Privacy Policy

Last reviewed 1 June 2026 · Version 3.0

Who we are

White Heath Estate Limited (NZBN 9429048612703) trades as White Heath at 41 Royal Terrace, Dunedin 9016, Otago, New Zealand. We are the agency responsible for the personal information described in this policy, and we handle it under the Privacy Act 2020 and its thirteen information privacy principles.

Privacy Officer

The Privacy Officer, White Heath Estate Limited, 41 Royal Terrace, Dunedin 9016, Otago · [email protected] · +64 3 477 2814

What we collect, and why

We collect only what we need to run a hotel and a licensed gaming lounge. We collect it directly from you wherever we can.

Enquiries and bookings

Name, email address, telephone number, dates, number of guests, and anything you choose to tell us in the message box. Used to answer you, to hold a reservation, and to make your stay work — a quiet room, a level entrance, an anniversary.

Staying in the house

Address, payment card details (processed by our payment provider; we do not store full card numbers), vehicle registration if you use the drive, dietary and accessibility requirements, and the account you run up while you are here.

Entering the Signal Room

Your date of birth and the type of identification shown, checked at the door. We record that a check was made; we do not keep a copy of your document. Where an exclusion order exists we hold a photograph taken with consent, used only so that door staff can recognise the person concerned.

Closed-circuit television

The Signal Room, the lobby, the corridors, the drive and the entrances are recorded. Footage is held for 31 days and then overwritten, unless it has been retained for a specific incident. It is used for the safety of guests and staff, for host responsibility, and to meet our obligations under the Gambling Act 2003.

This website

If you accept analytics cookies, aggregate counts of pages viewed. If you do not, nothing beyond what the server needs to send you the page. There is no advertising network on this site and no social tracking pixels. See the Cookie Policy.

If you ask for our emails

Your name and email address, used to send about six emails a year about rooms, dining and packages. Every one of them carries an unsubscribe link that works on the first click.

What we do not do

• We do not sell personal information, ever, to anyone.
• We do not share your details with advertising networks or data brokers.
• We do not use gambling behaviour to target marketing, and we do not market gambling to anyone by email.
• We do not tell a family member whether a particular person has been in the gaming lounge.
• We do not take payment through this website; the enquiry form does not confirm a booking.

Who else sees it

Personal information is disclosed only where it is necessary, and only to:

• Our staff, to the extent their job requires it. Gaming records are visible to gaming staff and management, not to housekeeping or the dining room.
• Service providers who work for us under contract — the payment processor, the reservation system, the email provider, our accountants — each bound to use the information only for the service they provide.
• The Department of Internal Affairs, where required under the Gambling Act 2003.
• The New Zealand Police or another authority, where we are required by law or where there is a serious threat to someone's life or health.

Our reservation and email systems are operated by providers who store data in New Zealand and Australia. Where information is held outside New Zealand we satisfy ourselves that comparable safeguards apply, as principle 12 of the Privacy Act 2020 requires.

How long we keep it

Enquiries that do not become bookings

12 months.

Booking and stay records

7 years, as our tax obligations require.

CCTV

31 days, unless retained for a specific incident.

Gaming incident and duty log records

7 years, as required under the Gambling Act 2003.

Exclusion orders

The term of the order, plus 2 years.

Marketing list

Until you unsubscribe, and then a record of the unsubscribe so that we do not add you back.

Keeping it safe

Access is limited to staff who need it for their work. Systems are password-protected with multi-factor authentication, records held on paper are locked, CCTV is on a closed system that is not connected to the guest network, and this website is served over HTTPS. If a privacy breach occurs that is likely to cause serious harm, we will notify the affected people and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.

Your rights

Under principles 6 and 7 of the Privacy Act 2020 you may ask us for a copy of the personal information we hold about you, and you may ask us to correct it if it is wrong. Write to the Privacy Officer at the address above. We do not charge, and we will reply within 20 working days. We may ask you to confirm your identity first — usually the booking reference and one other detail is enough.

You may also ask us to delete information we no longer need, and to stop sending you marketing at any time.

Complaints

If you are unhappy with how we have handled your information, write to the Privacy Officer and we will investigate. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner:

Changes

We review this policy each June. If we change it in a way that materially affects you, we will say so on this page and change the version number above.