Our privacy policy

Tourism Waitaki Limited (“us”, “we” or “our”) operates Ōamaru Penguins. In this Privacy Policy (Policy), “you” and “your” means the individual providing Personal Information to us.

This Policy provides information in relation to the basis upon which we collect, hold, use and disclose your Personal Information. Personal Information has the same meaning as in the Privacy Act 2020 (Act). In essence, it is information relating to an individual which can be used to identify that individual or which is linked to an identified individual.

This Policy applies to your use of the websites and services of Ōamaru Penguins (https://www.penguins.co.nz).

By accessing our websites and using our services you agree to the terms of this Policy.

1. Updates to this Policy

1.1 We will review this Policy from time to time to make sure it takes into account new laws and technology, and any changes to how we operate.

1.2 Should we decide to change our Policy we will post all changes on our website so that you are always kept up to date.

1.3 Use and disclosure of Personal Information collected from you is subject to the Policy in effect at the time such Personal Information is collected, unless otherwise agreed.

2. Collection of Personal Information

2.1 The Personal Information we collect and hold includes (but is not limited to): your name, email address, postal address, phone number and payment information. We may also collect any personal information contained in the content of your communications with us.

2.2 We collect your Personal Information when you provide it to us, including when you contact us (whether in person, over the phone, via email, through our websites, or through our social media accounts) or when you interact with the communications we may send.

2.3 Our websites may automatically collect information about your access to our websites, including time of access, IP address, browser type, any third party website where you clicked a link to our websites, pages on our websites where you click links and device identifiers.

2.4 Your Personal Information may also be collected from third parties you authorise us to contact, or by agents who are authorised by you to provide such information, or as otherwise permitted by the Act.

2.5 If you do not provide the Personal Information that we ask you to provide, or the information is incorrect, we may not be able to provide the requested products or services to you, register you as a member, respond to an enquiry, or contact you (including to provide an update to a requested service).

2.6 If you contact us or access our website from outside of New Zealand, you agree that any Personal Information you provide us is subject to this Policy and the Act.

3. Third Parties

3.1 If you provide Personal Information relating to another individual, you warrant you are authorised to do so and that you have ensured the individual is aware of the information in this Policy. If you provide us Personal Information about others, or if others give us your information, we will only use that information for the specific reason for which it was provided to us.

3.2 We also use social media services like Instagram, Facebook and YouTube in relation to each of the operations on our websites. These services may be linked to our websites through the use of social media buttons. Your use of these third party services is entirely optional.

3.3 Information posted publicly on these and other social media platforms and third party websites such as tripadvisor.com are all available for others to see. We may collect, hold and make use of any information that relates to our business that you make public when you use any such third party websites for the purposes of our business.

3.4 All third party services are governed by the privacy policies and/or practices of the relevant third party, for which we are not responsible. If you do not want to provide Personal Information to any of those third parties, or make information publicly available, you should not use their particular service.

4. Purposes for which we collect and use your Personal Information

4.1 We may collect and use your Personal Information for the following purposes:

4.1.1 to communicate with you, which includes responding to any message or enquiry from you and identifying you when you want to communicate with us;

4.1.2 to conduct our business, which may include reviewing, analysing and improving our own processes;

4.1.3 to manage your memberships and bookings, and to provide you with the products and services you have requested, for example, to manage your OBPC booking or penguin adoption;

4.1.4 to comply with our legal obligations;

4.1.5 to send you surveys so we can get your feedback on our products and services;

4.1.6 to send you our newsletters, to keep you updated with our services, and to provide you with our marketing material from time to time (where you have signed up to receive these marketing communications). We only provide you marketing material from the business unit you have signed up to receive marketing communications from;

4.1.7 for us or other authorised agencies to detect, investigate, prevent or address fraud, security or technical issues;

4.1.8 to optimise your experience as a customer of our services and/or as a user of our websites; and

4.1.9 any other purpose made known to you when collecting the Personal Information.

4.2 Other sections of this Policy also set out other specific situations in which your personal information is collected, held, used and disclosed.

4.3 We may use and disclose your personal information for any of these purposes, or for any other purpose authorised by you or by the Act and any other applicable privacy laws.

