Privacy Policy

The Hosting Co. respects your privacy and is committed to protecting personal information in accordance with the Privacy Act 2020 and the applicable Information Privacy Principles.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:

• visit or use our website;
• contact us;
• request a property appraisal or revenue assessment;
• create or access an owner account;
• provide information about a property;
• use our owner portal;
• interact with a property managed or marketed by us;
• apply to work with us or provide services to us; or
• otherwise deal with The Hosting Co.

In this Privacy Policy, “The Hosting Co.,” “we,” “us” and “our” mean:

[FULL LEGAL ENTITY NAME], trading as The Hosting Co. NZBN: [NZBN] Company number: [COMPANY NUMBER, IF APPLICABLE] Registered or principal address: [BUSINESS ADDRESS]

This Privacy Policy applies to personal information held by us. It does not apply to information that does not identify, and cannot reasonably be used to identify, an individual.

The Hosting Co. provides short-term, flexible stay and property management services in New Zealand.

Depending on the circumstances, we may act as:

• a property manager for a property owner;
• a listing or co-hosting service provider;
• an administrator of owner accounts;
• a coordinator of cleaners, maintenance providers and other contractors;
• a marketer of accommodation;
• a recipient of property appraisal enquiries;
• an intermediary between owners, guests, contractors and booking platforms; or
• an accommodation provider or booking facilitator where direct bookings are offered.

A separate property management agreement governs the services supplied to each owner. This Privacy Policy governs how personal information is handled.

Our Privacy Officer is responsible for overseeing compliance with this Privacy Policy and the Privacy Act 2020.

Privacy Officer: [NAME OR POSITION] Email: [PRIVACY@YOURDOMAIN.CO.NZ] Postal address: [POSTAL ADDRESS] Telephone: [PHONE NUMBER]

Privacy requests and complaints should be directed to the Privacy Officer.

The information we collect depends on how you interact with us.

4.1Identity and contact information

We may collect:

• full name;
• preferred name;
• email address;
• telephone number;
• postal address;
• residential address;
• date of birth where reasonably required;
• signature;
• role, employer or business name;
• NZBN or company details;
• authorised representative information; and
• emergency contact details.

4.2Property information

We may collect information concerning a property, including:

• street address and location;
• ownership or authority to manage the property;
• property type;
• bedrooms, bathrooms and guest capacity;
• floor area;
• amenities and facilities;
• photographs, videos, floor plans and descriptions;
• access instructions, alarm instructions, lockbox or smart lock details;
• parking information;
• body corporate or building requirements;
• insurance information;
• compliance documents;
• maintenance history;
• utility information;
• appliance information;
• safety information;
• house rules;
• availability and owner use dates;
• booking history;
• revenue and expense information;
• occupancy information; and
• other information needed to assess, market or manage the property.

Some property information may be personal information where it identifies or relates to an individual.

4.3Owner account and portal information

We may collect:

• account username;
• account email;
• authentication and session information;
• password reset information;
• login timestamps;
• account access records;
• user permissions;
• messages and instructions;
• booking information;
• financial statements;
• property reports;
• documents uploaded to the portal; and
• actions taken within the portal.

Passwords may be processed by our authentication provider. We do not intend to store readable versions of user passwords.

4.4Enquiries and property assessments

When you contact us or request an assessment, we may collect:

• the information entered into the form;
• property address;
• property characteristics;
• ownership or management status;
• intended property use;
• expected availability;
• current or historical rental information;
• preferred contact method;
• notes from telephone calls or meetings; and
• any documents or photographs you provide.

4.5Guest and booking information

Where we manage or facilitate accommodation, we may collect:

• guest and additional occupant names;
• contact details;
• booking dates;
• number and ages of occupants where reasonably required;
• identity verification information;
• booking platform profile information;
• payment or transaction references;
• communications;
• special requests;
• accessibility requirements voluntarily provided;
• check-in and check-out information;
• complaints;
• reviews;
• incident information;
• damage information;
• security deposit or claim information; and
• information required to comply with house rules, safety obligations or booking conditions.

We will not intentionally collect sensitive information unless it is reasonably necessary for a lawful purpose or voluntarily provided in connection with a relevant request.

4.6Contractor and supplier information

We may collect information relating to cleaners, tradespeople, photographers, linen providers, agents and other suppliers, including:

• names and contact details;
• business and tax information;
• bank account information;
• qualifications, licences and insurance;
• job instructions;
• attendance records;
• invoices;
• photographs and service records;
• access information; and
• communications.

4.7Payment and financial information

We may collect or process:

• invoicing details;
• bank account details;
• payout instructions;
• transaction information;
• amounts charged or paid;
• GST information;
• commission information;
• expense records;
• refunds;
• debt or payment status information; and
• records required for accounting, tax, fraud prevention or dispute purposes.

Where a third-party payment provider is used, that provider may collect and process card or payment credentials directly. We may receive transaction confirmations and limited payment information without receiving complete card details.

4.8Documents and photographs

You may provide documents including:

• proof of ownership or authority;
• insurance documents;
• body corporate documents;
• compliance certificates;
• identification documents;
• contracts;
• property manuals;
• invoices;
• repair records;
• inspection reports; and
• correspondence.

Property photographs may incidentally capture people, vehicles, personal belongings, artwork, identifying documents or other personal information. You must remove unnecessary personal or confidential material before supplying photographs to us.

4.9Employment and recruitment information

Where applicable, we may collect:

• employment history;
• curriculum vitae;
• qualifications;
• references;
• right-to-work information;
• interview notes;
• background information lawfully obtained; and
• other information reasonably required for recruitment or engagement.

4.10Technical and usage information

When you access our website or portal, we or our service providers may automatically collect:

• IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• approximate location derived from IP address;
• pages viewed;
• links selected;
• referral source;
• date and time of access;
• session information;
• error and performance information;
• security events; and
• cookie or similar technology information.

We may collect personal information:

• directly from you;
• through our website;
• through our forms;
• through the owner portal;
• by email, telephone, text message or in person;
• through property inspections;
• through contracts and onboarding;
• through booking and accommodation platforms;
• through property owners or their representatives;
• through guests or additional occupants;
• through cleaners, contractors or suppliers;
• through payment or accounting providers;
• from publicly available sources;
• from property, company or government records where lawful;
• through analytics, security and hosting systems;
• through referrals; or
• from another person or organisation where permitted by law.

We aim to collect personal information directly from the individual concerned wherever reasonably practicable.

We may sometimes receive personal information about you from another person or organisation. Examples include:

• an owner providing information about an authorised representative;
• a guest providing the names of additional occupants;
• a contractor reporting an incident involving an owner or guest;
• a booking platform providing booking and profile information;
• a property owner providing information relating to previous bookings;
• a referee supplying information about a job applicant;
• a building manager supplying access or incident information; or
• a person submitting a complaint involving another individual.

Where the Privacy Act 2020 requires us to do so, we will take reasonable steps to notify you that we have collected your information indirectly and explain:

• that we have collected it;
• why we collected it;
• who will receive it;
• whether providing it was compulsory or voluntary;
• the consequences of not providing it where relevant; and
• your rights to access and request correction.

We may not provide a separate notification where an applicable legal exception permits us not to do so, including where you are already aware, notification would not prejudice your interests, notification is not reasonably practicable, or another statutory exception applies.

We may collect, use and disclose personal information for lawful purposes connected with our functions and activities, including to:

• respond to enquiries;
• assess whether a property is suitable for our services;
• prepare property appraisals and revenue estimates;
• provide property management, co-hosting or accommodation services;
• set up, optimise and administer property listings;
• coordinate bookings;
• communicate with owners, guests and contractors;
• manage check-in and check-out;
• coordinate cleaning, linen, maintenance and repairs;
• manage incidents, complaints and damage claims;
• verify identity or authority;
• assess fraud, safety, payment or party risk;
• administer owner accounts and portal access;
• process payments, fees, expenses and payouts;
• produce statements and performance reports;
• comply with contracts;
• protect properties, guests, owners, staff and contractors;
• improve our website, portal, services and internal systems;
• troubleshoot errors and maintain security;
• conduct analytics and business planning;
• maintain business and tax records;
• enforce our terms and agreements;
• establish, exercise or defend legal claims;
• comply with legal, regulatory, insurance and safety obligations;
• prevent, detect or investigate unlawful activity;
• send service communications;
• send marketing communications where permitted;
• manage recruitment and supplier relationships; and
• carry out another purpose that is authorised by you or permitted by law.

