Privacy Policy

1. About this policy

InnList Holiday Homes is the trading name of Rotorua Retreats Limited ("InnList", "we", "us", "our"). We manage holiday homes in Rotorua and around the Rotorua lakes for their owners.

This policy explains:

• what personal information we collect
• how we collect it
• what we use it for
• who we share it with
• the choices you have.

It applies to homeowners, guests, suppliers, team members and visitors to our website.

We handle personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles. That includes IPP3A, which covers information we collect about you from someone else.

2. How to contact us

If you have a question about this policy, want to see or correct the information we hold about you, or want to make a complaint, please contact our Privacy Officer:

• Post: Privacy Officer, Rotorua Retreats Limited (trading as InnList Holiday Homes), c/- Blackslate Accountants, 1350 Hinemoa Street, Rotorua 3010, New Zealand
• Email: info@innlist.co.nz
• Phone: +64 21 155 1444
• Website: www.innlist.co.nz

Rotorua Retreats Limited, NZBN 9429030071964.

3. Information we collect

What we collect depends on how you deal with us.

3.1 Homeowners and prospective homeowners

• Name, postal address, email address and phone number
• Property details, including address, features, photos and access information
• Bank account details so we can pay you
• Your IRD number and GST registration status. The law requires owners to give us these when we list their home on booking platforms. We use them to:
  • apply the right GST treatment
  • pass on any flat-rate GST credits
  • complete our own GST returns.

    If you don't give them to us, you may not receive flat-rate credits.

• Emails, calls, messages and meeting notes
• Booking, occupancy and revenue history for your property

3.2 Guests and prospective guests

• Name, email address, phone number and country of residence
• Booking details, dates of stay and number of guests
• Payment confirmation details (we don't store full credit card numbers)
• Identification or verification details required by the booking platform you used
• For some bookings, your home address, a photo of your passport or driver licence and, for a few bookings, a selfie, collected through our guest app at online check-in (see section 9)
• Which partner offers you tap on in our guest app's guidebook (see section 9)
• Reviews, ratings, feedback (including private feedback you send us through a booking platform), complaints and incident reports
• Messages with us before, during and after your stay
• Readings from noise monitoring sensors in some of our homes (see section 8)

3.3 Website visitors

• Pages visited, time spent, the website that referred you, and your general location (city or region)
• Device, browser and IP address
• Cookie identifiers and advertising IDs (see section 11)
• Anything you send us through an enquiry form or the "List Your Home" form

3.4 Suppliers, contractors and team members

• Contact details and bank account details
• Tax details, such as your IRD number, tax code, and KiwiSaver and student loan details, so we can deduct the right tax under PAYE and schedular payment rules
• Insurance, qualifications and compliance information, where relevant
• Records of work completed, such as cleaning and maintenance tasks, and who completed them
• Guest feedback relating to work completed (see section 5)
• Health and safety records, such as incident and injury reports

If you work for us or apply for a job with us, we'll give you a separate notice explaining how we handle your employment information.

4. How we collect your information

4.1 Directly from you

We collect information when you:

• fill in a form on our website
• email or call us
• sign a management agreement
• make a booking
• leave a review
• otherwise deal with us.

4.2 From other sources

Sometimes we receive information about you from someone else. When that happens, IPP3A requires us to take reasonable steps to let you know, and this policy is part of how we do that. These sources include:

• Booking platforms such as Airbnb, Booking.com and Vrbo, when you book one of our homes
• Our property management and operations systems (Guesty and Breezeway) and connected channel managers
• Google, when you leave a review of our business (see section 10)
• Homeowners who refer guests, neighbours, suppliers or other owners to us
• Suppliers who give us contact details for their staff or subcontractors
• Partner businesses that refer you to us
• Publicly available sources, such as the Companies Office register, social media profiles and Google business listings

If we've contacted you and you'd like to know how we got your details, please ask us using the details in section 2.

