Privacy Policy

1. Introduction

("we", "us", "our") operates the website merquessagrandinn.com (the "Website"), which presents information about Merquessagrandinn, a hotel and casino located in Whakatāne, New Zealand. We are committed to handling personal information responsibly and in accordance with the Privacy Act 2020 (New Zealand) and all other applicable privacy legislation.

This Privacy Policy explains what personal information we collect through the Website, why we collect it, how we use and protect it, and what rights you have in relation to it. It applies solely to personal information processed through merquessagrandinn.com and does not govern information collected through other channels or in-person at the property.

Please read this Policy carefully before submitting any personal information through the Website. By using the Website, you acknowledge that you have read and understood this Policy.

2. Data Controller

The data controller responsible for personal information collected through the Website is:

If you have any questions, concerns or requests relating to your personal information, please contact our Privacy team at the address above.

3. Personal Information We Collect

We collect only the personal information that is necessary for the purposes described in this Policy. The categories of information we collect through the Website are set out below.

3.1 Contact and Reservation-Request Data

When you submit an enquiry or reservation request through the Website, we collect the information you provide in the relevant form, which may include:

• Full name
• Email address
• Telephone number
• Preferred arrival and departure dates
• Room or accommodation type preference
• Number of guests
• Special requests or accessibility requirements you choose to disclose
• Any other information you voluntarily include in a free-text message field

We do not use Website forms to collect payment card details. Any payment processing in connection with a confirmed reservation takes place through a separate secure channel and is subject to any applicable terms communicated at the time.

3.2 Device and Technical Data

When you visit the Website, certain technical information is automatically recorded by our web servers and any cookies or similar technologies in operation. This may include:

• IP address
• Browser type and version
• Operating system
• Device type
• Referring URL
• Pages viewed and navigation path through the Website
• Date and time of each visit
• Session duration

3.3 Consent and Preference Data

Where the Website presents cookie consent or marketing preference options, we record the choices you make, together with a timestamp and relevant technical identifiers, so that we can honour your preferences and demonstrate compliance with applicable requirements.

3.4 Special-Category Personal Data

We do not intentionally collect special-category personal data through the Website. If you voluntarily include such information in a free-text field (for example, in a special-requests message), we will process it only to the extent necessary to respond to your request and will not use it for any other purpose.

3.5 Information About Minors

The Website is not directed at persons under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe that a person under 18 has submitted personal information through the Website, please contact us at privacy@merquessagrandinn.com and we will take steps to delete that information promptly. Please note that entry to and participation in casino gaming at Merquessagrandinn is restricted to persons aged 18 and over.

4. Cookies and Similar Technologies

The Website uses cookies and similar tracking technologies to enable core functionality, remember your preferences and, where you have given your consent, to analyse visitor behaviour in aggregate.

You may manage your cookie preferences at any time using the consent tool displayed when you first visit the Website, or by adjusting the settings in your browser. Please be aware that disabling certain cookies may affect the functionality of some Website features.

5. How and Why We Use Your Personal Information

We process personal information only where we have a lawful basis for doing so. The table below sets out our processing purposes and the corresponding legal bases under New Zealand privacy law and, where applicable, comparable international frameworks.

Where we rely on legitimate interests as our legal basis, we have assessed that our interests are not overridden by your privacy rights. You may request further information about this balancing assessment by contacting us at privacy@merquessagrandinn.com.

6. Disclosure of Personal Information

We do not sell, rent or trade your personal information to third parties for their own marketing purposes. We may disclose your personal information to the following categories of recipients, strictly as necessary for the purposes described in this Policy:

• Service providers and processors: Third-party companies that provide services on our behalf, such as website hosting, email delivery infrastructure, analytics platforms and IT support. These parties are contractually bound to process personal information only on our documented instructions and to maintain appropriate security standards.
• Professional advisers: Lawyers, accountants, auditors and insurers where necessary in the course of the professional services they provide to us.
• Regulatory and government authorities: Where we are required to do so by applicable New Zealand law or a binding order of a court or competent authority.
• Business successors: In the event of a merger, acquisition, restructuring or sale of assets involving , personal information held by us may be transferred to the relevant successor entity, subject to equivalent privacy protections.

