 Age Verification Information
Access to casino-related content and services on the Website is restricted to persons who are 18 years of age or older. Where the Website presents an age-confirmation mechanism, we record the confirmation of eligibility. We do not use the data captured for any purpose beyond ensuring compliance with minimum age requirements.
3.3 Device and Technical Information
When you access the Website, our servers and analytics systems automatically record certain technical data, including:
- Internet Protocol (IP) address
- Browser type and version
- Operating system and device type
- Referring URL and exit pages
- Pages viewed and time spent on each page
- Date and time of your visit
- Language preference settings
This information is collected automatically as part of standard web-server operation and is used in aggregated or pseudonymised form wherever possible.
3.4 Cookie and Consent Data
The Website uses cookies and similar tracking technologies. When you first visit the Website, a consent notice is presented to you. Your consent choices, together with a timestamp and session identifier, are recorded and stored so that we can honour your preferences consistently across your visits.
For full details of the cookies we use, their purposes and your options, please see Section 8 (Cookies and Similar Technologies) below.
3.5 Special-Category Personal Data
We do not seek to collect special-category personal data through the Website. If you voluntarily include such information in a free-text field, we will treat it with the heightened care required by applicable law and will use it only for the purpose for which you provided it. We will not retain special-category personal data beyond the period strictly necessary to address your enquiry.
3.6 Children's Information
The Website is not directed at persons under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently received information from a person under 18, please contact us at info@calvessianroyalretreat.com and we will delete it without undue delay.
4. Purposes and Legal Bases for Processing
The table below summarises each purpose for which we process personal information, the legal basis under the Privacy Act 2020 and any applicable legitimate interests we rely upon.
| Purpose | Categories of information used | Legal basis |
|---|---|---|
| Responding to enquiries and contact-form submissions | Contact information; free-text message content | Necessary to take steps at your request prior to entering a contract; our legitimate interest in providing prompt customer service |
| Processing and administering reservation requests | Contact information; arrival and departure dates; room preferences; payment method category; number of guests | Performance of a contract to which you are a party, or steps taken at your request prior to entering such a contract |
| Age verification for casino-related content and services | Age-confirmation data | Compliance with our legal obligations; our legitimate interest in upholding responsible gaming standards |
| Operating, securing and improving the Website | Device and technical information; cookie and consent data | Our legitimate interest in maintaining a functional, secure and high-quality online presence |
| Analytics and Website performance monitoring | Device and technical information (aggregated or pseudonymised) | Our legitimate interest in understanding how visitors use the Website so that we may improve it |
| Honouring your cookie and consent preferences | Cookie and consent data | Compliance with legal obligations; your consent where required |
| Communicating promotional information about our accommodation and casino facilities (where you have opted in) | Contact information | Your consent, which may be withdrawn at any time |
| Defending or establishing legal claims and complying with applicable law | Any relevant category of information | Compliance with legal obligations; our legitimate interest in protecting our rights and those of third parties |
Where we rely on legitimate interests as our legal basis, we have conducted a balancing assessment and are satisfied that our interests are not overridden by your rights and interests. You may request a copy of that assessment by contacting us at info@calvessianroyalretreat.com.
5. Recipients of Personal Information
We do not sell your personal information. We share personal information only where necessary for the purposes described in this Policy, or where required by law. The categories of recipient are as follows:
5.1 Service Providers and Processors
We engage reputable third-party service providers who process personal information on our behalf and under our instruction. These include:
- Reservation and property management system providers — to manage room availability, booking confirmations and guest records
- Payment processing providers — to facilitate secure handling of payment transactions; these providers operate under their own PCI-DSS compliance obligations and applicable data protection requirements
- Website hosting and infrastructure providers — to host and maintain the Website and associated systems
- Website analytics providers — to provide aggregated and pseudonymised data about Website usage
- Email and communications platform providers — to deliver responses to your enquiries and, where you have consented, promotional communications
Each service provider is bound by a data processing agreement that requires them to process personal information only in accordance with our instructions and to maintain appropriate security measures.
5.2 Professional Advisers
We may share personal information with our legal advisers, accountants or insurers where necessary in connection with professional services rendered to us, subject to obligations of professional confidentiality.
5.3 Regulatory and Law Enforcement Authorities
We may disclose personal information to government agencies, regulators or law enforcement authorities where we are required to do so by law, court order or other binding legal process, or where disclosure is necessary to protect the rights, property or safety of , our guests or the public.
5.4 Business Transfers
In the event that we undergo a merger, acquisition, restructuring, sale of assets or similar transaction, personal information held by us may be transferred as part of that transaction. We will notify affected individuals in advance of any such transfer where required by law, and any successor entity will remain bound by this Policy or a policy that provides equivalent or greater protection.
6. International Transfers of Personal Information
Some of our service providers are located or store data in countries outside New Zealand. Where personal information is transferred to a recipient in another country, we take steps to ensure that the transfer is carried out lawfully and that your information receives a standard of protection consistent with the Privacy Act 2020.
Such steps may include:
- Transferring to recipients in countries that the New Zealand Privacy Commissioner has recognised as providing comparable safeguards
- Entering into contractual clauses with recipients that require them to protect personal information in accordance with New Zealand standards
- Relying on the recipient's binding corporate rules or equivalent certification schemes where applicable
You may request information about the specific safeguards we apply to any particular international transfer by contacting us at info@calvessianroyalretreat.com.
