Your information, held with care

1. About this policy

This privacy policy explains how Whakahā ("Whakahā", "we", "us") handles personal information collected through our website, whakahā.com. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). By using the website, you accept the practices described here.

2. Who we are

Whakahā is a New Zealand-based short-stay accommodation property. For any privacy question or request, contact our Privacy Officer at privacy@teamduality.co.nz.

3. What information we collect and why

3.1 If you contact us. The website does not have a contact form. You can contact us using the email link on the site. If you contact us this way, we receive whatever you choose to share — typically your name, contact details, and the content of your message — used only to respond to you and to assist with your stay.

3.2 If you make a booking. Bookings are made through the Hostfully booking widget embedded on our website, provided by Hostfully Inc. When you request a booking, your booking details are processed by Hostfully under their own privacy policy (hostfully.com), and your deposit is processed by Stripe. Hostfully also handles your booking and pre-arrival communications (booking request, pre-arrival and check-in messages), sent from and replied to via our hello@whakaha.com address. After you have booked, some of these guest communications may also be sent and received through WhatsApp (provided by Meta Platforms, Inc.) if you choose to message us there. WhatsApp is only used with guests who have booked — it is not offered as a way to contact us on this website. Messages you exchange with us on WhatsApp are processed by Meta (see Section 5).

3.3 Information collected automatically (analytics and advertising). When you visit the site, and once you have accepted non-essential cookies (see Section 4), we use tags managed through Google Tag Manager to collect standard information about your visit:

• Analytics — through Google Analytics 4, such as pages viewed, date and time of visit, approximate location (from your IP address), and basic device and browser information — used in aggregate to understand how the site is used.
• Advertising and measurement — through the Meta Pixel (Meta Platforms, Inc.) and Google Ads (Google LLC) — to measure the performance of our marketing campaigns and to show you relevant Whakahā advertising on Meta and Google platforms after you have visited the site (this is called remarketing).

We do not send hashed or other identifying details to Meta or Google for advertising matching at launch (advanced matching and enhanced conversions are switched off), and Google Analytics "Google signals" is switched off at launch. Advertising audiences are held for limited periods and refresh automatically — up to 90 days for Meta and up to 180 days for Google Ads during our current campaign — after which membership expires. You can decline these tags entirely through the cookie banner (Section 4).

3.4 If you complete our pre-arrival preferences form. After you book, we invite you to complete a short pre-arrival preferences form within Hostfully to help us prepare for your stay. It asks for preferences such as dietary requirements or allergies, gear sizes, how you'd like the rooms set up, and any special occasions. These fields are optional — you choose what to share, and providing them helps our concierge curate your stay. Your responses are held as part of your booking record in Hostfully (United States — see Section 5), accessible only to the hosting team, and are retained in line with your booking record. You can ask us to access or correct this information at any time.

3.5 Planned features (fast-follows). We expect to switch these on shortly after launch and disclose them here in advance:

• Google Vacation Rentals — we may list the property on Google's travel / Vacation Rentals surfaces. Property, availability and pricing is distributed to Google (United States) via Hostfully; if you find us through Google, your booking is still completed through Hostfully as in 3.2.
• Digital guest guidebook — a digital guidebook hosted by Hostfully (United States) with an optional experiences marketplace; anything you buy is processed through Hostfully and Stripe (as in 3.2) and arranged by our concierge.
• Post-booking confirmation / experiences page — after booking you may be redirected to a confirmation or experiences page on our website; the analytics and consent-gated advertising events in 3.3 fire on that page.

(WhatsApp guest messaging is covered in 3.2 and Section 5.)

4. Cookies and consent

The site uses cookies and similar technologies. Strictly necessary cookies that make the site work are always on. Non-essential cookies — used for analytics (Google Analytics 4) and advertising/remarketing (Meta Pixel, Google Ads), all managed through Google Tag Manager — do not run until you accept them through the cookie banner shown when you first visit. You can accept or decline non-essential cookies, and you can change or withdraw your choice at any time through the cookie settings on the site or your browser settings. Some parts of the site may not function as intended if you block strictly necessary cookies.

5. Who we share information with, and overseas storage

We use the following providers to run the website and deliver our services. Some store or process information outside New Zealand; we disclose this under IPP 12. We do not sell personal information.

By making a booking or contacting us through the website, you acknowledge and consent to your information being transferred to and processed outside New Zealand as described above. Advertising and analytics tags only operate after you accept non-essential cookies. If you would prefer not to, please contact us directly at hello@whakaha.com to discuss alternatives.

6. How we store and protect your information

Emails and messages you send us, and your booking records, are held by the providers listed above and accessible only to the people who need them. We take reasonable steps — including encrypted connections (HTTPS), multi-factor authentication on administrative accounts, and limiting administrative access to authorised personnel — to keep personal information secure and to retain it only as long as needed. Enquiry and guest correspondence (including any WhatsApp messages) is generally kept for up to 12 months unless there is an ongoing relationship; booking records are retained in line with Hostfully's standard terms and New Zealand law; advertising audience membership expires automatically within the windows described in Section 3.3; access codes are time-limited. No method of transmission over the internet is completely secure.

7. Your rights

Under the Privacy Act 2020 you may ask to access the personal information we hold about you and to correct it. Contact privacy@teamduality.co.nz (please include "Privacy Enquiry" in the subject line; we aim to respond within 10 working days). If you are not satisfied with how we have handled your information, you can contact the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

8. Children

The website is intended for adults booking accommodation and is not directed at children.

9. Changes to this policy

We may update this policy from time to time; the current version and its effective date are always available on the website. We will update this policy before we introduce any genuinely new collection point. The planned fast-follow features in Section 3.5 are disclosed here in advance so they are already covered when switched on.

10. Contact

General enquiries and bookings: hello@whakaha.com
Privacy requests and questions: privacy@teamduality.co.nz