7. International Transfers of Personal Information

is based in New Zealand. Some of our service providers operate servers or infrastructure located in other countries, which may mean that personal information we collect is transferred to, stored in or processed in a jurisdiction outside New Zealand.

Where such transfers occur, we take steps to ensure that your personal information receives a level of protection consistent with the Privacy Act 2020, including by:

• Engaging only service providers in countries that the Office of the Privacy Commissioner of New Zealand has recognised as providing comparable privacy protections; or
• Putting in place contractual arrangements with our service providers that require them to protect your personal information to an equivalent standard.

You may request further information about international transfer safeguards by contacting us at privacy@merquessagrandinn.com.

8. Retention of Personal Information

We retain personal information for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

At the end of the applicable retention period, personal information is securely deleted or anonymised in a manner that prevents re-identification.

9. Security of Personal Information

We implement and maintain appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access. These measures include:

• Transmission of data between your browser and our Website servers via encrypted connections (TLS);
• Access controls that restrict personal information to authorised personnel who require it to perform their duties;
• Regular review of our information security practices;
• Contractual requirements on service providers to maintain equivalent security standards.

While we take these precautions seriously, no method of transmission over the internet or electronic storage is completely secure. If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at privacy@merquessagrandinn.com.

In the event of a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner of New Zealand and affected individuals in accordance with the mandatory notification requirements of the Privacy Act 2020.

10. Your Privacy Rights

Under the Privacy Act 2020, you have the following rights in relation to personal information we hold about you:

10.1 Right of Access

You have the right to ask whether we hold personal information about you and, if so, to request a copy of that information. We will respond to access requests within 20 working days, as required by the Privacy Act 2020, unless an extension is lawfully applicable.

10.2 Right of Correction

If you believe that personal information we hold about you is inaccurate, incomplete or misleading, you have the right to request that we correct it. Where we disagree with a correction request, we will note your objection on the relevant record.

10.3 Right to Withdraw Consent

Where we process your personal information on the basis of your consent (for example, for marketing communications), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, please contact us at privacy@merquessagrandinn.com or use the unsubscribe link in any marketing email we send you.

10.4 Right to Object or Restrict Processing

In certain circumstances, you may have the right to object to or request restriction of our processing of your personal information, in particular where we are relying on legitimate interests as our legal basis. We will consider your request and respond within a reasonable timeframe.

10.5 How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to:

We may ask you to verify your identity before processing your request, to ensure that personal information is not disclosed to an unauthorised person. We will not charge a fee for straightforward requests but reserve the right to apply a reasonable charge for requests that are manifestly unfounded or excessive.

11. Responsible Gaming Information

Where the Website provides information about casino gaming at Merquessagrandinn, access to and participation in casino gaming is open only to persons who are 18 years of age or older. The Department of Internal Affairs (DIA) is the New Zealand government agency responsible for overseeing gambling regulatory matters in New Zealand. The DIA publishes publicly available guidance on responsible gambling practices, self-exclusion tools and information for those seeking support, which can be accessed through the DIA's official website. Merquessagrandinn encourages all guests who use gaming facilities to do so responsibly.

12. Links to Third-Party Websites

The Website may contain links to third-party websites or services that are not operated by . We have no control over the content or privacy practices of those websites and are not responsible for them. We encourage you to review the privacy policy of every website you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Website or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Policy periodically to stay informed about how we protect your personal information. Continued use of the Website after the date of any update constitutes your acknowledgement of the revised Policy.

14. Complaints and Regulatory Contact

If you are not satisfied with how we have handled your personal information or responded to a privacy request, you may lodge a complaint with us in the first instance by writing to:

We will acknowledge your complaint promptly and aim to resolve it within 20 working days. If you are not satisfied with our response, or if you prefer to contact the regulator directly, you have the right to refer your complaint to the Office of the Privacy Commissioner of New Zealand (OPC). The OPC is the independent authority responsible for promoting and protecting privacy in New Zealand and can receive and investigate complaints about alleged interferences with privacy under the Privacy Act 2020. Further information about the OPC, including how to make a complaint, is available at www.privacy.org.nz.

15. Contact Us

For any questions, concerns or requests relating to this Privacy Policy or to the personal information we hold about you, please contact our Privacy team: