Privacy Policy

We collect the following types of personal information when you interact with our platform:

• Identity & contact information: your name, email address, phone number, and country of residence.
• Payment information: credit/debit card details (processed securely via our payment partners — we do not store full card numbers).
• Booking history: dates of stay, shack locations visited, preferences, and any special requests.
• Device & browser data: IP address, browser type, operating system, referring URLs, and pages visited — collected automatically when you browse our website.

We use your personal information for the following purposes:

• Processing bookings: to confirm reservations, process payments, and deliver booking confirmations and check-in instructions.
• Communications: to send you booking-related emails (confirmations, reminders, policy updates) and respond to your inquiries.
• Improving the platform: to analyse usage patterns, fix bugs, and enhance the guest experience.
• Marketing (with consent): to send you promotional emails, surf guides, and special offers — only when you have explicitly opted in. You can unsubscribe at any time.

We take data security seriously:

• All personal data is stored on encrypted servers with industry-standard security measures.
• Payment processing is handled by secure, PCI-compliant third-party payment processors. We do not store full credit card details on our servers.
• We do not sell, rent, or trade your personal information to any third party for marketing purposes.
• Access to personal data is restricted to authorised personnel only, and we regularly review our security practices.

Our website uses cookies and similar tracking technologies to improve your browsing experience:

• Essential cookies: required for the website to function — including session management and secure booking flows.
• Analytics cookies: help us understand how visitors use our site (pages viewed, time on site, device type). We use this data to improve performance and usability.
• Opt-out: you can disable cookies through your browser settings at any time. Note that disabling essential cookies may affect the functionality of the booking platform.

We use trusted third-party services to operate our platform. These providers may have access to limited personal data as necessary to perform their functions:

• Payment processors: to securely process credit/debit card transactions.
• Booking platform tools: to manage reservations, availability, and guest communications.
• Analytics services: to measure and analyse website traffic and user behaviour.

All third-party providers are contractually required to protect your data in compliance with applicable privacy laws.

Under the New Zealand Privacy Act 2020, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct any inaccurate or incomplete personal information.
• Deletion: request that we delete your personal information, subject to any legal obligations we may have to retain certain data.

To exercise any of these rights, please contact our Privacy Officer using the details in Section 9. We will respond to your request within 20 working days as required by the Act.

• We only send marketing communications to users who have explicitly opted in.
• Every marketing email includes an easy unsubscribe link — you can withdraw consent at any time.
• Opting out of marketing does not affect transactional emails related to your bookings (confirmations, reminders, check-in instructions).

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The "Last updated" date at the top of this page indicates when the most recent changes were made. We encourage you to review this policy periodically. Material changes will be communicated to registered users via email.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact our Privacy Officer:

Privacy Officer — Surf Shack Global Limited
89 Tautari Street, Ōrākei, Auckland 1071, New Zealand
Email: privacy@surfshackglobal.com