Legal · Privacy

Privacy Policy

1. Administrator and contact

2. Legal framework and scope

We process personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles. Those principles regulate the purposes and sources of collection, notice to individuals, collection methods, security, access, correction, accuracy, retention, use, disclosure, overseas disclosure and unique identifiers. Where we collect personal information about an individual from another source, we also apply Information Privacy Principle 3A, which has applied to relevant indirect collection since 1 May 2026, including giving the required notice unless a lawful exception applies.

If the European Union General Data Protection Regulation (GDPR) applies to a particular interaction—for example because our processing relates to offering services to a person in the EEA in circumstances covered by Article 3 GDPR—we also apply the GDPR requirements described below. References to GDPR rights are therefore conditional on that law being applicable to the person and processing concerned. Nothing in this policy limits rights that cannot lawfully be limited.

3. Information we collect

Depending on how you interact with us, we may collect your name, email address, telephone number, enquiry text, requested tour or destination, preferred date, group size, accessibility or practical requirements that you voluntarily provide, correspondence history and information necessary to manage a booking. We may also receive ordinary technical information generated when a browser requests the website, such as IP address, browser type, device type, requested URL, date and time, referral information and security logs, to the extent such information is recorded by our hosting or security providers.

Please do not send health information, identity documents, payment-card data or other sensitive information through the general contact form unless we have specifically asked for information that is genuinely necessary for a tour and have provided an appropriate secure method. If practical accessibility or dietary information is needed for a service, we will seek only what is reasonably necessary for that purpose.

4. How we collect information

We collect information directly when you contact us, submit the enquiry form, email or telephone us, request a quote, make or discuss a booking, or otherwise communicate with our team. We may also receive information from a person organising travel on behalf of a group, an authorised travel agent or another supplier involved in the requested service. When information is collected from someone other than the individual concerned, we will provide notification where required by New Zealand privacy law, subject to lawful exceptions.

5. Purposes of processing

We use personal information to answer enquiries; prepare itineraries and quotations; assess availability; organise transport or activity logistics; communicate changes; provide customer support; manage cancellations and complaints; maintain safety and operational records where justified; protect the website and our systems; prevent fraud or misuse; comply with legal, tax, accounting and regulatory obligations; and establish, exercise or defend legal claims. We do not sell personal information.

6. Legal bases under GDPR, where applicable

Where the GDPR applies, our legal basis depends on the processing. We ordinarily rely on steps requested before entering a contract and performance of a contract for tour enquiries and bookings; legal obligations for records that must be kept by law; legitimate interests for proportionate website security, service administration and protection of legal rights; and consent where consent is the appropriate basis, including for optional technologies or communications that require it. Where we rely on legitimate interests, we consider the necessity of processing and balance those interests against the person’s rights and reasonable expectations.

7. Data minimisation and accuracy

We seek to collect information that is reasonably necessary for a defined purpose and avoid collecting information simply because it might later be useful. We take reasonable steps to ensure information is accurate, up to date, complete, relevant and not misleading before using or disclosing it where accuracy matters. You can help by telling us when your contact or booking information changes.

8. Disclosure and service providers

We may disclose information to staff and contractors who need it to provide the requested service; transport operators, accommodation or activity providers where needed for an itinerary; professional advisers; IT, hosting, email, security and support providers; payment providers if a separate payment process is used; and public authorities where disclosure is required or authorised by law. We disclose only information reasonably necessary for the relevant purpose and use contractual, organisational or other safeguards appropriate to the relationship.

9. Overseas disclosures and international transfers

Some service providers or trip suppliers may process information outside New Zealand. Before disclosing personal information overseas, we consider the requirements of Information Privacy Principle 12 and the nature of the recipient and safeguards. Where GDPR Chapter V applies, we use an available lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards, as required for the transfer in question. A person may contact us for more information about safeguards relevant to their data.

10. Retention

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and for legitimate legal, accounting, safety, dispute-resolution or recordkeeping needs. Retention periods vary by record type. Enquiries that do not lead to a booking are periodically reviewed and deleted or anonymised when no longer needed. Booking and transaction records may be retained longer where necessary to comply with law or resolve claims. When information is no longer required, we take reasonable steps to delete, anonymise or securely dispose of it.

11. Security

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the information and risks. Measures may include access controls, limiting staff access to need-to-know purposes, updates and patching, backup practices, transport encryption when supported by the service, and procedures for handling suspected incidents. No internet transmission or storage method can be guaranteed to be completely secure, and users should avoid sending unnecessary sensitive information through ordinary email.

12. Privacy breaches

We assess suspected privacy incidents promptly, take steps to contain and remediate them, and consider notification obligations. Under New Zealand law, notifiable privacy breaches are reported to the Office of the Privacy Commissioner and affected people when the statutory threshold is met. Where another applicable privacy regime imposes a breach-notification duty, we address that duty according to the circumstances.

13. Access, correction and other rights

Under the New Zealand Privacy Act, individuals may request access to personal information we hold about them and request correction, subject to applicable grounds for refusal and procedural rules. If the GDPR applies, a person may also have rights to access, rectification, erasure, restriction, data portability, objection to certain processing and withdrawal of consent. These rights are not absolute and may depend on the legal basis and circumstances. Withdrawing consent does not affect processing lawfully carried out before withdrawal.

To exercise a right, email info@selmorienwhiteworks.com and describe the request clearly. We may take reasonable steps to verify identity before disclosing or changing information. We will respond within the time required by applicable law.

14. Complaints

Please contact us first if you believe personal information has been handled incorrectly so we can investigate. Individuals in New Zealand may also complain to the Office of the Privacy Commissioner. Where GDPR applies, individuals may have the right to lodge a complaint with a competent supervisory authority in the EEA or another applicable jurisdiction.

15. Children’s information

Our excursion services may include families, but the general website is not designed to collect personal information directly from young children without involvement of a parent, guardian or responsible organiser. If a child’s information is necessary for a booking or safety arrangement, we limit collection to information reasonably necessary for the service and handle it with particular care.

16. Automated decision-making

We do not use the website contact process to make decisions producing legal or similarly significant effects solely by automated means. If this changes, and applicable law requires additional notice or rights, we will update this policy before introducing the relevant processing.

17. Cookies and external content

Our use of cookies and similar technologies is described in the Cookie Policy. The website may include embedded map content supplied by a third party. A request to that third party can disclose technical data such as an IP address and browser information. The provider’s own terms and privacy practices govern its independent processing.

18. Changes to this policy

We may update this policy to reflect changes in services, technology, legal requirements or operational practices. The effective date at the top identifies the current version. Material changes will be presented in an appropriate way on the website. Continued use of the website does not waive any consent requirement that would otherwise apply.

19. Contact

Privacy requests and questions: info@selmorienwhiteworks.com. Controller/agency: Selmorienwhiteworks Limited, 123 Adventure Lane, Wellington 6011, New Zealand.