We will not use personal information for a materially different purpose unless that use is authorised or permitted under the Privacy Act 2020.

Property appraisals and revenue estimates may use information including:

• property characteristics;
• owner-supplied information;
• comparable accommodation;
• advertised rates;
• historical performance information;
• location;
• seasonality;
• market demand;
• events;
• availability;
• amenities; and
• internal assumptions or modelling.

We may use automated calculations to support an estimate. Automated results may be reviewed or adjusted by a member of our team.

Revenue estimates are not credit decisions, insurance decisions or decisions having equivalent legal effect. They are indicative commercial assessments.

We may retain appraisal information to:

• respond to the enquiry;
• improve the estimate;
• compare performance assumptions;
• follow up concerning our services; and
• maintain a record of advice or representations made.

Our website may use cookies, local storage and similar technologies.

9.1Essential technologies

Essential technologies may be used to:

• operate the website;
• maintain sessions;
• authenticate users;
• protect accounts;
• remember security settings;
• balance traffic; and
• prevent fraud or misuse.

The website may not function properly if essential technologies are disabled.

9.2Analytics technologies

We may use analytics tools to understand:

• website traffic;
• page usage;
• navigation;
• errors;
• performance; and
• campaign effectiveness.

9.3Advertising technologies

Where we introduce advertising or remarketing tools, those tools may use cookies or identifiers to measure advertisements or display relevant marketing.

Where required or appropriate, we will provide cookie controls before activating non-essential technologies.

You can also manage cookies through your browser. Blocking cookies may affect website or portal functionality.

We may send information concerning:

• The Hosting Co. services;
• property management insights;
• market updates;
• promotions;
• new features; and
• relevant business updates.

We will send commercial electronic messages only where permitted by applicable law.

Marketing emails or text messages will include an unsubscribe method where required. Unsubscribing from marketing does not stop operational communications concerning an enquiry, account, booking, contract, security issue or service.

We do not sell personal information to third parties for their independent marketing.

We may disclose personal information where reasonably necessary to:

• property owners;
• authorised owner representatives;
• guests and authorised occupants;
• cleaners;
• linen and laundry providers;
• maintenance providers and tradespeople;
• photographers, stylists and property service providers;
• building managers and body corporates;
• booking and accommodation platforms;
• payment processors and financial institutions;
• accountants, insurers, auditors and professional advisers;
• technology, hosting, storage and security providers;
• email, communication and customer management providers;
• analytics providers;
• debt recovery providers;
• prospective purchasers or successors to our business;
• regulators, courts, tribunals, law enforcement bodies or government agencies;
• emergency services; or
• another person where authorised by you or permitted by law.

We seek to disclose only the information reasonably required for the relevant purpose.

Contractors receiving access information should receive only the information required to perform the assigned work.

Our website and services may use third-party providers, including:

12.1Supabase

Supabase may be used for:

• authentication;
• database hosting;
• account management;
• file storage;
• property photographs;
• owner documents; and
• application infrastructure.

12.2Vercel

Vercel may be used for:

• website hosting;
• deployment;
• content delivery;
• application logs;
• security; and
• performance monitoring.

12.3Google services

Google services may be used for:

• address search;
• Places information;
• mapping;
• geocoding;
• analytics; and
• related functionality.

12.4Booking and property management platforms

We may use platforms such as:

• Airbnb;
• Booking.com;
• Vrbo;
• Hostaway;
• Guesty;
• PriceLabs;
• AirDNA; or
• another booking, channel management, property management or pricing provider.

The services actually used may change as our business develops.

Each third-party provider processes information under its own terms and privacy arrangements. We remain responsible for our own obligations under New Zealand privacy law.

Some service providers, systems, support teams or infrastructure may be located outside New Zealand.

Personal information may therefore be stored, accessed or processed in countries whose privacy laws differ from those of New Zealand.

Where the Privacy Act 2020 requires us to do so, we will take reasonable steps to ensure an overseas recipient is subject to privacy safeguards comparable to those required in New Zealand, is otherwise covered by an applicable exception, or processes the information as our agent.

Where information is transferred overseas through a platform selected directly by you, that platform’s own privacy terms may also apply.

Where you provide personal information concerning another person, you confirm that:

• you are authorised to provide it;
• the information is accurate to the best of your knowledge;
• providing it does not breach an obligation of confidence;
• the person has been informed where required; and
• we may process the information for the purposes described in this Privacy Policy.

