Last updated: 6 September 2026

Kayak New Zealand Limited (trading as New Zealand Kayak School) (“we”, “us”, “our”) is committed to protecting your privacy. “You” and “your” refer to any individual whose personal information we collect, including website visitors, customers, training course participants, and newsletter subscribers. This Privacy Policy explains how we collect, use, store, and disclose personal information through our website https://www.nzkayakschool.com and while running our business, in accordance with the Privacy Act 2020 (New Zealand).

By using our website or otherwise providing us with personal information, you agree to the collection and use of your information as described in this policy.

New Zealand Kayak School is a New Zealand business based at 111 Waller Street, Murchison 7007, New Zealand, operated by Kayak New Zealand Limited (NZBN: 9429047599239). You can contact us using the details in the “Contact Us” section below.

Depending on how you interact with us, we may collect:

Contact form / general enquiries

• Name
• Email address
• Phone number
• Message content

Online shop (purchases)

• Name, billing and shipping address
• Email address and phone number
• Order history
• Payment information (processed by our payment provider, Stripe – see Section 4; we do not store full card details ourselves)

Training courses

• Participant’s name and date of birth
• Emergency contact name and phone number
• Relevant health or medical information (e.g. injuries, medical conditions, allergies, medications) that may affect a participant’s safety while taking part in whitewater activities
• Previous experience and skill level
• Photographs and video footage taken during your course, used to give you feedback on your technique and progress
• GPS location data, only if an emergency communications device carried during the course is activated in a genuine emergency

Where a participant is a minor, this information is provided by a parent or legal guardian on their behalf (see Section 10).

Automatically collected / cookies

• IP address, browser type, and device information
• Pages visited, time spent on site, referring website
• Cookies and similar tracking technologies (see Section 6)

Marketing

• Email address and name, for future communications

We only collect health and emergency contact information where it is necessary for the safe delivery of our courses and activities, and we treat this as sensitive information requiring extra care (see Section 5).

We collect and use personal information for the following purposes:

• To respond to enquiries and communicate with you
• To process and fulfil orders through our online shop
• To process payments
• To administer course bookings, including assessing the safety and suitability of participants, and contacting a participant’s emergency contact if needed
• To provide instruction and manage risk during courses and activities
• To give you photo or video feedback on your course performance
• To respond to a genuine emergency, including via activation of an emergency communications device
• To send you marketing communications, where you have opted in (you can unsubscribe at any time)
• To comply with our legal, accounting, tax, and health and safety obligations
• To protect the rights, property, or safety of New Zealand Kayak School, our staff, participants, the public, and “visitors to the workplace,” including members of the public recreating in the vicinity of our operations

We will only use personal information for the purpose it was collected, or for a directly related purpose, unless you consent otherwise or the law allows or requires it.

We do not sell your personal information. We may share it with:

• Online shop platform (WooCommerce) – our website’s shop, cart, and order records run on WooCommerce, which stores your order and account details on our website’s database.
• Payment processor (Stripe) – to process online payments. Stripe has its own privacy policy and security measures.
• Shipping and courier providers (e.g. NZ Post, Aramex, and Mainfreight) – to deliver physical orders, we share your name, delivery address, and contact details with relevant shipping and courier providers.
• Email marketing platform – if you subscribe to our newsletter, we may use a third-party email platform to send it. We are not currently sending newsletters via a connected platform; if this changes, we will update this section to name the platform used.
• Google Shopping – we use the CTX Feed plugin to share our product catalogue (product names, prices, images, and stock) with Google Shopping, so our products can appear in Google Shopping listings and ads.
• Google Maps – our website embeds a Google Map to help visitors find our location. Google may collect information (such as your IP address) when the map loads, in accordance with Google’s own privacy policy.
• IT and website service providers – who may have access to our website and its data for the purposes of maintenance, hosting, and technical support.
• Instructors and staff – who need access to relevant booking and health and emergency contact information to safely run courses for participants.
• Rescue and emergency authorities (e.g. Rescue Coordination Centre New Zealand) – if an emergency communications device is activated during a genuine emergency, your GPS location data is transmitted to search and rescue authorities to enable an emergency response.
• Emergency services or medical professionals – if required for the safety of a participant or others during an activity.
• Professional advisors, regulators, or authorities – where required by law, or to enforce our terms, protect our rights, or respond to a legal process.