5. How we use your information

We use personal information to run our holiday home management business, including to:

• Respond to enquiries from prospective owners and guests
• Set up and manage owner accounts, properties and management agreements
• Take, confirm and manage bookings, including check-in, check-out and help during your stay
• Pay owners, suppliers and contractors, and meet our tax and accounting obligations
• Organise cleaning, linen, maintenance and other property services
• Reply to reviews, and read reviews and feedback to find cleaning, maintenance, safety and other problems we should fix
• Check and improve the quality of our cleaning and property care. This includes:
  • linking guest feedback to the stay and to the team member or contractor who prepared the home
  • using it for feedback, training, recognition, performance conversations and planning work.

    Before feedback is used in any decision about a team member or contractor, a person always checks the original feedback and checks that it has been linked to the right person. Team members can ask to see feedback linked to them.

• Prevent parties, noise complaints and damage to our homes (see sections 8 and 9)
• Improve our website, our homes and the guest experience
• Send service messages (such as booking confirmations, statements and owner updates) and, where you've agreed or the law allows it, marketing about our homes, offers and news
• Run online advertising campaigns and measure how they perform (see section 7)
• Meet our legal obligations, prevent fraud and resolve disputes

Use of AI tools

We use artificial intelligence (AI) tools, including Claude by Anthropic, to help us:

• draft replies to reviews
• sort and summarise reviews and guest feedback, for example to spot recurring maintenance problems.

Our team checks AI output before we act on it, and any decision about a guest, owner or team member is always made by a person. Where practical, we remove names before information is sent to our AI provider. We don't use AI tools to make decisions about you that have legal or similarly significant effects. Our AI provider processes this information on our behalf, under business terms that don't allow it to use our data to train its models.

6. Who we share your information with

We share personal information only where it's needed for the purposes above. This includes:

• Booking platforms and channel managers: for example Airbnb, Booking.com, Vrbo and Guesty
• Homeowners:
  • booking details for their home, such as dates, number of guests, booking income, fees, and GST or flat-rate credit amounts
  • information about incidents, damage or safety issues at their property.

    We only share a guest's name or contact details with an owner where that's needed, for example to deal with damage or an incident.

• Our service providers: cleaning, linen, maintenance and other contractors who work on our behalf
• Business systems we use:
  • Guesty (property management)
  • Breezeway (cleaning and maintenance)
  • PriceLabs (pricing)
  • Xero (accounting)
  • Smartly (payroll)
  • Aeve.ai (guest messaging)
  • Microsoft 365 (email and files)
  • Google (reviews and analytics)
  • Minut (noise monitoring)
  • Vercel and Supabase (hosting and secure storage for our guest app, in Sydney, Australia)
  • Anthropic (AI tools)
• Payments and finance: payment providers, banks, and our accountants and bookkeepers
• Inland Revenue:
  • payroll and contractor tax information
  • our GST returns, including flat-rate credits we pass on to owners
  • information Inland Revenue asks us for under its legal powers.

    Booking platforms may also report information about the homes we list, and the income they earn, to Inland Revenue or overseas tax authorities under international platform reporting rules.

• Councils: Rotorua Lakes Council or other local authorities, for example for rating, resource consent or noise complaints, where you ask us to or the law requires it
• Marketing and advertising partners: our agency Burst Digital, and platforms such as Meta (Facebook and Instagram), Google, LinkedIn and TikTok
• Authorities and advisers: government agencies and regulators (such as WorkSafe, Fire and Emergency New Zealand, ACC and the Police), and our professional advisers, where the law requires or allows it

Information stored or shared overseas

Some of the organisations we use are based overseas, mainly in the United States, Australia, the United Kingdom and the European Union.

Some overseas providers only store or process information for us, such as our cloud software and AI providers. We stay responsible for that information under the Privacy Act.

Other overseas organisations use the information for their own purposes, such as booking and advertising platforms. We only share information with them where we believe on reasonable grounds that they must protect it in a way that gives comparable safeguards to New Zealand law, for example under their contract terms with us. If we can't be confident of that, we'll tell you and ask for your permission first.

