Privacy Statement

Who holds your information

Copper Meeple collects and holds personal information for its event organisation service. Our address is Office 41, Level 4, 104 The Terrace, Wellington, New Zealand. Contact us about privacy at [email protected] or +64 4 002 3946, and mark your message for the privacy contact.

This statement applies to coppermeeple.com and to information we receive while responding to enquiries and organising events. We handle personal information under the New Zealand Privacy Act 2020. The Office of the Privacy Commissioner’s privacy principles explain the general framework.

What we collect and why

The enquiry form asks for your name, email address, event type and event location. These fields are required so we can respond and assess the event brief. Phone number, company name, preferred date, estimated guest count and event details are optional. If you leave optional fields blank, we can discuss them later; without the required details we may be unable to process the form or provide a useful response.

We use enquiry information to communicate with you, discuss availability and suitability, develop a proposal and arrange the agreed event. If you proceed, we may also need booking correspondence, billing details, supplier instructions and information required to deliver the programme. We do not request identity documents, payment-card details or a complete guest list through the website form.

Please describe an access adjustment rather than providing unnecessary medical details. Do not include sensitive information about another person unless it is necessary for the event and you have an appropriate basis to share it. We will discuss a suitable way to provide any further information needed.

Website storage and technical information

The website uses an essential session cookie named cm_session on pages that support the enquiry process. It helps protect the form, limit repeat submissions and display the appropriate confirmation. The session holds a security token and submission timing; the site does not save the enquiry text in a public file or a website database. Submitted information is passed to our email system for handling.

Your privacy preference is stored in your browser under cm_privacy_v1 for up to 180 days. It records your optional category choices and when you made them. There are currently no active analytics, advertising pixels, embedded maps, third-party video players or remotely loaded fonts on this website.

The hosting service may record technical request information such as an IP address, requested page, time, browser information and error details for security and operation. These records are handled according to the hosting arrangements and are not used by this site to create advertising profiles. Read our Cookie & Tracking Notice for storage details and controls.

Who receives the information

Our hosting and email service providers process information for the operation of the website and our communications. People working on the event receive the information necessary for their role. Relevant details may be shared with a venue, host, facilitator or other supplier when needed to prepare or deliver your agreed programme.

We limit supplier information to what the task needs, such as the event date, setup requirements or an access adjustment. We do not sell personal information. We do not share an enquiry with advertising services or treat it as permission for unrelated promotional contact.

We may disclose information where you authorise it, where necessary for the original purpose or a directly related purpose, or where another lawful ground applies, including a legal obligation or a serious safety concern. We assess the circumstances and limit the disclosure to what is appropriate.

Information received from someone else

An organiser may provide a supplier contact or a guest requirement on another person’s behalf. We first consider whether there is an appropriate basis to collect that information indirectly. Where notification is required by information privacy principle 3A, we take reasonable steps to tell the person about the collection, its purpose, intended recipients, our identity and address, and their access and correction rights as soon as reasonably practicable, unless an applicable exception permits otherwise.

If you provide another person’s details, make sure they understand the intended use and share only what the event needs. This does not replace our own obligations. The Privacy Commissioner’s guidance on indirect collection provides more information.

Overseas processing and disclosure

Hosting, email or supplier arrangements may involve processing outside New Zealand. Before a relevant overseas disclosure, we assess the recipient and the safeguards required by information privacy principle 12, including whether comparable protections apply through law or appropriate contractual arrangements.

Where a service provider acts only as our processing agent, we remain responsible for the information held on our behalf. We do not use a general enquiry submission as blanket permission for overseas disclosure without appropriate safeguards. If a particular disclosure requires your informed authorisation because comparable protection may not apply, we will explain that separately before seeking it. See the guidance on overseas disclosure.

Security and retention

We take reasonable steps to protect personal information against loss, unauthorised access, use, alteration or disclosure. The website includes server-side validation, form security tokens and limited session-based repeat-submission controls. Access to event information should be limited to the people who need it, and supplier sharing should follow the agreed purpose.

We retain information only for as long as it is needed for the enquiry, event, related administration or lawful record-keeping. Enquiries that do not proceed should be reviewed and deleted when no longer needed. Booking and financial records may need to be retained for applicable legal obligations or to resolve a dispute. Deleting browser preferences does not delete an enquiry already sent by email.

If a privacy breach has caused or is likely to cause serious harm, we will assess and meet the applicable notification obligations, including notifying the Privacy Commissioner and affected people where required.

Access, correction and concerns

You can ask for access to personal information we hold about you or request a correction by contacting [email protected]. We may need to verify your identity and clarify the information requested, using a proportionate approach. We respond within the timeframes required by the Privacy Act and explain any lawful reason for refusing access or a correction.

If we do not make a requested correction, you can ask for a statement of the correction sought to be attached to the information where appropriate. Please tell us if contact details or an event requirement change so we can keep the working information accurate.

Contact us first if you have a privacy concern so we can understand and address it. You can also contact the Office of the Privacy Commissioner. We may update this statement when our practices change; the date above identifies this version.

Marketing choices

An event enquiry is not an automatic subscription to marketing. Any promotional email or SMS must have an appropriate consent basis, identify Copper Meeple accurately and provide a functional unsubscribe method. You may tell us at any time that you do not want promotional contact. Necessary messages about an enquiry or booking are separate from marketing.