Privacy Policy
Last updated: 1 August 2026 · Governed by New Zealand Privacy Act 2020
NZ Bus Trail ("we") complies with New Zealand's Privacy Act 2020 and its 13 Information Privacy Principles.
1. Information We Collect
We collect the following personal information to provide our services:
- Booking & payment information: name, email, phone, origin/destination, departure date, passenger count, payment details
- Communication data: WhatsApp messages, email enquiries
- Website usage data: IP address, browser type, pages visited, access time (collected automatically via cookies and analytics tools)
- Special requirements: health conditions or disability information collected only when necessary for service delivery (with separate consent)
2. Purpose of Collection & Use
Collected information is used solely for the following purposes:
- Confirming bookings and providing shuttle services
- Processing changes, cancellations and refunds
- Sending important service notifications (departure details, schedule changes, etc.)
- Responding to customer enquiries
- Fulfilling legal obligations (NZTA transport records, etc.)
- Improving our website and service quality (aggregated, anonymised analytics)
We do not sell personal information to third parties. We do not use your information for marketing without your consent.
3. Retention Periods
| Information Type | Retention Period |
|---|---|
| Booking & payment records | 7 years from service date (accounting & legal obligations) |
| Customer enquiry records | 3 years after resolution |
| Website logs | 90 days |
| Marketing consent records | Until consent is withdrawn |
4. Third-Party Sharing
Your information may be shared with third parties only in the following cases:
- NZTA (NZ Transport Agency): to fulfil mandatory transport record reporting
- Payment processor: minimum information required for payment authorisation only
- Firebase (Google): Used to provide login functionality (operates in demo mode when not connected)
- Legal requirements: court orders, regulatory requests or other legal obligations
Where information is transferred outside New Zealand, we ensure the receiving country provides adequate privacy protections or appropriate contractual safeguards are in place.
5. Your Rights (Privacy Act 2020 IPP 6 & 7)
Under the New Zealand Privacy Act 2020, you have the following rights:
- Access: you may request the personal information we hold about you (we respond within 20 working days)
- Correction: you may request correction of inaccurate information
- Deletion: you may request deletion of information not subject to legal retention requirements
- Opt-out: you may withdraw marketing consent at any time
To exercise these rights, email: contact@nzbustrail.com (subject: "Privacy Request")
6. Security Measures
- Full HTTPS (TLS) encryption across the website
- Payment information is processed via PCI-DSS certified processors and is never stored on our servers
- Access to personal information is restricted to authorised staff with a business need
- In the event of a data breach, affected individuals and the Office of the Privacy Commissioner (OPC) will be notified within 72 hours
7. Cookies & Analytics
Our website may use cookies for the following purposes:
- Website functionality (session management, language preference)
- Visitor analytics (e.g. Google Analytics — anonymised)
You may disable cookies in your browser settings, though some functionality may be limited.
8. Privacy Officer
Under the Privacy Act 2020, we have designated a Privacy Officer:
- Email: contact@nzbustrail.com
- If your concern is not resolved, you may contact the Office of the Privacy Commissioner: www.privacy.org.nz