Your privacy

When you check in for a trip we ask for some information about you. This page explains what we ask for, why we need it, who can see it and how long we keep it. We follow the Privacy Act 2020.

What we collect, and why

• Your name and date of birth — so your guide knows who is on their raft, and because some trips have a minimum age.
• Your weight — buoyancy aids are sized by weight, and it affects how we balance a raft.
• How well you swim — so your guide knows who to keep closest.
• Any medical conditions you tell us about — so your guide and trip leader can look after you properly, and so emergency services have it if something happens. This is health information and we treat it as the most sensitive thing we hold.
• An emergency contact — only used if there is an emergency.
• Your signature — your record that you were told about the risks and accepted them. This is a legal safety record and it is why we keep it longer than the rest.
• Your email address — to send your photos and a thank-you after the trip. We only send you marketing if you tick the box, and every email has an unsubscribe link.
• If you are under 18 — the name of the parent or guardian who signed for you.

We do not ask for your address, and we never take payment details — those stay with the booking system you booked through.

Who can see it

Only Rotorua Rafting staff who need it: the guides and trip leader running your trip, and the office. Your check-in is tied to your trip and is not visible to other operators. Every staff member signs in with a code sent to their own phone — there are no shared logins.

We share it outside the business in only three situations: with emergency services or medical staff if you need help; with WorkSafe New Zealand if there is an incident the law requires us to report; and with the companies that run our systems, listed below.

Where it is kept

Our systems are hosted by Supabase, Vercel and Cloudflare, on servers in Sydney, Australia. Your information is protected by the same standards there as it would be here, and those providers process it only to run the service for us. Emails are sent through Resend. Your signature is stored separately from everything else and can only be opened through a link that expires after a few minutes.

How long we keep it

• Medical details you type in — 90 days. They matter for your trip and for a short while afterwards in case something comes up. After that we delete the detail automatically. We keep only the fact that a condition was declared and reviewed, which is part of the safety record.
• Your check-in and signature — 7 years. This is the risk-disclosure record required of an adventure activity operator, and matches how long a claim could be brought.
• Your email address — until you unsubscribe or ask us to remove it.

Your rights

You can ask us what we hold about you, and ask us to correct it if it is wrong. You can ask us to stop emailing you at any time. You can ask us to delete your information, and we will — except the signed risk disclosure, which we are required to keep.

Email raft@rotorua-rafting.co.nz and we will come back to you within 20 working days. If you are not happy with how we have handled it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

If something goes wrong

If information is ever lost or accessed by someone who should not have it, and it could cause you harm, we will tell you and the Privacy Commissioner as the law requires.

Rotorua Rafting, 761 State Highway 33, Okere Falls 3074, New Zealand.