Privacy Policy
Last updated: 1 June 2025
1. Introduction
("we", "us", "our") operates the hotel and casino resort known as Merquorianroyalretreat, located at , and the accompanying website at merquorianroyalretreat.com (the "Website"). We are committed to protecting the privacy and personal information of every person who visits or interacts with our Website. This Privacy Policy explains how we collect, use, disclose, store and protect your personal information, and describes the rights you hold under New Zealand law.
This policy applies exclusively to personal information collected through merquorianroyalretreat.com. It should be read together with any supplementary notices displayed at the point of collection.
2. Data Controller
The data controller responsible for your personal information is:
| Legal entity | |
|---|---|
| Registered address | |
| Company number | 9638472 |
| GST number | 236-948-721 |
| Privacy enquiries | privacy@merquorianroyalretreat.com |
3. Personal Information We Collect
We collect personal information only to the extent necessary for the purposes described in this policy. The categories below describe what we collect through the Website.
3.1 Information You Provide to Us
- Contact and identification details: your full name, email address, postal address and any other details you voluntarily submit via enquiry forms, reservation-request forms or correspondence sent to us through the Website.
- Reservation-request data: preferred arrival and departure dates, room-type preferences, number of guests, special requests and any other information you include when submitting a reservation enquiry.
- Communications content: the content of messages, feedback or complaints you send us through the Website's contact channels.
- Age-verification data: where required in connection with casino-related enquiries, a declaration or confirmation that you are aged 18 or over, in accordance with the minimum age requirement applicable to our casino facilities.
- Special-category personal data: we do not actively solicit special-category personal data through the Website. If you voluntarily include such information (for example within a special-request field), we will process it only to the extent strictly necessary to fulfil your request and will treat it with enhanced care.
3.2 Information Collected Automatically
- Device and technical data: IP address, browser type and version, operating system, device type and screen resolution.
- Usage and navigation data: pages visited, time and date of access, referring URL, session duration and clickstream data.
- Cookie and similar technology data: identifiers set by cookies or comparable technologies on your device, as further described in Section 5 below.
4. Purposes and Legal Bases for Processing
New Zealand's Privacy Act 2020 requires us to collect personal information only for a lawful purpose directly connected to our functions or activities, and only to the extent necessary for that purpose. The table below sets out each purpose for which we process your personal information and the corresponding legal basis.
| Purpose | Description | Legal basis (Privacy Act 2020) |
|---|---|---|
| Responding to enquiries and reservation requests | To receive, process and respond to your enquiries and reservation-request submissions, including confirming availability and communicating reservation details. | Directly related purpose — necessary to take steps at your request prior to entering into a booking agreement. |
| Managing the guest relationship | To manage correspondence, handle complaints and maintain accurate records of your interactions with us. | Legitimate purpose — necessary for the ongoing management of our relationship with guests and prospective guests. |
| Casino age compliance | To record and verify that persons enquiring about casino facilities meet the minimum age requirement of 18 years. | Legal obligation — compliance with the applicable statutory requirements governing casino access in New Zealand. |
| Website operation and security | To maintain the technical operation, security and integrity of the Website, including fraud prevention, error detection and performance monitoring. | Legitimate purpose — necessary to protect the Website, our systems and our users. |
| Analytics and improvement | To understand how visitors use the Website, identify areas for improvement and measure the effectiveness of our content, using aggregated or pseudonymised data where possible. | Legitimate purpose — to improve the quality and relevance of our Website, balanced against the privacy interests of users. |
| Consent-based processing | Where you have given specific consent (for example, to receive promotional communications about the resort), we will process your personal information for that stated purpose. | Consent — you may withdraw consent at any time by contacting privacy@merquorianroyalretreat.com. |
| Legal and regulatory compliance | To comply with our legal obligations, respond to lawful requests from public authorities and enforce our terms and conditions. | Legal obligation and authorised purpose — required under applicable New Zealand law. |
6. Disclosure of Personal Information
We do not sell your personal information to third parties. We may share your personal information with the following categories of recipients, strictly to the extent necessary for the purposes described in this policy:
- Service providers and technology partners: organisations that provide hosting, IT support, website analytics, email delivery and related services on our behalf, under contractual obligations to handle your personal information only as instructed by us and in accordance with applicable privacy law.
- Professional advisers: solicitors, accountants and auditors who are bound by professional confidentiality obligations.
- Regulatory and public authorities: government agencies, regulatory bodies or law-enforcement authorities where we are required or permitted to do so by law, or where necessary to protect the rights, property or safety of , our guests or the public.
- Business successors: in the event of a merger, acquisition, restructuring or sale of all or part of our business, personal information may be transferred to the relevant successor entity, subject to equivalent privacy protections.
Where we engage service providers to process personal information on our behalf, we enter into written agreements that require them to implement appropriate security measures and to process personal information only for the specified purposes.
7. International Transfers of Personal Information
is based in New Zealand. Some of our service providers may be located in, or operate systems in, countries outside New Zealand. Where personal information is transferred to a recipient in another country, we take steps to ensure that such transfers comply with Information Privacy Principle 12 of the Privacy Act 2020 and that your personal information receives a comparable level of protection to that afforded within New Zealand.
