Your information, held with care

1. About this policy

This privacy policy explains how Whakahā ("Whakahā", "we", "us") handles personal information collected through our website, whakahā.com. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). By using the website, you accept the practices described here.

2. Who we are

Whakahā is a New Zealand-based short-stay accommodation property. For any privacy question or request, contact our Privacy Officer at privacy@teamduality.co.nz.

3. What information we collect and why

3.1 If you contact us. The website does not have a contact form. You can contact us using the email link on the site. If you contact us this way, we receive whatever you choose to share — typically your name, contact details, and the content of your message — used only to respond to you and to assist with your stay.

3.2 If you make a booking. Bookings are made through the Hostfully booking widget embedded on our website, provided by Hostfully Inc. When you request a booking, your booking details are processed by Hostfully under their own privacy policy (hostfully.com), and your deposit is processed by Stripe. Hostfully also handles your booking and pre-arrival communications (booking request, pre-arrival and check-in messages), sent from and replied to via our hello@whakaha.com address. After you have booked, some of these guest communications may also be sent and received through WhatsApp (provided by Meta Platforms, Inc.) if you choose to message us there — this channel is planned but not yet active. WhatsApp will only be used with guests who have booked — it is not offered as a way to contact us on this website. Once active, messages you exchange with us on WhatsApp will be processed by Meta (see Section 5).

Please note: if you begin entering your details into the Hostfully booking widget, Hostfully may receive what you have entered even if you do not complete or confirm your booking, because the widget records entries as they are made. We treat any such information the same way as a completed booking request — we use it only to respond to you and assist with your stay, and you can ask us to delete it at any time (see Section 7). The widget also sends Hostfully the address of the page you arrived from (the referring URL) together with the details you enter.

3.3 Information collected automatically (analytics). When you visit the site, and once you have accepted non-essential cookies (see Section 4), we use tags managed through Google Tag Manager to collect standard information about your visit through Google Analytics 4, such as pages viewed, date and time of visit, approximate location (from your IP address), and basic device and browser information — used in aggregate to understand how the site is used.

Where you accept non-essential cookies, we may also use Google signals — a Google Analytics setting that links this aggregate visit data with Google's own signed-in-user information, so that visits across your devices can be counted together, we can see broad demographics/interest reporting, and we can build advertising audiences to share with our Google Ads advertising (see Section 5). This does not involve us collecting any new information about you — it changes how Google may use the data already described above, under Google's own terms.

3.4 Advertising and measurement. When you visit the site, and once you have accepted non-essential cookies (see Section 4), we also use advertising and measurement tags managed through Google Tag Manager — through the Meta Pixel (Meta Platforms, Inc.), Google Ads (Google LLC, running as Performance Max — remarketing and conversion measurement across Google Search, Display and YouTube, including automated bid optimisation), and the LinkedIn Insight Tag (LinkedIn Corporation / Microsoft) — to measure the performance of our marketing campaigns and to show you relevant Whakahā advertising on Meta, Google and LinkedIn after you have visited the site (this is called remarketing).

We do not send hashed or other identifying details to Meta, Google or LinkedIn for advertising matching at launch (advanced matching, enhanced conversions and LinkedIn's enhanced conversion tracking are all switched off). Advertising audiences are held for limited periods and refresh automatically — up to 90 days for Meta and up to 180 days for Google Ads during our current campaign — after which membership expires. You can decline these tags entirely through the cookie banner (Section 4). If you decline or later withdraw cookie consent, we stop adding you to these advertising audiences and stop refreshing your place in them. Because of how the advertising platforms work, this doesn't remove you instantly — your existing membership simply expires on its own within the retention periods described above (up to 90 days for Meta, up to 180 days for Google Ads). We also use the TikTok Pixel, provided by TikTok Pte. Ltd. — a Singapore-based company in the ByteDance group — on the same consent-gated basis: it runs only after you accept non-essential cookies, measures the performance of our TikTok advertising, and can show you relevant Whakahā advertising on TikTok after you have visited the site. We disclose TikTok separately from the providers above because it is not a United States provider — your information is processed by TikTok Pte. Ltd. in Singapore, and may be stored or accessed in other countries where the ByteDance group operates, under TikTok's own privacy policy (see Section 5). We do not send hashed or other identifying details to TikTok (advanced matching is switched off), and the consent-withdrawal position described above applies in the same way — audience membership expires on its own rather than being removed instantly.

3.5 If you complete our pre-arrival preferences form. After you book, we invite you to complete a short pre-arrival preferences form within Hostfully to help us prepare for your stay. It asks for preferences such as dietary requirements or allergies, gear sizes, how you'd like the rooms set up, and any special occasions. These fields are optional — you choose what to share, and providing them helps our concierge curate your stay. Your responses are held as part of your booking record in Hostfully (United States — see Section 5), accessible only to the hosting team, and are retained in line with your booking record. You can ask us to access or correct this information at any time.

3.6 Digital guest guidebook and booking channels. After you book, you can access a digital guest guidebook hosted by Hostfully (United States), including an optional experiences marketplace. If you request or purchase an experience, our concierge helps confirm and arrange it; any payment is processed through Hostfully and Stripe (as in 3.2) — either at the time of purchase or once our concierge has confirmed the experience with you.

We also list the property on Google Vacation Rentals, Airbnb and Booking.com. Our property details, availability and pricing are distributed to these platforms through Hostfully. If you find and book us through one of them, your booking is made with that platform, under that platform's own privacy policy and terms; the details we need to manage your reservation — such as your name, contact details, party size and booking dates — are then passed to us through Hostfully, where we handle them as described in 3.2. Section 5 shows where each platform holds information.

(WhatsApp guest messaging is covered in 3.2 and Section 5.)

4. Cookies and consent

The site uses cookies and similar technologies. Strictly necessary cookies that make the site work are always on. Non-essential cookies — used for analytics (Google Analytics 4) and advertising/remarketing (Meta Pixel, Google Ads, LinkedIn Insight Tag and TikTok Pixel), all managed through Google Tag Manager — do not run until you accept them through the cookie banner shown when you first visit. You can accept or decline non-essential cookies, and you can change or withdraw your choice at any time using the “Cookie preferences” link in the footer of the Whakahā website, or through your browser settings. Some parts of the site may not function as intended if you block strictly necessary cookies.

5. Who we share information with, and overseas storage

We use the following providers to run the website and deliver our services. Some store or process information outside New Zealand; we disclose this under IPP 12. We do not sell personal information.

By making a booking or contacting us through the website, you acknowledge and consent to your information being transferred to and processed outside New Zealand as described above. Advertising and analytics tags only operate after you accept non-essential cookies. If you would prefer not to, please contact us directly at hello@whakaha.com to discuss alternatives.

6. How we store and protect your information

Emails and messages you send us, and your booking records, are held by the providers listed above and accessible only to the people who need them. We take reasonable steps — including encrypted connections (HTTPS), multi-factor authentication on administrative accounts, and limiting administrative access to authorised personnel — to keep personal information secure and to retain it only as long as needed. Enquiry and guest correspondence (including any WhatsApp messages) is generally kept for up to 12 months unless there is an ongoing relationship; booking records are retained in line with Hostfully's standard terms and New Zealand law; advertising audience membership expires automatically within the windows described in Section 3.4; access codes are time-limited. No method of transmission over the internet is completely secure.

7. Your rights

Under the Privacy Act 2020 you may ask to access the personal information we hold about you and to correct it, and you can ask us to delete information you have provided (including booking details you began entering but did not complete). Contact privacy@teamduality.co.nz (please include "Privacy Enquiry" in the subject line; we aim to respond within 10 working days). If you are not satisfied with how we have handled your information, you can contact the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

8. Children

The website is intended for adults booking accommodation and is not directed at children.

9. Changes to this policy

We may update this policy from time to time; the current version and its effective date are always available on the website. We will update this policy before we introduce any genuinely new collection point. Where something is planned but not yet running — such as guest messaging on WhatsApp (Section 3.2) — we disclose it here in advance so it is already covered when it is switched on.

10. Contact

General enquiries and bookings: hello@whakaha.com
Privacy requests and questions: privacy@teamduality.co.nz