Privacy policy

1. Who we are

This policy explains how BAJ Technologies Limited (“BAJ”, “we”, “us”) handles personal information about guests who book accommodation, businesses that list accommodation (“partners”), and visitors to our websites. We follow the New Zealand Privacy Act 2020.

2. What we collect

Guests

• Your name, email address and, if you give it, phone number.
• Your stay: the property, dates, rooms, number of adults and the age of each child.
• Payment status and references from our payment providers. We do not receive or store full card numbers.
• Anything you tell us, such as a cancellation reason or a support email.
• If you write a review: your rating, your words and the name you choose to show with it, which are published on the property’s page once we approve them. Your email address is not published.
• If you sign in to a BAJ account: your email address, the name and phone number you save, and when you last signed in. An account is optional; you can book without one.

Partners

• Your name, business name, email, phone number, address and GST or tax number.
• Bank account details for payments, which we store encrypted.
• Property details, photos and documents you upload so we can verify the property.

Everyone

• Technical information such as your IP address, browser and the pages you use, kept in server logs for security.

3. How we use it

• To make, confirm, change and cancel bookings, and to send you emails about them.
• To sign you in to your BAJ account with a one-time link sent to your email, and to show you the bookings made with that email address or while you were signed in.
• To take payments and issue refunds.
• To verify and publish partner properties, and to pay partners.
• To answer questions and handle complaints.
• To keep our services secure and prevent fraud and misuse.
• To meet our legal obligations, including tax record-keeping.

We ask for children’s ages only to show rooms that fit and the correct price. We do not ask for children’s names.

4. Who we share it with

• The property you book receives your name, contact details and stay details, including guests’ ages, so it can host you. If the property uses a channel manager or property management system connected to BAJ, the booking is sent there too.
• Payment providers (such as Stripe or PayPal, depending on the method you choose) process your payment and any refund.
• Service providers that host our systems and send our emails, who may use the information only to provide those services to us.
• Authorities, where the law requires it.

We do not sell personal information.

5. Information sent overseas

Some of our providers, including payment providers, store or process information outside New Zealand. When we send personal information overseas, we take reasonable steps to make sure it is protected in a way comparable to the Privacy Act, as Information Privacy Principle 12 requires.

6. Security and how long we keep it

We limit access to personal information to people who need it, store passwords only in hashed form, and encrypt partner bank details and payment provider keys. Guest accounts have no password: sign-in links work once, expire after 30 minutes and are stored only in hashed form. We keep booking and payment records for at least seven years because New Zealand tax law requires it, and other information only for as long as we need it.

If a privacy breach is likely to cause serious harm, we will tell the people affected and the Office of the Privacy Commissioner, as the Privacy Act requires.

7. Cookies and third-party content

We use cookies only to keep you signed in and to protect forms from misuse. We do not use advertising or analytics cookies. Our pages load fonts from Google Fonts, so Google receives your IP address when a page loads. Where maps are shown on search results and property pages, they are loaded from Google Maps only when you choose “Show map”; Google then receives your IP address. The “Open in Google Maps” link takes you to Google, whose own privacy policy applies.

8. Your rights

If you have a BAJ account, you can correct your name, phone number and sign-in email address under My details, and delete the account there. Deleting it removes the account, the details saved in it and any reviews written from it; your bookings stay on record for the period described above. You can correct the guest details on a booking from its voucher until the stay ends.

You can ask to see the personal information we hold about you and ask us to correct it. Email our Privacy Officer at support@baj.co.nz. We will respond within 20 working days.

If you are not happy with how we handle a privacy concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

9. Changes to this policy

We may update this policy. The date at the top shows when it last changed.