These steps may include confirming that the destination country has been assessed as providing comparable privacy safeguards, or incorporating contractual clauses that require the overseas recipient to protect your personal information consistently with the Privacy Act 2020.
By submitting personal information through our Website, you acknowledge that such transfers may occur in the circumstances described above.
8. Retention of Personal Information
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required or permitted by law. The factors we consider when determining the appropriate retention period include:
- the nature and sensitivity of the personal information;
- the purpose for which it was collected and whether that purpose has been fulfilled;
- our legal and regulatory obligations, including accounting and record-keeping requirements;
- limitation periods applicable to potential legal claims; and
- any contractual commitments we have made.
| Category of personal information | General retention period |
|---|---|
| Reservation-request and enquiry data | Duration of the enquiry or reservation process, plus 7 years for accounting and compliance purposes where a booking is confirmed. |
| General correspondence and communications | 3 years from the date of last contact, unless a longer period is required by law. |
| Casino age-verification records | As required by applicable statutory obligations. |
| Website analytics and log data | Up to 26 months from the date of collection, in aggregated or pseudonymised form. |
| Consent records | Retained for the duration of the consent and for a period thereafter sufficient to demonstrate compliance with our consent obligations. |
When personal information is no longer required, we securely delete or anonymise it in accordance with our internal data-retention procedures.
9. Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure. These measures are proportionate to the nature of the personal information held and the risks associated with its processing.
Whilst we take the security of your personal information seriously, no method of transmission over the internet or electronic storage is entirely secure. We encourage you to take care when submitting personal information online and to notify us promptly at privacy@merquorianroyalretreat.com if you have any concerns about the security of your interaction with our Website.
In the event of a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals in accordance with the mandatory notification obligations under the Privacy Act 2020.
10. Your Privacy Rights
Under the Privacy Act 2020, you have the following rights in relation to personal information we hold about you:
10.1 Right of Access
You have the right to request access to personal information we hold about you. We will respond to such requests within 20 working days of receipt, as required by the Privacy Act 2020. We may ask you to verify your identity before processing your request.
10.2 Right of Correction
If you believe that personal information we hold about you is inaccurate, incomplete, misleading or not up to date, you may request that we correct it. Where we agree that correction is warranted, we will make the correction as soon as reasonably practicable. Where we do not agree, we will note your request for correction alongside the relevant information.
10.3 Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
10.4 Right to Object
You may object to processing of your personal information carried out on the basis of our legitimate purposes. We will consider your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
10.5 How to Exercise Your Rights
To exercise any of the rights described above, please contact us in writing at:
Privacy OfficerEmail: privacy@merquorianroyalretreat.com
We will acknowledge your request promptly and respond within the timeframes required by applicable law. We will not charge a fee for processing a request unless it is manifestly unfounded or excessive, in which case we will notify you before proceeding.
11. Casino Access and Minimum Age
Access to our casino facilities is restricted to persons who are 18 years of age or older, in accordance with the minimum age requirements applicable under New Zealand law. Where you submit an enquiry relating to our casino facilities through the Website, we may collect an age-verification declaration for the purpose of compliance with this requirement. Personal information collected for this purpose is handled in accordance with this Privacy Policy.
We do not knowingly collect personal information from persons under the age of 18 through any part of our Website. If you believe that we have inadvertently collected such information, please contact us immediately at privacy@merquorianroyalretreat.com so that we can take appropriate steps.
12. Responsible Gaming Resources
The New Zealand Government provides publicly available guidance and support resources in connection with gambling. The Department of Internal Affairs administers gambling-related regulation in New Zealand and publishes information about responsible gambling practices, self-exclusion tools and avenues for raising concerns. Independent community organisations also provide confidential support services accessible to the public.
We encourage any person who has concerns about gambling behaviour — whether their own or someone else's — to access these publicly available resources. We do not collect or process personal information submitted to third-party support services.
13. Third-Party Websites and Links
Our Website may contain links to third-party websites. This Privacy Policy applies only to merquorianroyalretreat.com. We are not responsible for the privacy practices of any third-party website and encourage you to review the privacy policies of any external sites you visit.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements or best practice. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
Continued use of the Website following the posting of any changes constitutes your acknowledgment of the updated policy.
15. Complaints and the Office of the Privacy Commissioner
If you have a concern or complaint about how we have handled your personal information, we encourage you to contact us in the first instance so that we can seek to resolve the matter promptly:
Privacy OfficerEmail: privacy@merquorianroyalretreat.com
We will acknowledge your complaint within 5 working days and endeavour to provide a substantive response within 20 working days. If we require additional time, we will keep you informed.
If you are not satisfied with our response, or if you prefer to raise your concern directly with an independent authority, you have the right to contact the Office of the Privacy Commissioner of New Zealand. The Office of the Privacy Commissioner is the independent statutory body responsible for oversight of the Privacy Act 2020 and provides a free complaints resolution service. Further information is available at www.privacy.org.nz.
16. Contact Us
If you have any questions about this Privacy Policy or our data-handling practices, please contact our Privacy Officer:
Privacy OfficerEmail: privacy@merquorianroyalretreat.com