This applies particularly to:

• additional property owners;
• company directors;
• owner representatives;
• guests;
• additional occupants;
• emergency contacts;
• referees;
• contractors; and
• people shown in photographs or documents.

Do not provide another person’s identification document, health information, financial information or other sensitive information unless it is necessary and you have authority to do so.

We take reasonable steps to ensure that personal information used or disclosed by us is accurate, complete, relevant, up to date and not misleading.

You should notify us if your information changes or if you believe information held by us is inaccurate.

Owners are responsible for keeping account, property, payment and authorised user information current.

We use safeguards that are reasonable in the circumstances to protect personal information from:

• loss;
• unauthorised access;
• unauthorised use;
• modification;
• disclosure;
• copying; and
• other misuse.

Safeguards may include:

• HTTPS encryption;
• authentication controls;
• access restrictions;
• role-based permissions;
• secure cloud infrastructure;
• logging and monitoring;
• environment variable controls;
• supplier controls;
• account security;
• data backups where appropriate; and
• staff or contractor confidentiality requirements.

No internet transmission, storage system or security measure is completely secure. We cannot guarantee absolute security.

You are responsible for:

• choosing a strong password;
• keeping login credentials confidential;
• signing out of shared devices;
• restricting access to authorised users; and
• notifying us promptly of suspected unauthorised access.

A privacy breach may include unauthorised or accidental access to, disclosure of, alteration of, loss of, destruction of, or inability to access personal information.

Where a privacy breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

We may also notify:

• law enforcement;
• insurers;
• service providers;
• property owners;
• platform providers; or
• other relevant parties,

where reasonably necessary to investigate, contain or respond to the breach.

We retain personal information only for as long as reasonably required for the purposes for which it was collected or where retention is required or permitted by law.

Retention periods may depend on:

• the nature of the information;
• an active or prospective management relationship;
• booking history;
• contractual requirements;
• tax and accounting obligations;
• dispute or claim periods;
• fraud and security requirements;
• insurance requirements;
• platform requirements; and
• backup or technical constraints.

When information is no longer reasonably required, we may securely delete, destroy or de-identify it.

Deletion from active systems may not immediately remove information from encrypted backups, audit logs or archives. Such information will remain protected and will be removed or overwritten through normal retention cycles.

You may request access to personal information that we hold about you.

Requests should be sent to our Privacy Officer and should include enough information for us to:

• confirm your identity;
• identify the requested information; and
• locate the relevant records.

We may ask for identity verification before releasing information.

We will respond within the period required by the Privacy Act 2020.

Access may be withheld where the Privacy Act permits or requires withholding, including where disclosure would unreasonably affect another person’s privacy, prejudice safety or law enforcement, reveal legally privileged material, or another statutory ground applies.

You may ask us to correct personal information that you believe is inaccurate, incomplete or misleading.

Where we do not make a requested correction, you may ask us to attach a statement of the correction sought to the relevant information where required by law.

Where reasonably practicable, we may inform recipients of information that a correction has been made.

Raise privacy concerns first with our Privacy Officer:

Email: [PRIVACY EMAIL] Postal address: [POSTAL ADDRESS]

We will acknowledge and investigate the complaint and respond within a reasonable period.

You may also complain to the Office of the Privacy Commissioner if you are dissatisfied with our response.

Our website and owner services are not directed at children.

Guests or additional occupants may include people under 18. Information about minors should be provided only by a parent, guardian, booking guest or other authorised adult and only where reasonably necessary.

We do not knowingly invite children to create owner accounts or submit property management enquiries.

Our website may link to third-party websites or platforms.

We do not control the privacy practices of those third parties. Their own privacy policies apply to information collected directly by them.

A link does not mean that we endorse or accept responsibility for a third party’s privacy, security, content or conduct.

We may update this Privacy Policy where our services, systems, providers or legal obligations change.

The updated version will be published on our website with a revised “Last updated” date.

Where a change materially affects how existing personal information is handled, we may provide additional notice where reasonably appropriate or required by law.

Privacy questions, requests and complaints should be sent to:

Privacy Officer [FULL LEGAL ENTITY NAME] trading as The Hosting Co. Email: [PRIVACY EMAIL] Telephone: [PHONE] Postal address: [POSTAL ADDRESS]