This statement explains how Harbor Hex handles information provided through this website and enquiries about the venue. It covers the enquiry form, correspondence and the technical information needed to operate the website.
Who is responsible
Harbor Hex is the public-facing venue. The owner’s supplied business information is set out below. Use the venue contact for privacy questions, access or correction requests and complaints.
Contact Harbor Hex at [email protected] or +6437759231.
Office 24, 42 George Street, Dunedin 9016, New Zealand
What we collect and why
The enquiry form asks for your name, email, area of interest, preferred date, preferred time and group size. These are required by the form so we can understand and respond to your visit request. Your phone number, experience level and message are optional. Do not include identity documents, payment information or other guests’ personal details.
We use the information to answer you, discuss participation, arrange a visit and follow up on that enquiry. Sending it does not subscribe you to marketing. You can choose not to submit the form and contact us by phone or email instead. Without a way to reach you, we may be unable to respond.
Who receives it
Enquiries are addressed to the published Harbor Hex email account and handled by people responsible for venue enquiries. Hosting and email providers process the information as needed to run the website and deliver correspondence. The website does not publish your submission or send copies to a separate owner address.
Service providers may process information outside New Zealand. Their locations depend on the hosting and email services in use; we do not promise storage only in New Zealand. Contact us if you need details of a provider or processing location. Where disclosure to a separate overseas recipient is involved, the applicable safeguards under Information Privacy Principle 12 must be addressed; an overseas processor acting only on our behalf is not necessarily the same kind of disclosure.
Technical data and security
The form uses a secure session cookie, a request token and a hidden spam field. A rate-limit record uses a keyed hash of the connecting IP address and attempt times. Form contents are not written to those rate-limit files. Standard hosting and network services may keep request logs, such as IP addresses, requested paths, response codes and timestamps, for service operation and security.
The application protects internal files from web access, validates submitted data and escapes displayed content. Sessions use Secure, HttpOnly and SameSite settings. Access to correspondence should be limited to people who need it. No method of transmission or storage is perfectly secure; please keep sensitive information out of a general enquiry.
How long information is kept
Session information expires after two hours of inactivity at the application level; the browser cookie ends with the browsing session. Rate-limit records contain only recent attempt times and are eligible for removal after 24 hours; cleanup runs when subsequent form submissions are handled.
Correspondence is kept for as long as reasonably needed to answer the enquiry, manage agreed arrangements and deal with related questions, complaints or legal requirements. Mailboxes and hosting logs are managed through their respective services; this website does not promise automatic deletion from those systems. You may ask about retention or request deletion, subject to information we need to retain.
Your choices and rights
You may request access to personal information we hold about you and ask for it to be corrected. We may need proportionate verification of your identity. If a correction is not made, you may ask for your statement of correction to be attached. Contact us first with a privacy concern; if it remains unresolved, you can contact the Office of the Privacy Commissioner.
The collection notice requirements and overseas disclosure principle explain relevant New Zealand privacy protections. The form is designed to collect information directly from you, rather than to collect details about the other people in your group.
Cookies and external links
We do not include advertising pixels, analytics tags, embedded maps, external chats or marketing signups. See the Cookie Policy. Choosing an external directions or publisher link takes you to another provider whose privacy practices apply there.