Privacy Policy

1. Data Controller

The data controller responsible for personal information collected through delvessianluxemanor.com (the "Website") is:

References in this Policy to "we", "us" or "our" are references to Delvessianluxemanor Ltd. This Policy governs personal information we collect and use in connection with your interactions on the Website. It does not govern information collected through other channels unless this Policy is expressly referenced at the point of collection.

2. Applicable Legal Framework

We comply with the Privacy Act 2020 (New Zealand) and its Information Privacy Principles ("IPPs"). Where visitors access the Website from other jurisdictions, we apply the higher standard of protection where reasonably practicable. This Policy uses plain language consistent with the Privacy Act 2020.

3. Personal Information We Collect

We collect personal information that you provide directly, that is generated automatically by your device when you use the Website, or that we receive when you interact with our services. The categories we collect are set out below.

3.1 Contact and Reservation-Request Information

When you submit an enquiry, accommodation or facilities reservation request, or any other form on the Website, we may collect:

• Full name
• Email address
• Telephone number
• Postal address (where provided)
• Arrival and departure dates
• Room type and occupancy preferences
• Special requests and accessibility requirements
• Payment card details (processed via our secure payment gateway; we do not store full card numbers)
• Any other information you voluntarily include in a message or enquiry field

3.2 Casino-Related Age and Identity Information

Our property operates a licensed casino. Guests wishing to access casino facilities must be aged 18 years or over. Where you indicate an intention to use casino facilities through the Website (for example, by requesting specific gaming packages), we may collect date of birth or age-verification information. Full identity verification takes place on-property in accordance with applicable gaming laws.

3.3 Account and Profile Information

If you create a guest account on the Website, we collect the information you provide at registration, including your chosen username, password (stored in hashed form), and preferences you save to your profile.

3.4 Device, Technical and Usage Information

When you visit the Website, certain information is collected automatically from your device and browser, including:

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Referring URL
• Pages viewed and navigation path
• Time and date of visit
• Session duration

3.5 Cookie and Consent Data

We use cookies and similar technologies on the Website. When you interact with our cookie consent mechanism, we record your choices (accepted, declined or customised categories) together with a timestamp and a session identifier so that we can honour your preferences consistently and demonstrate compliance. See Section 7 for further detail on cookies.

3.6 Correspondence

If you contact us by email or through a contact form, we retain a record of that correspondence, including any personal information contained in your message and our response.

3.7 Special-Category Personal Data

We do not seek to collect special-category personal data through the Website. If you voluntarily include such information in a free-text field (for example, an accessibility request), we will handle it with enhanced care and use it only for the purpose for which you provided it. We will not use it for any other purpose without your explicit consent.

4. Purposes for Which We Use Your Information

We use personal information only for the purposes described in this Policy. The table below sets out each purpose, the categories of information used and the legal basis under the Privacy Act 2020.

We will not use your personal information for a purpose that is incompatible with the purpose for which it was collected without first informing you and, where necessary, obtaining your consent.

5. Disclosure of Your Personal Information

We do not sell, rent or trade your personal information. We may share it with the following categories of recipient only to the extent necessary for the purposes described in Section 4.

5.1 Service Providers

We engage third-party service providers who process personal information on our behalf and under our instructions, including:

• Payment processing and card-scheme operators
• Reservation management system providers
• Website hosting and content delivery providers
• IT security and analytics providers
• Email and communications service providers

All such providers are required, by contract, to protect your information with standards no less protective than those in this Policy, and to use it only for the specified purpose.

5.2 Professional Advisers

We may share personal information with our lawyers, auditors and insurers where necessary for the provision of professional services or for the establishment, exercise or defence of legal claims.

5.3 Regulatory and Law Enforcement Bodies

We may disclose personal information to government authorities, regulatory bodies or law enforcement agencies where we are required or permitted to do so by applicable law, including for the purposes of complying with gaming regulations applicable to our casino operations.

5.4 Business Transfers

In the event of a sale, merger, restructuring or acquisition involving Delvessianluxemanor Ltd, personal information held by us may be transferred to the relevant parties as part of that transaction. We will take reasonable steps to ensure that your privacy interests continue to be protected.

6. International Transfers of Personal Information

Delvessianluxemanor Ltd is based in New Zealand and the Website is operated from New Zealand. However, some of our service providers are located in, or store data on servers in, countries other than New Zealand. Where personal information is transferred outside New Zealand, we take steps to ensure that it receives a comparable level of protection to that required by the Privacy Act 2020. These steps may include:

• Entering into contractual arrangements with the overseas recipient that require them to protect the information consistently with the Privacy Act 2020;
• Transferring to a country whose privacy laws the Privacy Commissioner has recognised as providing comparable safeguards; or
• Relying on your consent, obtained before transfer, where the above mechanisms are not available and the transfer is necessary to fulfil your request.

