Privacy Policy

Last updated 1 March 2026

White Heath Hospitality Ltd (NZBN 9429051873604), trading as White Heath at 88 Frankton Road, Queenstown 9300, Otago, New Zealand, is the agency responsible for the personal information described here. We handle it under the Privacy Act 2020 and its thirteen information privacy principles. New Zealand law applies, not the GDPR.

01

What we collect

When you enquire or book

Your name, email address, telephone number, the dates and room you are asking about, the number of guests, and anything you write in the message field. If you tick the marketing box, we record that you did and when.

When you stay

Your address, payment card details (handled by our payment provider — we do not store full card numbers), vehicle registration if you park with us, dietary requirements and accessibility needs if you tell us, and a record of what you spent and where in the hotel.

When you enter The Ben Lomond Room

We check photo identification at the door and record only that a check was made, not the document. Closed-circuit television covers the gaming room, its entrance and the cash desk; that is a requirement of our licence. If you make a self-exclusion order we record your name, photograph and the period of the order, and nothing else about you.

When you use this website

Server logs record your IP address, browser and the pages requested. Essential cookies remember your age confirmation and your cookie choices. Analytics and marketing cookies run only if you switch them on — see the Cookie Policy.

02

Why we collect it

• To answer your enquiry and to hold and service your booking.
• To meet obligations we cannot decline: the Gambling Act 2003 and our DIA licence conditions, the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 above certain thresholds, tax law, and the Sale and Supply of Alcohol Act 2012.
• To keep guests and staff safe, which is why there is CCTV in public areas.
• To send you offers, but only if you asked us to.

03

Who else sees it

Our payment provider, our property management system supplier, our email provider, and — where a package includes them — the transfer, cruise or treatment operator who has to know your name and the time. Each is bound to use the information only for that purpose.

We also disclose information where the law requires it: to the Department of Internal Affairs as a condition of our gambling licence, to the New Zealand Police on a lawful request, and to Inland Revenue. We do not sell personal information to anyone, ever.

Our systems are hosted in New Zealand and Australia. Where information leaves New Zealand we take reasonable steps to ensure comparable safeguards, as principle 12 requires.

04

How long we keep it

Enquiries that do not become bookings	12 months
Booking and stay records	7 years, as tax law requires
CCTV	31 days, then overwritten, unless held for an investigation
Self-exclusion records	The period of the order, then 2 years
Marketing consent	Until you withdraw it, then a record that you did
Website server logs	90 days

05

Your rights

Under principles 6 and 7 of the Privacy Act 2020 you may ask what we hold about you and ask us to correct it. Write to [email protected] or to the Privacy Officer at 88 Frankton Road, Queenstown 9300, Otago, New Zealand. We respond within 20 working days, which is the statutory limit, and usually much sooner. There is no charge.

You may withdraw marketing consent at any time from the link in any email we send, or by telling the front desk. It takes effect immediately.

06

If we get it wrong

Tell us first — the Privacy Officer, at the addresses above. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner: privacy.org.nz, 0800 803 909. The Commissioner is independent of us and the complaint is free.

If a privacy breach occurs that is likely to cause serious harm, we will notify you and the Commissioner as Part 6 of the Act requires.