Privacy policy

Last updated: 13 September 2026

The short version. We use what you send through our forms to answer your enquiry, send the information pack you asked for, and plan your event. We use analytics and advertising tools to understand how people find our website and to show our advertisements to people who have visited it. We do not sell your personal information.

Kauri Bay Auckland Limited ("we" or "us") collects, holds, uses and discloses personal information in connection with our website at kauribay.co.nz. We comply with the New Zealand Privacy Act 2020 and the thirteen Information Privacy Principles.

Kauri Bay Auckland Limited, 777 Clevedon-Kawakawa Road, Clevedon, Auckland 2585, New Zealand. Phone +64 9 298 7779. Email events@kauribay.co.nz.

1. What this policy covers

This policy covers kauribay.co.nz and the enquiry and information-pack forms on it. Our Christmas functions page at christmas.kauribay.co.nz has its own privacy notice.

2. What information we collect

From you, when you submit a form

Your name, email address and, if you give them, your phone number and company.
Details of the event you are planning, such as date, guest numbers or the package, activity or vehicle launch you are interested in.
Anything else you choose to write in a message field.

Automatically, when you visit the website

Your IP address and the approximate location derived from it, your device and browser, and the pages you view — through Google Analytics, the Meta pixel, HubSpot and standard web-server and security logs.
The page that referred you, and the advertising parameters in the link you arrived on: Google Ads click identifiers (gclid, gbraid, wbraid), the Facebook click identifier (fbclid) and any utm campaign parameters. If you then submit a form, these are sent with your enquiry so we can tell which advertisement or link brought you to us.

We do not knowingly collect information from anyone under 16 years of age.

3. Why we collect it

To answer your enquiry, send the information you requested, and arrange quotes, site visits and bookings.
To run, secure and improve the website, and to measure how visitors find and use it.
To measure and improve our advertising.
To show our advertisements on Google services and Meta services (such as Facebook and Instagram) to people who have previously visited our websites.
To meet our legal obligations.

We will not use your information for an unrelated purpose without your consent.

Marketing. Submitting a form does not sign you up to a mailing list. Contacts created from our website forms are recorded as non-marketing, and we do not send marketing email to them on the strength of an enquiry. If we ever want to send you marketing, we will ask you first.

4. How we hold it

Form submissions are stored in our website database and in our customer-relationship system, HubSpot (United States), and are emailed to our events team through Microsoft 365. The website is hosted on servers operated by Zonata Limited, our technology service provider, in New Zealand, and backed up to cloud storage in Australia.

We use industry-standard measures — TLS encryption in transit, access controls, a web application firewall and audit logging — to protect your information. We keep enquiry records for as long as we need them to run our business and to meet New Zealand tax and contract-law retention obligations, typically up to seven years, and then delete or de-identify them.

5. Who we share it with

We share information only with the parties below, and only as far as the stated purpose needs.

Recipient	Purpose	Country	Information shared
HubSpot	Storing and managing your enquiry; understanding which pages an enquirer viewed	USA	Everything you enter in a form, the referring page and advertising parameters in §2, and — once you have submitted a form — the pages you view on our website, linked to your email address
Microsoft 365	Notifying our events team and replying to you	USA / EU	The contents of your enquiry
Google Analytics	Website analytics	USA	A pseudonymous identifier for your browser, the pages you view, your device and browser, and approximate location. Not your name, email address or phone number
Google Ads	Conversion measurement, and showing our advertisements to people who have visited our website	USA	A pseudonymous identifier for your browser, the pages you view, and that an enquiry was submitted. Not your name, email address or phone number
Meta (Facebook, Instagram)	Advertising measurement, and showing our advertisements to people who have visited our website	USA	A pseudonymous identifier for your browser, the pages you view, and that an enquiry was submitted, with its general category. Not your name, email address, phone number or anything you type into a form
Akismet (Automattic)	Filtering spam from our information-pack request forms	USA	The contents of an information-pack request, your IP address and browser details
Google Maps, YouTube	Showing our location map and embedded videos	USA	Your IP address and browser details, when those elements load
Google Fonts	Displaying the website's typefaces	USA	Your IP address and browser details
AddToAny	Share buttons	USA	Your IP address and browser details, when the share buttons load
Wordfence	Website security	USA	Your IP address and the requests your browser makes to our website
Backblaze (via Zonata)	Backup copies of our website	Australia	The website database, including form submissions stored in it

The recipients above are based outside New Zealand. See §8.

6. Cookies and similar technologies

Google Analytics sets _ga and _ga_* to measure traffic.
Google Ads may store advertising click information in first-party cookies whose names begin _gcl_ (including _gcl_aw), which expire after 90 days, and uses Google's own cookies to show our advertisements to past visitors.
Meta pixel sets _fbp (and _fbc if you arrived from a Facebook or Instagram link), which expire after 90 days. It records the pages you view and whether an enquiry was sent, never what you type into a form. You can control ads based on your activity in your Facebook or Instagram ad preferences, and in Google's My Ad Center.
HubSpot sets __hstc, hubspotutk, __hssc and __hssrc to recognise returning visitors and, after you submit a form, to connect your visits to your enquiry.
Our own attribution cookies, named kb_ft_* and kb_lt_*, are set only when you arrive through a link carrying the advertising parameters in §2. They hold those parameters, your landing page and referring page, and expire after 90 days.
Pop-up and security cookies from our pop-up tool and Wordfence remember whether you have closed a pop-up and protect the website.

You can disable cookies in your browser settings. The website and its forms will still work; only our analytics will be less complete.

7. Your rights under the Privacy Act 2020

You have the right to ask us for the personal information we hold about you, to have information corrected if it is wrong or out of date, to ask us not to contact you further, and to complain to us or to the Office of the Privacy Commissioner.

To do any of these, email events@kauribay.co.nz. We will respond within 20 working days, as the Privacy Act requires.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner, PO Box 10094, The Terrace, Wellington 6143, phone 0800 803 909, privacy.org.nz.

8. Overseas disclosure

Some of the recipients in §5 are based overseas, principally in the United States. Where we transfer your information outside New Zealand we rely on the recipient's own privacy commitments and, where relevant, on contractual data-protection clauses, so that your information is protected to a standard comparable to the Privacy Act 2020. By submitting a form you consent to that overseas disclosure for the purposes set out in this policy.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change.

10. Contact

Privacy Officer, Kauri Bay Auckland Limited — events@kauribay.co.nz, +64 9 298 7779, 777 Clevedon-Kawakawa Road, Clevedon, Auckland.