Your information, looked after
Your privacy
We ask for the information we need to welcome you, manage your stay and keep your account secure. This policy explains what happens to it.
Who we are
Bach NZ is operated by Time Out Holidays Ltd. We collect and hold the information described here and are responsible for handling it under New Zealand's Privacy Act 2020.
For privacy questions or requests, contact Time Out Holidays Ltd at contact@bachnz.co.nz.
What we collect and why
- Your account: your name, email address, a protected password record, verification status and sign-in information. We use these to secure your account and let you manage your bookings. Passwords are stored as hashes, not readable passwords.
- Your stay: your chosen bach, arrival and departure dates, guest numbers, contact phone number, booking reference, status, agreed terms version and changes to the booking. We use these to check availability, arrange your stay and keep an accurate record.
- Your messages: enquiries, booking correspondence and information you choose to share with us. We also keep records of account and booking emails and their delivery status so we can follow up when necessary.
- Payments arranged directly: relevant payment references, amounts and correspondence may be held in our banking and business records. This website does not collect card details or process online payments.
- Website security: technical information such as your IP address, browser information, session identifiers and request times may be processed to operate the site, prevent misuse and investigate problems.
Providing information is voluntary. You can browse our baches and calendars without an account. To request a booking online, we need the required account and booking details; without them we cannot process that request. To answer an enquiry, we need your name, email address and message. Please only include information relevant to your enquiry or stay.
Information from other people or booking channels
We may receive booking details from another booking service or a person arranging a stay for your group, and record the information needed to manage the stay and avoid double bookings. If you give us another person's details, please make sure you are authorised to do so and share this policy with them.
Where the Privacy Act requires us to notify someone about information collected from another source, we will take reasonable steps to do so as soon as practicable. This may be through the person or service arranging the booking where they have already provided the required notice.
Guest reviews displayed on this website are separate from private booking records. They may include a reviewer's published display name, review text, rating and review month, with the original booking platform identified. Contact us if you have a privacy concern about a review.
Cookies and emails
We use necessary cookies for sign-in and account security. Blocking these cookies may prevent account and booking features from working. We do not use advertising cookies, tracking pixels or third-party analytics on this website.
We send messages needed for your account, enquiries and stay. Creating an account or making a booking does not subscribe you to a marketing mailing list.
Who can receive your information
Access is limited to the people who need it to manage your booking or support our business, and the providers that operate our website and email. We use Fly.io for website hosting in Sydney, Australia, and MyHost for our domain email. Booking notifications also go to the owner's mailbox and its email provider.
Our hosting and email providers may store or process information outside New Zealand. We remain responsible for information handled on our behalf and must take reasonable steps to protect it. Where information is disclosed overseas for a recipient's own purposes, we must meet the Privacy Act's overseas-disclosure requirements.
We may share relevant information with professional advisers, insurers or authorities where needed to deal with a claim, meet a legal obligation or protect someone's safety, and only where the law permits. We do not sell your personal information or share it for targeted advertising.
Keeping information secure
We use access controls, protected sign-in and encrypted connections to help keep information secure. Public availability calendars show whether dates are available, without identifying guests. Please keep your password and account links private.
If a privacy breach causes or is likely to cause serious harm, we will notify the Privacy Commissioner and affected people as required by the Privacy Act.
How long we keep it
We keep personal information only for as long as needed for your account, booking, correspondence, legitimate business records or legal obligations. We review information we no longer need and delete or de-identify it when there is no lawful reason to retain it.
Relevant tax and accounting records generally need to be kept for at least seven years. This does not mean every account detail or enquiry needs to be kept for that period. Records needed for an unresolved complaint or claim may need to be kept until it is resolved.
You can ask us to close your account. We may still need to retain relevant booking or financial records, and will explain why. Backup copies have their own retention cycle and are kept for recovery rather than routine use. We do not promise immediate removal from every backup.
Your choices and rights
You can ask to see or correct the personal information we hold about you by emailing contact@bachnz.co.nz. We may need to check your identity before releasing it. We will respond as soon as reasonably practicable and normally within 20 working days, and explain any lawful extension or reason for withholding information.
If we do not make a correction you request, you can ask us to attach your statement of correction to the information. You can also contact us to raise a privacy concern. If it is not resolved, you can complain to the Office of the Privacy Commissioner.
Changes to this policy
We will update this page when our practices change and identify the updated version. Where a change affects how we collect or use your information, we will provide any further notice or seek any permission required by law.