Policies
Privacy Notice
Written under the Privacy Act 2020. It applies to this website, to the hotel, and to anybody who writes to us or stays with us.
In force from 1 February 2026
1. Who holds your information
Red Timbers Hospitality Ltd, NZBN 9429046172584, of 118 Dyers Pass Road, Cashmere, Christchurch 8022, Canterbury, New Zealand, trading as Red Timbers. We are the agency responsible for the personal information described here under the Privacy Act 2020. Questions and requests go to the general manager at [email protected] or +64 3 337 4180.
2. What we collect, and when
When you send an enquiry from this site: your name, email address, telephone number if you give one, the subject you chose, the dates and number of people if you gave them, and whatever you wrote in the message box. The form also records the moment it was opened, which is used only to tell a person from a script.
When you book or stay: the above, plus the address you give at check-in, your payment card details, your vehicle registration if you use the car park, dietary and accessibility requirements you choose to tell us, and the account of what you spent here.
When you eat, drink or use the bath house: a booking name and a contact number, and any health information you volunteer to the therapists so a treatment can be done safely.
When you visit this website: the pages requested, the time, the browser, and a truncated network address, held in the server log. Cookies are covered separately in the Cookie Notice.
We do not buy lists, we do not enrich what you give us from other sources, and we do not build a profile of you from other websites.
3. Why we hold it
- To answer an enquiry and to make, hold and honour a booking.
- To take payment and to keep the accounting records the Inland Revenue requires.
- To meet the obligations of the Sale and Supply of Alcohol Act 2012, the Gambling Act 2003 and the Food Act 2014.
- To keep guests and staff safe, and to deal with damage, injury or an incident on the premises.
- To send the occasional note about offers — only if you ticked the box, and only until you tell us to stop.
We do not use automated decision-making, and no algorithm here decides whether you get a room or a rate.
4. Who else sees it
Only those who have to. Our payment processor sees card data and we do not; our email is hosted in New Zealand by a New Zealand provider; our property management system is operated by a supplier under a written contract that forbids any other use of your information. A travel agent or company that booked on your behalf sees the booking they made and nothing else.
We disclose personal information to the Police, the Department of Internal Affairs, a licensing inspector or a court where the law requires it, and we tell you when we have done so unless we are forbidden to. We never sell personal information, and we do not pass it to an advertiser.
5. How long it is kept
| Enquiries that came to nothing | Twelve months, then deleted. |
|---|---|
| Booking and stay records | Seven years, because the Inland Revenue requires the financial record. |
| Mailing list | Until you unsubscribe, and the unsubscribe link is in every message. |
| Camera footage | Thirty days, then overwritten, unless it has been kept for a specific incident. |
| Gaming exclusion records | The term of the order plus two years, as the venue licence requires. |
| Server logs | Ninety days. |
6. How it is protected
This site is served over HTTPS. The property system needs a named login with two factors and it logs who looked at what. Paper — registration cards, event agreements, exclusion forms — is locked in the back office and shredded on the schedule above. Staff see what their job requires and no more, and access is removed on the day someone leaves.
If a breach happens that is likely to cause serious harm, we notify the people affected and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires, and we say what went wrong rather than what it might have been.
7. The gaming room
Identification shown at the door of The Rimu Room is looked at and handed back. It is not photographed, scanned or recorded, and no register of who entered the room is kept.
Where a person applies to be excluded, or is excluded by the venue, we hold the form, the term and the reason. That record is confidential to the duty manager and the door staff, it is kept apart from hotel booking records, and it is never used for marketing.
8. Cameras
Cameras cover the entrances, the car park, the corridors, the cage in The Rimu Room and the loading door. They do not cover guest rooms, bathrooms, the pools, the changing rooms or the treatment rooms. Signs mark the areas that are covered. Footage is held thirty days and is viewed only after an incident, by the general manager or the duty manager.
9. Your rights, and how to use them
Under the Privacy Act 2020 you may ask for a copy of the personal information we hold about you, and you may ask us to correct it if it is wrong. Write to [email protected]. We answer inside twenty working days, at no charge, and we will ask you to prove who you are before we send anything.
If we decline a request we say which part of the Act allows that and how to challenge it. If you are not satisfied with how we have handled your information, you may complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909, and you do not need to come to us first.
10. Changes to this notice
When this notice changes the date at the top changes with it. A change that affects how we use information already collected is notified by email to anybody on the mailing list before it takes effect.