Overseas disclosure

Some of the third-party providers we use (such as payment processors, Google, and website hosting and support providers) may store or process information on servers located outside New Zealand, including in countries such as the United States. Where we disclose personal information overseas, we take reasonable steps to ensure it is subject to privacy protections comparable to those under the Privacy Act 2020, including relying on the provider’s own compliance with recognised privacy or data protection frameworks. If you would like more information about a specific provider’s data handling practices, please contact us.

Where health, medical, or emergency contact information is provided for a participant as part of a course booking, we:

• Only collect what is reasonably necessary to assess and manage safety risks during the activity
• Limit access to this information to instructors and staff directly involved in delivering the course
• Do not use this information for any other purpose, including marketing
• Retain it in line with the periods set out in Section 8

Our website uses cookies and similar technologies to enable core website functionality, such as remembering items in your shopping cart during checkout (via WooCommerce). If we begin using website analytics, advertising, or remarketing tools (such as Meta Pixel) in future, we will update this policy to describe how they work and how you can opt out.

Some embedded third-party content, such as the Google Map on our site, may set its own cookies when it loads – this is controlled by Google, not by us (see Section 4).

You can control or disable cookies through your browser settings. Disabling cookies may affect some website functionality, such as the shopping cart.

We take reasonable steps to protect personal information from loss, misuse, unauthorised access, disclosure, alteration, or destruction. This includes:

• Using secure, reputable third-party providers for payment processing (we do not store full payment card details)
• Restricting access to personal information to staff who need it to do their jobs
• Using secure hosting and standard website security practices

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

The Privacy Act 2020 requires us not to keep personal information for longer than is required for the purposes for which it may lawfully be used. Beyond that general principle, some retention periods are required by other laws, while others are periods we have adopted as part of our business and risk-management practices.

Our default retention period is around 7 years, except where a different minimum or maximum applies (as set out below):

• General enquiries (contact form messages that do not lead to a booking or purchase).
• Shop orders and related financial records: at least 7 years after the end of the relevant income year, in accordance with New Zealand tax record-keeping requirements.
• Course booking records (such as name, date of birth, and experience level).
• Health, medical, and emergency contact information collected for the safety of adult and minor course participants.

Otherwise:

• Newsletter and marketing contact details: retained while you remain subscribed and there is a legitimate purpose for retaining the information. You can unsubscribe at any time, and we may periodically remove inactive or obsolete contacts.
• Incident and safety records: at least 10 years. This includes incident and accident reports, near-miss reports, safety investigations, and relevant corrective actions. This longer period is adopted as a risk-management measure.
• Photos and video taken for client feedback: retained for up to 12 months to allow you to request copies, then deleted, unless you ask us to delete them sooner.

Where information is no longer required for these purposes, we securely delete or de-identify it. These are our general retention practices rather than fixed legal minimums for every category. Different retention periods may apply where required by law, where information is relevant to an ongoing incident, complaint, investigation, dispute, or legal claim, or where there is another lawful reason to retain it.

Under the Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Correct that information if it is inaccurate, out of date, incomplete, or misleading

To make a request, contact us using the details below. We will respond within the timeframes required by law (generally within 20 business days) and will let you know if there’s a reason we can’t fulfil your request.

If you’re unhappy with how we’ve handled your personal information, please contact us first so we can try to resolve it. If you remain unsatisfied, you can make a complaint to the Office of the Privacy Commissioner:

• Website: https://www.privacy.org.nz/
• Phone: 0800 803 909

An “adult” is a person aged 18 years or older; a “minor” is a person aged 17 years or younger. Our courses and activities may include minor participants.

Where we collect personal information about a minor participant, we do so with the involvement and consent of a parent or legal guardian, who is responsible for providing accurate information – including health and emergency contact details – on the minor’s behalf.

We retain a minor participant’s health and safety-related records for longer than an adult participant’s records (see Section 8), reflecting that a legal claim involving a minor can be raised later than for an adult.

Our website may contain links to third-party websites (e.g. social media, brand partners, payment providers). We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies separately.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a new “Last updated” date.

If you have any questions about this Privacy Policy, or wish to access or correct your personal information, please contact us:

New Zealand Kayak School
111 Waller Street
Murchison 7007
New Zealand
Email: admin@nzkayakschool.com
Phone: +64 3 669 3330