7. Retention of Personal Information
We retain personal information for no longer than is necessary for the purposes for which it was collected, taking into account our legal and regulatory obligations, contractual requirements and legitimate business needs.
| Category of information | Retention period |
|---|---|
| Reservation-request and confirmed booking records | Seven years from the date of stay or, if a booking is not completed, two years from the date of the request — to comply with our accounting and tax obligations and to defend potential legal claims |
| Contact-form and general enquiry records | Two years from the date of the last communication, unless the enquiry resulted in a booking (in which case the booking retention period applies) |
| Age-verification records | For the duration of your session, or as otherwise required to demonstrate compliance with applicable law |
| Website analytics and technical log data | Up to 26 months in aggregated or pseudonymised form; raw server logs are deleted within 90 days |
| Cookie consent records | 12 months from the date consent was recorded, or until you withdraw or amend your consent |
| Marketing-preference records | Until you withdraw consent or request erasure, plus a brief suppression-list period to prevent accidental re-contact |
At the end of the applicable retention period, personal information is securely deleted or irreversibly anonymised. Where deletion is not immediately practicable due to technical constraints, the information is isolated from active processing and scheduled for deletion at the earliest practicable opportunity.
9. Security of Personal Information
We implement and maintain appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. These measures are designed to reflect the nature and sensitivity of the information held and the risks presented by our processing activities.
Our security measures include:
- Encryption of data in transit using industry-standard Transport Layer Security (TLS) protocols
- Access controls and role-based permissions that limit access to personal information to those employees and processors who require it to perform their functions
- Regular review and testing of our technical infrastructure and security posture
- Staff awareness and training on data protection obligations
- Contractual requirements on all third-party processors to maintain equivalent security standards
Despite these measures, no method of electronic transmission or storage is completely secure. If you become aware of any actual or suspected security incident affecting your personal information, please notify us immediately at info@calvessianroyalretreat.com.
In the event of a privacy breach that is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner and affected individuals in accordance with the mandatory notification requirements of the Privacy Act 2020.
10. Your Privacy Rights
Under the Privacy Act 2020, you have the following rights in relation to the personal information we hold about you:
10.1 Right of Access
You have the right to request confirmation of whether we hold personal information about you and, if so, to receive a copy of that information together with details of how it is used. We will respond to an access request within 20 working days of receipt, subject to any extensions permitted by law.
10.2 Right to Correction
If you believe that personal information we hold about you is inaccurate, incomplete, misleading or not up to date, you may ask us to correct it. Where we disagree that a correction is warranted, we will attach a note of your request to the relevant record.
10.3 Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for marketing communications, click the unsubscribe link in any marketing email we send you, or contact us at info@calvessianroyalretreat.com. To withdraw cookie consent, use the cookie settings panel accessible from the Website footer.
10.4 Right to Object and Restrict Processing
You may object to processing based on our legitimate interests, or request that we restrict processing of your information in certain circumstances, for example if you contest the accuracy of the information or object to our use of it while we investigate your concern.
10.5 Right to Erasure
In certain circumstances, you may request that we delete personal information we hold about you. This right is not absolute and may be limited by our legal obligations, the necessity of retaining information to perform a contract with you, or the need to establish, exercise or defend legal claims.
10.6 Right to Data Portability
Where technically feasible and where processing is based on consent or contract, you may request that we provide your personal information in a structured, commonly used and machine-readable format, or that we transmit it directly to another controller.
10.7 Exercising Your Rights
To exercise any of the rights described above, please send a written request to:
Privacy Officer
Email: info@calvessianroyalretreat.com
We may ask you to verify your identity before acting on your request in order to protect the security of the information we hold. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we will notify you before proceeding.
11. Complaints
If you are dissatisfied with how we have handled your personal information or any privacy request you have made, we encourage you to contact us in the first instance at info@calvessianroyalretreat.com so that we have the opportunity to address your concern directly.
If you remain dissatisfied after engaging with us, or if you wish to make a complaint directly to the regulator, you have the right to contact the Office of the Privacy Commissioner of New Zealand:
Office of the Privacy Commissioner
PO Box 10 094, The Terrace, Wellington 6143, New Zealand
Website: www.privacy.org.nz
The Privacy Commissioner provides a complaints service under the Privacy Act 2020 and may investigate complaints that an agency has breached the Information Privacy Principles.
12. Links to Third-Party Websites
The Website may contain links to third-party websites or services that are not operated by . This Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party website you visit. We accept no responsibility for the privacy practices or content of third-party websites.
13. Changes to This Policy
We review this Privacy Policy periodically to reflect changes in our processing activities, applicable law or regulatory guidance. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on the Website.
We encourage you to review this Policy each time you visit the Website to stay informed about how we protect your personal information. Continued use of the Website following the posting of an updated Policy constitutes your acknowledgement of the changes.
14. Contact Us
If you have any questions, concerns or requests in relation to this Privacy Policy or the way we handle your personal information, please contact us:
Privacy Officer
Email: info@calvessianroyalretreat.com
Website: calvessianroyalretreat.com