Privacy Act 2020
Privacy Policy
What we collect, why we hold it, who sees it, and how to get it back or corrected.
Last updated: 1 July 2026.
1. Who we are
This website and the hotel it describes are operated by Copper Bluffs Hospitality Ltd, a New Zealand company:
Copper Bluffs Hospitality Ltd
27 Lake Esplanade
Queenstown 9300, Otago
New Zealand
NZBN 9429047318852
We are the agency responsible for the personal information described in this policy, and we handle it in accordance with the Privacy Act 2020 and the thirteen Information Privacy Principles it contains.
Our Privacy Officer can be reached at [email protected] or on +64 3 441 7250.
2. What we collect
Information you give us
- Booking and enquiry details — name, email address, phone number, postal address, arrival and departure dates, number of guests, room preference and the content of your message.
- Stay details — dietary requirements, accessibility requirements, special occasions, and any preference you tell us about so we can get it right next time.
- Payment information — taken at the front desk or through our payment provider. We do not store full card numbers on our own systems; our provider holds them and returns a token to us.
- Identification — at check-in we sight photo ID as required for guest registration. At the gaming lounge we sight photo ID to verify age. In both cases we sight the document; we do not copy or scan it, and we do not retain it.
- Correspondence — emails, letters, form submissions and notes of phone calls with us.
- Self-exclusion requests — if you ask to be excluded from the gaming lounge, we record your name, the period and the fact of the request. See our Host Responsibility policy.
Information collected automatically
- Website usage — IP address, browser type and version, device type, pages visited, time of visit and referring page. Collected only where you have consented to analytics cookies.
- Cookies — see our Cookie Policy for the full list and how to change your choice.
Information from others
Where you book through a travel agent or an online booking platform, that party passes us the details needed to hold your reservation. What they collect from you is governed by their own privacy policy, not this one.
CCTV
Closed-circuit television operates in the hotel's public areas, entrances, car park, cash-handling areas and the gaming lounge. It does not operate in guest rooms, bathrooms, changing areas or treatment rooms. Signage is displayed where cameras are in use. Footage is retained for thirty days and then overwritten, unless it is required for an investigation or requested lawfully.
3. Why we hold it
| Purpose | What it involves |
|---|---|
| Taking and managing your booking | Confirming a reservation, allocating a room, preparing for arrival, invoicing and taking payment. |
| Answering enquiries | Replying to the form, an email or a phone call. |
| Providing hotel services | Restaurant and spa bookings, events, concierge arrangements, room service. |
| Legal obligations | Guest registration, tax and accounting records, health and safety, and obligations under the Gambling Act 2003 and the Sale and Supply of Alcohol Act 2012. |
| Host responsibility | Verifying age for gaming lounge entry and administering self-exclusion requests. |
| Safety and security | CCTV, incident records, and protecting guests, staff and property. |
| Improving the hotel | Understanding how the website is used and what guests ask for. Analytics only with your consent. |
| Marketing | Sending seasonal offers, but only if you have ticked the box asking us to. |
We do not use personal information for any purpose that is unrelated to the one it was collected for, unless you agree or the law requires it.
4. Marketing
We send marketing email only to people who have opted in. The box is never pre-ticked. Every message carries a one-click unsubscribe link, and unsubscribing takes effect immediately — it does not stop us sending you the operational emails about a booking you have actually made.
We do not sell, rent or trade mailing lists. Ever.
5. Who we share it with
We disclose personal information only where it is necessary, and only to:
- Service providers who work on our behalf — our property management system, payment processor, email platform and website host. Each is bound by contract to use the information only for the service they provide to us.
- Concierge partners, where you ask us to make a booking with a tour operator, restaurant or transport provider. We pass on only what that booking requires.
- Professional advisers — accountants, auditors and lawyers, under a duty of confidence.
- Regulators and enforcement agencies where we are required or authorised by law to disclose, including the Department of Internal Affairs in relation to our gaming operation, and the New Zealand Police.
We do not sell personal information to anyone, for any purpose.
6. Where it is held
Our records are held on servers in New Zealand and Australia. Some of our service providers process data in other countries. Where personal information is sent overseas, we satisfy ourselves that the recipient is subject to comparable safeguards, as Information Privacy Principle 12 requires, and we bind them contractually to protect it.
7. How long we keep it
| Record | Retention |
|---|---|
| Booking and guest records | Seven years, to meet tax and accounting requirements |
| Enquiries that did not become bookings | Twenty-four months |
| Marketing consent and preferences | Until you withdraw consent, then a suppression record only |
| CCTV footage | Thirty days, unless required for an investigation |
| Self-exclusion records | The period of exclusion plus seven years |
| Website analytics | Twenty-six months |
When information is no longer needed for any lawful purpose, it is deleted or de-identified.
8. Keeping it safe
We take reasonable technical and organisational steps to protect personal information against loss, misuse and unauthorised access. These include encryption in transit (HTTPS across this website), access controls limiting staff access to what their role requires, staff training in privacy and confidentiality, and regular review of our systems and providers.
No system is perfect. If we experience a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as the Privacy Act 2020 requires.
9. Your rights
Under the Privacy Act 2020 you have the right to:
- Access the personal information we hold about you.
- Correct it if it is wrong, or attach a statement of correction if we disagree.
- Withdraw consent to marketing or to analytics cookies at any time.
- Complain to us, and to the Office of the Privacy Commissioner if you are not satisfied.
To make a request, write to [email protected] or to the Privacy Officer at the address above. We may ask you to confirm your identity before releasing anything. There is no charge for a reasonable request, and we respond within twenty working days.
10. Children
This website is not directed at children, and we do not knowingly collect personal information from anyone under 16 through it. Children are welcome as guests of the hotel; their details are provided by the adult making the booking.
11. Other websites
This site links to external websites, including tourism operators and the support services listed in our Host Responsibility policy. We are not responsible for their content or their privacy practices. Read their policies before giving them anything.
12. Changes to this policy
We update this policy when our practices or the law change. The date at the top shows the current version. Material changes will be flagged on this page for at least thirty days.
13. Complaints
If you are unhappy with how we have handled your personal information, tell us first — write to [email protected]. We acknowledge within two working days and respond within twenty.
If you are not satisfied with our response you may complain to:
Office of the Privacy Commissioner
PO Box 10094, Wellington 6143
Phone 0800 803 909
privacy.org.nz