5. Cookies

5.1 Our websites may use cookies or similar technologies. A cookie is a small data file stored on a device with a web browser (eg computer or iPad). It can contain information about your device, your IP address, your session, and the online activity on our websites of anyone using your device.

5.2 We currently use functional/required and analytics/performance cookies.

5.3 Functional and required cookies are always used, which allow us to provide the functionality of the websites to you. Analytics and performance cookies are used on our websites to view site traffic, activity and other data. We currently use Google Analytics for analytics purposes.

5.4 While Google is primarily collecting data on our behalf, it may also use the data which is collected for its legitimate business interests, including to improve its own services, and to maintain the security of its systems. To understand the ways that Google Analytics may use your data, please read their policy available here.

5.5 If you do not agree to the use of cookies, or would like to block some or all of the cookies on our website, you can manually disable or reject the use of cookies through your internet browser.

5.6 If you disable or reject the use of cookies, some functionality on our website may not be available.

6. Marketing Communications and Disclosure of Personal Information

6.1 We currently use GetSmart to send surveys and MailChimp to assist us in sending marketing communications. You authorise us to disclose your personal information to these third parties as set out in the “Management of Personal Information” section.

6.2 To understand the ways GetSmart and MailChimp collect, hold, use and disclose such Personal Data, please read their privacy policies:

6.3 You may unsubscribe from receiving marketing communications from us in accordance with the unsubscribe facility in any email sending you marketing communications. You may request that you are removed from our survey list by contacting us in accordance with the contact details below.

6.4 We will not be able to provide surveys or marketing communications to you if you unsubscribe or do not agree to our use of third parties to assist us with our surveys and marketing communications.

6.5 Where you sign up to receive surveys and marketing communications from us, you agree that we may disclose your Personal Information to those third parties as set out above.

6.6 We do not otherwise share your Personal Information without your consent, except where permitted by the Act, unless we believe it is necessary:

6.6.1 to enforce our terms and conditions, or where we are legally required to do so;

6.6.2 for us or other authorised agencies to detect, investigate, prevent or address fraud, security or technical issues;

6.6.3 to otherwise protect our property, legal rights, or that of others; or

6.6.4 for the purposes of carrying out the matters noted in the section below on the Management of Personal Information.

6.7 We may use and disclose your Personal Information for any of these purposes, in any circumstances authorised by the Act, or in any other manner with your consent.

7. Management of Personal Information

7.1 Except as otherwise stated in this Policy, your Personal Information we collect is held by us. Our address is set out below.

7.2 We currently use Windcave to facilitate your payments via our websites. Windcave is based in New Zealand and in other countries around the world. Windcave will provide or make available to us the information collected by it as required to enable us to confirm your payment. Any credit card details stored for payments are done so on the Windcave system. No credit card information is stored by us when you make a payment using the Windcave system. Please read Windcave’s privacy policy, available here, to understand the ways in which it collects, holds, uses and discloses such personal information.

7.3 We may use other third party providers (including technology providers, providers services and providers of software tools used by us in our business) to perform services on our behalf, to process the information for us, or hold it on our behalf. For example, we currently use Jetpack for providing website security, and IBIS to provide our online reservation system. IBIS is based in New Zealand, however other third parties we use (such as Jetpack) may be offshore. We do not authorise such parties to use personal information for their own purposes.

7.4 While we endeavour to only use third parties that protect your personal information in a way that is comparable to the safeguards in the Act, that is not always possible. You authorise us to disclose your personal information to third parties as set out in this policy even though those third parties may not be required to protect the information in a way that, overall, provides comparable safeguards to those in the Act.

8. Your Rights

8.1 You have the right of access to, and to request correction of, your Personal Information. To access or correct any of your Personal Information, please contact us as follows:

Email: bookings@penguins.co.nz

Address: 17 Waterfront Road, Oamaru 9400

8.2 We endeavour to ensure that the Personal Information we hold is accurate, complete and up-to-date. If any of the Personal Information that you have provided to us changes we encourage you to contact us to update that Personal Information.

8.3 If a dispute arises between us and we cannot resolve it with you, then you may wish to contact the Office of the Privacy Commissioner on investigations@privacy.org.nz.

9. Governing Law

9.1 This Policy is governed by the laws of New Zealand.