Privacy Statement
Last updated: 10 September 2026
This statement explains how personal information is handled when you use this website or contact Shuffle Loft. For questions about your information, contact [email protected]. The supplied owner details are in our Legal Notice.
What we collect and why
The enquiry form collects your name, email, selected activity, preferred date and time, and number of guests. These are required so we can respond and understand the visit you are proposing. You can optionally provide a phone number and a message. Please provide only your own personal details, and do not include other guests’ names, medical records or sensitive information.
If required fields are missing, the form cannot send your enquiry. You can contact us by email or phone instead. We use information to answer questions, discuss arrangements, handle follow-up correspondence and address complaints. Sending an enquiry does not subscribe you to marketing.
Who receives your information
Enquiries are addressed only to [email protected] and are handled by the operator and authorised staff who need them. Hosting and email service providers process information as needed to operate the website and deliver correspondence. We may also use or disclose information where required or otherwise permitted by law.
Service providers or authorised recipients may process information outside New Zealand. We do not promise that information stays in New Zealand. The treatment of a service provider acting only on our behalf differs from disclosure to an overseas recipient using information for its own purposes. Where Information Privacy Principle 12 applies, the required basis and safeguards must be in place. You can contact us for information about the providers and arrangements used for your enquiry.
Website security and storage
The form uses a necessary session cookie, an anti-forgery token, a hidden spam trap and rate limiting. The session stores technical tokens, activity timestamps and the outcome of a submission, rather than a saved copy of the completed enquiry. Session access expires after two hours of inactivity. Information entered into a form remains in the displayed page when an error occurs; this website does not save it in localStorage or sessionStorage.
To limit automated submissions, the application stores a one-way hash derived from an IP address alongside recent attempt times. It does not put your message or email into these files. Attempts count towards a 15-minute window; expired files become eligible for housekeeping after a day. Hosting servers may also keep access and error logs containing IP addresses, requested URLs and times for security and operation, under the host’s retention arrangements.
Enquiries and replies are retained in the operational mailbox for as long as reasonably needed to resolve the request, manage agreed arrangements and meet applicable legal or complaint-handling needs. Correspondence should then be reviewed for deletion. The website does not automatically delete messages from the mailbox. Backups and provider logs follow their own retention arrangements. Access to mailboxes and hosting should be restricted to authorised people; no system can guarantee absolute security.
Optional advertising measurement
If you allow Marketing in Cookie settings, we load the Google tag for Google Ads. It measures advertising performance and clicks on “Send enquiry”, including clicks made while the form is incomplete. A tracked click does not mean an enquiry was sent or a visit was confirmed.
Google may receive page URLs, advertising click identifiers, your IP address, browser information and click events. It may use cookies and browser storage to recognise your browser and personalise advertising. Our click event does not include the name, email, phone number or message entered in the form, and this implementation does not enable enhanced conversions.
Marketing is off until you allow it. You can withdraw that choice in Cookie settings; future click conversions are then disabled and advertising consent is updated. Google may receive that consent update if its tag is already loaded. Google may process information outside New Zealand under its own arrangements. Read how Google uses information from sites that use its services and our Cookie Policy.
Access, correction and complaints
You may ask us to access or correct your personal information under the Privacy Act 2020. Contact us at the email above and explain your request. We may need to verify your identity before releasing information. If a correction is declined, you may request that a statement of the correction sought be attached to the information, where the Act provides for this.
Please contact us first if you have a privacy concern so we can try to resolve it. You can also contact the Office of the Privacy Commissioner. Relevant guidance includes IPP 3, IPP 12 and the Privacy Act 2020.