Privacy Policy

This policy explains what personal information Oceanic Manor Hospitality Ltd, trading as Oceanic Manor, collects about you, why we collect it, who sees it and how long we keep it. We are bound by the Privacy Act 2020 and the thirteen information privacy principles in it. Last reviewed February 2026.

01 — Who we are

Oceanic Manor Hospitality Ltd (NZBN 9429041807265), 118 Marine Parade, Mount Maunganui 3116, New Zealand. We are the agency responsible for the information described here. Our privacy officer can be reached at [email protected] or on +64 7 575 4180.

02 — What we collect, and why

When you make a booking or send an enquiry:

• Your name, email address and phone number — so we can answer you and hold the booking
• What the enquiry is about, the dates and the number of guests — so we can answer it usefully
• Anything you tell us in the message box — a late arrival, a quiet floor, a cot, an anniversary
• Whether you confirmed you are 20 or older, and whether you agreed to this policy
• Whether you asked to be kept updated

When you stay:

• A billing address and payment card details, taken to guarantee and settle the room
• Dietary requirements and accessibility needs, if you give them to us — some of this is health information, which the Act treats as more sensitive, and we treat it that way too
• Vehicle registration, if you use the car park
• What you charged to the room

When you enter The Beacon Room:

• We sight photo ID to confirm you are 20 or over. We check it and hand it back — we do not scan it, photograph it or keep a copy
• If you self-exclude, we hold your name and a photograph taken with your consent, for as long as the exclusion runs. This is the one place we keep an image of a guest, and it exists only so that the door can honour your own request
• CCTV covers the gaming floor, as our licence requires. Recordings are held 31 days and then overwritten

When you use this website:

• Your cookie choice and your answer to the age check, stored in your browser
• If you consent to analytics: which pages were read and for how long, never tied to your name
• Standard server logs — IP address, browser, time — kept 30 days for security

We collect all of it directly from you, except CCTV. We do not buy lists, and we do not build a profile of you from anywhere else.

03 — What we will not do

• We do not sell personal information. Not to anyone, at any price.
• We do not share what you tell us with other guests, including someone you are staying with. If you ask us to keep something private, we keep it private.
• We do not use gaming activity to target marketing at you.
• We do not send marketing you did not tick a box for.

04 — Who else sees it

Only where it is necessary, and only what is necessary:

• Our payment provider, to process a card. We never see or store the full card number ourselves.
• Our booking system and email provider, both under contract, both required to protect it and to use it for nothing else.
• A supplier fulfilling something you asked for — a transfer driver gets your name and flight, a therapist at The Saltwater Bathhouse gets what they need to treat you safely.
• The Department of Internal Affairs, where gambling law requires us to produce records.
• Police or a court, where we are legally obliged, or where someone's safety is at risk.

Some of these providers store data on servers outside New Zealand, including Australia and the United States. Where they do, we satisfy ourselves that the information will be protected to a standard comparable to the Privacy Act, as principle 12 requires.

05 — How long we keep it

• Enquiries that did not become bookings: 12 months
• Booking and billing records: 7 years, because tax law requires it
• Dietary and accessibility notes: deleted 3 months after your stay unless you ask us to keep them for next time
• Marketing list: until you unsubscribe, and then we keep only the fact that you unsubscribed
• CCTV: 31 days
• Self-exclusion records: for the length of the exclusion, then 12 months, then destroyed
• Server logs: 30 days

06 — Keeping it safe

Access is limited to staff who need it for their job. Systems are password protected with two-factor authentication, connections are encrypted, and paper records — there are still a few — are locked in the back office. Staff are trained on this at induction, and a breach that could cause serious harm is notified to the Office of the Privacy Commissioner and to you, as the Act requires.

07 — Your rights

Under the Privacy Act 2020 you may:

• Ask what we hold about you, and get a copy. Free, and answered within 20 working days.
• Ask us to correct it if it is wrong. If we disagree, we will attach your statement of correction to the record, which is your right.
• Withdraw marketing consent at any time — the unsubscribe link, or one email to us.
• Ask us to delete what we are not legally required to keep.
• Complain, to us first if you are willing, and to the Privacy Commissioner whether or not you come to us first.

Write to [email protected]. We may ask you to confirm who you are before we hand over personal information, which is for your protection rather than our convenience.

08 — Complaining to the regulator

The Office of the Privacy Commissioner takes complaints about privacy in New Zealand: privacy.org.nz, 0800 803 909. You do not need our permission and you do not need to have complained to us first.

09 — Changes

If we change this policy in a way that matters, we will say so on this page and change the review date at the top. The version in force is always the one published here.