7. Online advertising

We use online advertising to promote our holiday homes and our property management services. Our advertising agency, Burst Digital, helps us run campaigns on platforms including Meta (Facebook and Instagram), Google, LinkedIn and TikTok. As part of these campaigns we may:

• Upload lists of people who have enquired with us or agreed to hear from us, as encrypted (hashed) email addresses. We do this so we can show them ads or leave them out of campaigns
• Build "lookalike" audiences so the platforms can find people with similar interests
• Use website tracking pixels and tags to measure how our ads perform and to show ads to people who've visited our site

We only send marketing emails or texts to people who have agreed to receive them, or where the law otherwise allows it. We don't use guest details we receive from booking platforms, or details you give us through online check-in, for marketing or advertising audiences unless you've given us your express consent. If a partner business refers you to us, we'll tell you how we got your details in our first message.

You can opt out of our marketing at any time by using the unsubscribe link in any of our emails or by contacting us. You can also manage your advertising preferences in your Google, Meta, LinkedIn or TikTok account settings.

8. Noise monitoring in our homes

Some of our homes have Minut sensors. These sensors:

• Measure noise levels (in decibels only). They never record audio or conversations, and they have no cameras.
• Estimate how many people are in the home by counting the nearby wireless devices, such as phones. The sensor doesn't record who owns a device or what is on it, and it doesn't identify anyone. We compare the count with the number of guests booked.
• Track temperature and humidity.

Sensors are placed in living areas, never in bedrooms or bathrooms. Minut sensors aren't smoke or fire alarms, and our homes have separate smoke alarms. Where a home has a sensor, its listing says so.

We use the readings:

• to step in early if a home is getting too loud
• to protect the home from parties and damage
• to spot problems such as damp.

If there's a noise complaint, an incident or damage, we may share the relevant readings with the homeowner, the booking platform, Rotorua Lakes Council or the Police. We don't share readings with neighbours. We keep readings for up to 90 days, unless we need them to deal with an incident.

9. Our guest app and online check-in

Each booking gets a private web page at guest.innlist.co.nz with your arrival details, door code, wifi, house information and our local guidebook. The link is unique to your booking, so please don't share it.

Who is asked to check in. Guests who book directly with us, or through Booking.com or Vrbo, complete online check-in before we release the door code. Guests who book through Airbnb aren't asked for check-in details or ID through our app.

What we collect. The lead guest's name, email, mobile number and home address, and a photo of their passport or driver licence. You can cover the licence or passport number and date of birth - we only need the name and photo to be clear.

Selfies for some bookings. For a small number of bookings, such as those made within 48 hours of arrival or by guests with a Rotorua home address, we also ask for a selfie. A person on our team compares it with your ID photo by eye. We don't use face recognition or any software to compare faces, and your selfie is never sent to an AI service. If you'd rather not take a selfie, message us and we'll do a short video call instead, at no cost.

Why. Our homes are self check-in with no one on site. Checking who is staying helps keep our homes and neighbours safe and helps us follow up if anything goes wrong during a stay.

How your ID photo is checked. Your ID photo is checked by an AI service run by Anthropic, a US company, to confirm it's a readable ID in the booking name. Anthropic processes it only for us, doesn't use it to train its models and normally deletes it within 30 days. It doesn't compare your face with anything. If the check can't confirm your ID, a person on our team looks at it instead. No decision about your stay is made by AI alone.

Where it's stored. The guest app and its storage are hosted in Sydney, Australia (Vercel and Supabase). ID photos and selfies are kept in private storage that only our team can see. Your contact details are also added to your guest record in Guesty, our booking system.

How long we keep it. ID photos and selfies are deleted automatically 90 days after you check out. Contact details from online check-in are deleted automatically 2 years after you check out. We keep either longer only if we need them for an open incident, damage claim or dispute, and delete them once it's resolved.

If you'd rather not check in online. Message us through your booking or call us and we'll arrange another way to confirm who's staying.

Guidebook partners. Our guidebook includes local businesses that offer InnList guests a discount. When you tap a partner's booking link or copy a discount code, we record which offer was tapped and for which booking, so we can track commissions. We don't share your details with partner businesses. We may earn a small commission when you book through these links - it never costs you more.

Your rights. You can ask to see, correct or delete your check-in details at any time (see section 13).

10. Google Business Profile data

Our internal review system connects to InnList's own Google Business Profile through Google's API, with our permission as the account owner.

What we access. We access reviews of our business, including:

• the reviewer's public display name and profile photo link
• the star rating, review text and date
• our replies.

How we use it. We use this data only to read, reply to and analyse reviews so we can improve our homes and service.

Where it's stored. We store it in our review system on our own computer in New Zealand, with backups in our Microsoft 365 storage, protected by restricted access.

Who we share it with. We share review text with Anthropic only to tag topics such as cleaning or maintenance, under terms that don't allow Anthropic to train its models on it.

What we don't do. We don't sell Google user data, use it for advertising, or use it to develop or train general AI or machine learning models.

How long we keep it. We keep it while the review is live on Google and delete it within 90 days of it being removed. You can ask us to delete Google review data we hold about you by contacting us (section 2).

Our use of information received from Google APIs follows the Google API Services User Data Policy.

11. Cookies and website tracking

Our website uses cookies and similar technology to:

• make the site work
• remember your preferences
• measure traffic
• support our advertising.

These include:

• Essential cookies, which let the website work
• Analytics cookies (for example Google Analytics), which help us understand how the site is used
• Advertising cookies and pixels (for example the Meta Pixel and Google Ads tag), which let us measure and target our ads

You can block or delete cookies in your browser settings. Blocking some cookies may affect how the site works for you.

12. How long we keep your information

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires.

• Financial and tax records. This covers owner statements, booking and payment records, and supplier, contractor and payroll records. We keep them for 7 years after the end of the tax year they relate to, as New Zealand tax law requires. We keep them longer if Inland Revenue asks us to or there's an unresolved dispute.
• Owner agreements and bank details. Management agreements and owner contact details are kept for 7 years after our management relationship ends. Bank account details are removed from our payment systems once your final payment is made.
• Guest details. Guest contact details and messages are kept for 2 years after your stay. ID photos and selfies collected through our guest app are deleted 90 days after you check out; other identification details are kept only until the stay is complete. We keep either longer if we need them to deal with an incident, damage or a dispute.
• Health and safety records. This covers incident reports and safety issues raised in reviews, and what we did about them. We keep them for at least 5 years, or longer if they relate to a claim, investigation or dispute.
• Reviews. Reviews and review analysis are kept while they help us manage and improve our homes. Links between a review and a team member are removed after 24 months.
• Noise sensor readings are kept for up to 90 days, unless we need them for an incident.
• Marketing contact details are kept until you unsubscribe or ask us to delete them.
• Website analytics data is kept in line with our analytics provider's retention settings.

When we no longer need your information, we securely delete it or make it anonymous.

13. Your rights

Under the Privacy Act 2020 you can:

• Ask whether we hold personal information about you, and ask to see it
• Ask us to correct information you think is wrong, incomplete or out of date
• Ask us to delete information we no longer need to keep
• Ask how we got your information, if we collected it from someone other than you
• Withdraw your consent to marketing at any time

To do any of these things, contact us using the details in section 2. We'll respond within 20 working days. If we need longer, as the Privacy Act allows, we'll tell you why. If we decide not to correct information, you can ask us to attach a statement of the correction you asked for. We may need to confirm who you are before we release any information.

If you're not happy with how we've handled your information, please talk to us first. You can also complain to the Office of the Privacy Commissioner at www.privacy.org.nz or on 0800 803 909.

14. How we protect your information

We take reasonable steps to protect personal information from loss and misuse, and from access, change or disclosure without permission. These steps include:

• Limiting who can access our systems
• Using secure passwords, and two-step sign-in where available
• Training our team
• Using reputable service providers

We'll never change the bank account we pay you into based on an email alone. We'll confirm any change by calling you on the number we already hold. If you get a message claiming to be from us that asks for payment or bank details, please call us first.

No system is completely secure. If a privacy breach happens that is likely to cause serious harm, we'll tell the Privacy Commissioner and the people affected, as the Privacy Act requires. If we can't reach everyone affected, we'll give public notice.

15. Children

Bookings must be made by an adult. We don't knowingly collect personal information from children under 16, except as part of a booking made by a parent or guardian. If you think a child has given us personal information, please contact us and we'll remove it.

16. Changes to this policy

We may update this policy from time to time, for example when our services or the law change. The current version is always on this page, with the date it was last updated at the top. If we make significant changes, we'll let affected owners, guests, team members and contractors know directly.