Privacy

Last updated 1 July 2026

Resort Scenery Hospitality Ltd (NZBN 9429048817326), trading as Resort Scenery at 31 Esplanade, St Clair, Dunedin 9012, Otago, New Zealand, is the agency responsible for the personal information described on this page. We handle it under the Privacy Act 2020 and its thirteen information privacy principles. The Act is administered by the Office of the Privacy Commissioner.

1. What we collect

When you make a booking or send an enquiry

• Your name, email address and telephone number.
• The dates you are asking about, the number of people, and what the enquiry is about.
• Anything you write in the message field, including requests about access, dietary needs or an occasion.
• Whether you confirmed that you are 20 years of age or older, and whether you opted in to our mailing list.

When you stay

• Registration details required of every accommodation provider: name, address, arrival and departure dates, and vehicle registration if you park with us.
• Payment card details, processed by our payment provider. Full card numbers are not stored on our systems.
• Charges to the room — restaurant, bar, bathhouse, laundry. Gaming spend is never charged to a room and so never appears on a folio.

When you enter The Albion Room

• Sight of photo identification, to confirm you are 20 or over. We look at it; we do not photocopy, scan or record it.
• If you enter a self-exclusion order: your name, the term of the order, and a photograph taken with your consent. Held securely, seen only by staff on duty in the gaming room, destroyed when the order ends.
• Records of any harm-related interaction, as the Gambling Act 2003 requires.

Automatically, when you use this website

• Standard server log data: IP address, browser type, the pages requested and the time. Held 30 days for security, then deleted.
• Your cookie answer and your age answer, stored in your own browser. See the cookie page.
• A signed form token and the time the enquiry form was opened, held only for the length of the submission and used to tell a person from a script.

2. Why we collect it

• To answer your enquiry and to hold, change or cancel your reservation.
• To provide what you asked for — a room, a table, a treatment, a meeting room.
• To meet legal obligations: the Gambling Act 2003, tax and companies law, health and safety, and the record-keeping required of accommodation providers.
• To send occasional news about the hotel, but only if you ticked the box. Three or four emails a year, and one click stops them.
• To keep the premises and the people in them safe.

We do not build a profile of you, we make no automated decisions about you, and we do not sell your information to anybody.

3. Who we share it with

Only where it is necessary and only as far as necessary: our payment provider, to take payment; our email and hosting providers, who hold data on our behalf under contract; a service you asked us to book for you, such as an airport shuttle or a peninsula tour; and the Department of Internal Affairs, New Zealand Police or another regulator where the law requires it.

Some providers hold data on servers outside New Zealand. Where that is the case we satisfy ourselves that comparable safeguards apply, as principle 12 of the Act requires.

4. How long we keep it

• Enquiries that do not become bookings — 12 months.
• Booking and stay records — 7 years, which is what Inland Revenue requires of the financial record.
• Mailing list consent — until you withdraw it, plus a suppression record so we do not email you again by mistake.
• Self-exclusion records — for the term of the order and the period the Gambling Act requires, then destroyed.
• Website server logs — 30 days.
• CCTV — 31 days, then overwritten, unless it forms part of an incident under investigation.

5. CCTV

Cameras cover the entrances, the lobby, the corridors, the car park and the interior of The Albion Room. There are no cameras in bedrooms, bathrooms, treatment rooms, changing areas or at the bathhouse pools. Footage is held 31 days and can be viewed by the general manager and the duty managers only.

6. Your rights

Under the Privacy Act 2020 you may ask for a copy of the personal information we hold about you, and we will answer within 20 working days; ask us to correct it if it is wrong, and where we disagree you may require us to attach a statement of the correction sought, which we will do; withdraw mailing consent through the unsubscribe link or by telling anyone at the front desk; and complain — to us first, at [email protected], and to the Office of the Privacy Commissioner if that does not settle it. None of this costs anything.

7. Security, and what happens if it goes wrong

Access to guest data is limited to staff who need it for their role. Systems are password-protected with two-factor authentication and the site is served over HTTPS. Paper registration cards are held in a locked cabinet in the back office and destroyed on the schedule above. If a privacy breach occurs that is likely to cause serious harm, we are required to notify the Office of the Privacy Commissioner and the people affected as soon as practicable, and we will.

8. Children

This website is not directed at children and the gaming room is closed to anyone under 20. We do not knowingly collect information from children beyond the names and ages of children on a family booking, which are used only to prepare the room.

9. Contact

Privacy Officer, Resort Scenery Hospitality Ltd
31 Esplanade, St Clair, Dunedin 9012, Otago, New Zealand
[email protected] · +64 3 455 2180

Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909.

10. Changes

If this page changes we update the date at the top of it. Material changes are also notified to anyone on the mailing list.