By submitting personal information through the Website, you acknowledge that such transfers may occur in accordance with this Section.

7. Cookies and Similar Technologies

The Website uses cookies and similar tracking technologies to operate correctly, remember your preferences and understand how visitors use the Website. Cookies are small text files stored on your device.

When you first visit the Website, you will be presented with our cookie preference centre, where you can accept all cookies, reject non-essential cookies or customise your choices by category. You may update your preferences at any time by returning to the cookie settings link in the website footer. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal.

You may also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website.

8. Retention of Personal Information

We retain personal information only for as long as is necessary to fulfil the purposes described in this Policy, to comply with legal and regulatory obligations, and to resolve disputes or enforce our agreements. The following indicative retention periods apply:

When personal information is no longer required, we securely delete or anonymise it. Where anonymisation is not practicable, we will restrict further processing pending secure deletion.

9. Security of Your Personal Information

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, disclosure, alteration, loss or destruction. These measures include:

• Encrypted transmission of data over public networks using industry-standard TLS protocols;
• Secure storage of personal information with access controls limited to authorised personnel;
• Regular security assessments and vulnerability monitoring;
• Staff training on privacy and information security obligations;
• Contractual obligations on service providers to maintain equivalent security standards.

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at privacy@delvessianluxemanor.com.

In the event of a privacy breach that is likely to cause serious harm to individuals, we will notify the New Zealand Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

10. Your Privacy Rights

Under the Privacy Act 2020, you have the following rights in relation to the personal information we hold about you.

10.1 Right of Access

You have the right to request confirmation of whether we hold personal information about you, and to request a copy of that information, subject to certain exceptions permitted by law (for example, where disclosure would prejudice the prevention, detection or investigation of a criminal offence, or would unreasonably disclose the personal information of another individual).

10.2 Right of Correction

If you believe that personal information we hold about you is inaccurate, incomplete, misleading or not up to date, you have the right to request correction. We will take reasonable steps to correct the information, or, where we decline to make the correction, to attach a statement of the correction sought but not made.

10.3 Right to Withdraw Consent

Where we process your personal information on the basis of your consent (for example, for marketing communications or non-essential cookies), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw consent by:

• Clicking the unsubscribe link in any marketing email;
• Adjusting your cookie preferences via the cookie settings link in the Website footer; or
• Contacting us at privacy@delvessianluxemanor.com.

10.4 Right to Raise Concerns

You have the right to raise concerns about our handling of your personal information. Please see Section 12 for information on how to do so.

10.5 Making a Request

To exercise any of the rights described above, please contact us in writing at privacy@delvessianluxemanor.com. We may need to verify your identity before processing your request. We will respond within 20 working days of receiving a valid request, as required by the Privacy Act 2020. There is no fee for making an access or correction request; however, if a request is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or decline the request in accordance with the Act.

11. Minimum Age and Children's Privacy

The Website is not directed at children under the age of 18. In particular, guests must be 18 years of age or over to access casino facilities at the property. We do not knowingly collect personal information from individuals under the age of 18 through the Website. If you believe that a person under 18 has submitted personal information to us, please contact us at privacy@delvessianluxemanor.com and we will promptly take steps to delete that information.

12. Complaints and Concerns

If you have a concern about the way in which we have handled your personal information, we encourage you to contact us in the first instance so that we can address your concern directly:

We will acknowledge your complaint within five working days and endeavour to provide a substantive response within 20 working days. If you are not satisfied with our response, or if we have not responded within that timeframe, you have the right to make a complaint to the Office of the Privacy Commissioner of New Zealand:

• Website: www.privacy.org.nz
• Post: Office of the Privacy Commissioner, PO Box 10094, Wellington 6143, New Zealand

You may also request that the Privacy Commissioner investigate your complaint under Part 5 of the Privacy Act 2020. Lodging a complaint with us first is not a prerequisite to contacting the Privacy Commissioner; you may approach the Commissioner directly at any time.

13. Third-Party Links

The Website may contain links to third-party websites. This Policy applies solely to personal information collected through the Website. We are not responsible for the privacy practices of any third-party website and encourage you to review their respective privacy notices before providing any personal information to them.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Website, or applicable legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Policy periodically. Your continued use of the Website following the posting of a revised Policy constitutes your acknowledgement of the changes.

15. Contact Us

If you have any questions about this Privacy Policy or about how we handle your personal information, please contact our Privacy Officer: