1. Who we are and when this policy applies
STAYS by Goodwins is a short- and mid-term accommodation service operated by Goodwin Realty Limited, trading as Goodwins (‘Goodwins’, ‘we’, ‘us’ or ‘our’). We arrange and manage accommodation on behalf of property owners, and provide booking and guest services across Auckland and Waiheke Island.
This policy explains how we collect, use, store and disclose personal information when you visit our website, enquire about accommodation, make or manage a booking, stay at a property we manage, or communicate with us. It also applies to corporate travel arrangers and other people who provide information about guests. It should be read alongside the applicable booking terms and any relevant third-party platform privacy policy.
We handle personal information in accordance with the New Zealand Privacy Act 2020, including the information privacy principles as amended.
2. What personal information we collect
Depending on your interaction with us, we may collect: your name, email address, telephone number, postal or billing address; booking dates, guest numbers, property preferences, arrival and departure information, and details of other guests; payment, billing, deposit and transaction information (normally handled through authorised payment providers); identity-verification information where reasonably necessary for a booking, safety or fraud-prevention purpose; communications, requests, complaints, reviews and records of support provided; and information you voluntarily share about accessibility, pets or other requirements so we can consider your needs.
We may also collect limited website and device information, including IP address, browser, pages visited, cookie identifiers and referral sources. If a property has disclosed external security cameras or other security systems, relevant recordings or access logs may be collected as explained in section 8.
We seek only information reasonably necessary for our legitimate accommodation-management activities. Please avoid sending sensitive information unless it is requested and necessary. If we need identification documents, we will explain why and how to provide them securely.
3. How information is collected and notice when received from others
We collect information directly from you when you use our website, make an enquiry, book accommodation, complete check-in steps or contact our team. We may also receive information from booking platforms, Guesty and integrated booking systems, corporate travel arrangers or employers, relocation agents, another person making a booking on your behalf, property owners, or service providers involved in your stay.
Where we receive personal information about you from someone else, we will take reasonable steps to give you the information required by Information Privacy Principle 3A, unless a lawful exception applies. This may occur through a booking confirmation, pre-arrival communication or another appropriate notice. If you provide details about other guests, please make sure you are authorised to do so and tell them about this policy.
4. Why we use your information
We use personal information to respond to enquiries; recommend suitable accommodation; check availability; confirm, administer and fulfil bookings; communicate arrival and departure details; coordinate guest services, cleaning, maintenance and property access; process payments, deposits, refunds and invoices; verify identity where necessary; protect guests, properties and staff; detect fraud or misuse; resolve incidents and complaints; comply with legal, tax and accounting obligations; and improve our services and website.
We may use aggregated or de-identified information for business analysis and service improvement. We do not use your booking information to send unrelated marketing messages unless permitted by applicable law, including the Unsolicited Electronic Messages Act 2007. Marketing communications will provide a way to unsubscribe where required.
5. Who we may share information with
We may share relevant information, only to the extent reasonably necessary and permitted by law, with: the property owner where needed to manage the accommodation or an incident; Guesty and other booking, channel-management, website-hosting and customer-service technology providers; booking platforms through which you reserve accommodation; payment processors and financial service providers; housekeeping, maintenance, linen, access-management and other operational contractors; corporate travel arrangers or employers involved in arranging or paying for your booking; professional advisers, insurers and debt-recovery providers; and public authorities where disclosure is required or authorised by law.
We expect service providers to protect information and use it only for authorised purposes. We do not sell guest personal information. If you book through a third-party platform, that platform may separately collect and use information under its own privacy policy.
6. Booking technology, Guesty and payments
We use third-party technology to manage enquiries, reservations, calendars, guest messages and associated operations, including Guesty. Information entered on our website or received from a booking channel may be processed through these systems. Guesty publishes its own privacy policy at https://www.guesty.com/privacy-policy/.
Card payments may be processed by a third-party payment provider. We do not intend to store complete payment-card details in our own general business records. The relevant payment provider’s terms and privacy notice may also apply. Do not send card numbers or identity documents by ordinary email unless we have specifically provided a secure method.
7. Overseas storage and disclosure
Some of our booking, payment, hosting and communications providers may process or store personal information outside New Zealand. Where a disclosure to an overseas recipient is subject to Information Privacy Principle 12, we will take steps required by law, including ensuring appropriate privacy protections or obtaining authorisation where applicable. Overseas cloud storage and processing arrangements will be assessed according to their actual legal and technical structure.
8. Security cameras, smart locks and property access
Some properties may use exterior security cameras, entry systems, smart locks, doorbell cameras or access logs for security, access management and incident investigation. Where recording occurs, relevant listing information, booking communications or on-site signage will explain the presence and location of devices and whether video or audio is recorded, as applicable.
We do not authorise undisclosed cameras or recording devices in private indoor guest areas. Any monitoring must comply with applicable law and the relevant booking platform’s rules, which may be more restrictive. Access to recordings is limited to people with a legitimate need, and recordings are retained only as long as necessary for the relevant purpose or legal requirement. If you have concerns about a device at a property, contact us promptly.
9. Cookies, analytics and third-party websites
Our website may use essential cookies and, where configured, analytics or marketing technologies to operate the site, understand usage and improve booking journeys. The specific tools and available cookie controls should be described in the website’s cookie settings. You can manage many cookies through your browser, although disabling essential cookies may affect functionality.
Our website may link to external booking services, maps, social media or other websites. Those services have their own privacy practices, which we do not control.
10. Security and retention
We take reasonable technical, physical and organisational steps to protect information against loss, unauthorised access, misuse, alteration and disclosure. Access is limited according to business need. No internet-based system is completely risk-free.
We keep personal information only for as long as needed for the purpose for which it was collected, to manage bookings or disputes, or to meet applicable legal and accounting requirements. We then securely delete or de-identify it where reasonably practicable. Retention periods vary by record type and applicable obligations.
11. Your rights and privacy complaints
Under the Privacy Act 2020, you may request access to personal information we hold about you and request correction of information you believe is inaccurate. We will respond in accordance with the Act. If we decline a correction request, you may have the right to request that a statement of correction be attached to the information.
For access, correction, or a privacy concern, contact our Compliance and Privacy Officer: Catherine Goodwin, catherine@goodwins.co.nz, telephone 09 373 4400. You may also complain to the Office of the Privacy Commissioner at www.privacy.org.nz if your concern is not resolved.
12. Privacy breaches
We have processes to assess and respond to privacy incidents. Where a privacy breach is notifiable under the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and affected individuals as required by law.
13. Updates to this policy
We may update this policy to reflect changes to our services, technology or legal requirements. The current version will be published on the STAYS by Goodwins website with its effective date.