Wilderness Motorhomes Ltd Privacy Policy

1. Definitions in and Purpose of this privacy policy

For the purposes of this privacy policy the following words and expressions have the meanings given to them below:

controller has the meaning given to it in the EU GDPR, the UK GDPR and UK Data Protection Act;
Data Protection Legislation means the NZ Privacy Act, EU GDPR, UK GDPR, UK Data Protection Act,  and other data protection and privacy laws and regulations that apply where you live or where we do business;
EU GDPR means the European Union General Data Protection Regulation (as amended from time to time);
NZ Privacy Act means the New Zealand Privacy Act 2020 (as amended from time to time);
personal data means “personal data” as defined in and for the purposes of  the EU GDPR, UK GDPR and UK Data Protection Act, and “personal information” as defined in and for the purposes of the NZ Privacy Act;
processing and processor have the meanings given to them in the EU GDPR, UK GDPR and UK Data Protection Act and processes has a corresponding meaning;
user, customer, you, and your means the individuals about whom we may collect personal data;
UK Data Protection Act means the General Data Protection  Act 2018  of the United Kingdom (as amended from time to time);
UK GDPR means the UK General Data Protection Regulation (as amended from time to time);
Wilderness, we, us, our means Wilderness Motorhomes Limited;

This Policy explains how Wilderness collects, uses and processes your personal data and your rights relating to such personal data under the relevant Data Protection Legislation.
For the purposes of this privacy policy, the terms “user,” “customer”, “you”, and “your” are meant to refer to the individuals about whom we may collect data.

2. Who we are

Wilderness Motorhomes Limited is a New Zealand registered company with its principal places of business at 11 Pavilion Drive, Airport Oaks, Auckland, New Zealand and 3 Export Avenue, Harewood, Christchurch, New Zealand.

For the purposes of this privacy policy the terms “Wilderness”, "we", "us" or "our" is a reference to Wilderness Motorhomes Limited.

For the purposes of the EU GDPR, UK GDPR and UK Data Protection Act, Wilderness is the data controller.

If you have any questions about this privacy policy, or any requests in relation to your personal data held by us, please write to us by email to privacy@wilderness.co.nz or by mail to Data Protection Officer, Wilderness Motorhomes, PO BOX 53134, Auckland Airport, Auckland 2150, New Zealand. Our appointed Data Protection Officer (DPO) is our Head of Digital Experience.

3. The information we collect about you

Information we collect automatically
When you visit our website, our server or the server of our technical providers automatically collects certain browser or device generated information, including but not limited to:

• your IP address;
• domain names;
• referring website address;
• your date, time and duration of your visit;
• your browser type;
• your operating system;
• your page visits;
• other information about your computer or device

We provide optional Wi-Fi connectivity in our motorhomes to enable you to access the internet during your rental. When you connect to the Wi-Fi hotspot, we automatically record:

• Device identifier (MAC address) and internal IP address
• Date, time and duration of each session
• Total data uploaded and downloaded per session
• Motorhome ID and booking reference (to link the hotspot to a rental agreement)

We do not inspect or store the content of websites you visit, search queries, e-mails, chat messages or application data. Deep-packet inspection, web-logging and filtering are disabled by default.

Information you provide
In order to access or use certain portions of the website or enjoy the full functionality of the website, or otherwise in conducting business with us or seeking to conduct business with us, you may be prompted to provide certain personal data to us in the following ways:

• by making a booking with us for the hire of a motorhome;
• by filling in forms (for example, a 'Contact us' form) on our website or at a trade show or anywhere else we conduct business;
• by downloading files such as an e-book from our website;
• by subscribing to newsletters, offers and tips, blog posts or other communications;
• by corresponding with us by phone, e-mail, chat or otherwise using our contact details;
• or by submitting questions or comments to us or requesting any other information from us.

Sensitive data
We do not collect any sensitive data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). We do not collect any information about criminal convictions and offences, although we may be required to briefly hold and pass on any driving infringements that you incur while renting our vehicles.

Recruitment and job applications
We collect the information you provide in your CV, cover letter and application form—e.g. identification details, work history, education, referee contacts, visa status—and any data generated during the process (interview notes, assessment results, background-check reports).

• Purpose: assess your suitability, make hiring decisions, enter an employment contract, maintain diversity statistics, defend legal claims.
• Lawful basis: steps necessary prior to entering a contract and our legitimate interests in selecting qualified candidates. Where local law requires us to keep certain records (e.g., immigration checks), the basis is legal obligation.
• Retention: successful candidates – transfer to personnel file; unsuccessful – kept 12 months then deleted, unless you opt-in to our talent pool.
• Sharing: referees you nominate or relevant government authorities.

4. Cookies

Our website uses cookies. A cookie is a small text file that can be placed on your computer, mobile or other device when browsing a website. These cookies allow us to distinguish you from other users of our website, which helps us to provide you with a good experience when you browse our website and also allows us to improve our site. Read more about individual cookies we use and how to recognise them by reviewing our (third-party service provider platform) Cookie Policy by clicking here.

Certain cookies power our AI chat widget and personalise support. These are only set after you opt in via our cookie banner.

5. Lawful basis for processing of personal data

The table below describes the various forms of personal data we collect and the lawful basis for processing this data. We have processes in place to make sure that only those people in our organisation who need to access your data can do so. A number of data elements are collected for multiple purposes, as the table below shows. Some data may be shared with third parties and, where this happens, this is also identified below. In the table below, the following terms have the stated meaning:

• Consent means only when you have consented to the processing for one or more specific purposes.
• Contractual Performance means the processing is necessary to perform a contract with you or in order to take steps at your request prior to entering into a contract, such as to fulfil a booking, or to provide product information you have requested;
• Legal Obligation means the processing is necessary for us to comply with a relevant legal obligation, such as keeping accounting records;
• Legitimate Interest means the processing is in our or a third party’s legitimate interests, which are not overridden by your interests or fundamental rights and freedoms which require protection of personal data.

When we process on the lawful basis of legitimate interest, we apply the following test to determine whether it is appropriate:

1. The purpose test – is there a legitimate interest behind the processing?

2. Necessity test – is the processing necessary for that purpose?

3. Balancing test – is the legitimate interest overridden, or not, by the individual’s interests, rights or freedoms?

6. Disclosure of personal data

We will not sell, trade, or otherwise, transfer to outside parties your personal data except as disclosed in this paragraph 6 and the table above or where we provide users with notice in advance. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential, inline with the specified purpose and in accordance with our instructions. We may also release information when it’s release is appropriate to comply with the law, enforce our site policies, or protect ours or others’ rights, property or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.  Also, if we sell our business as a whole to a third party, your personal data may be transferred to the new owner as part of this process but strictly on the basis that they will protect your personal data in the same way as set out in this Privacy Policy.

Tracking
We use various marketing tools that help us create a better user experience for people visiting our site. These tools allow us to look at aggregated data such as scrolling patterns, clicks, and allow us to run tests to determine which pages result in the best actions. However, your personal data is not used by any of these tools. We use the following third-party service providers for tracking:

Google Analytics
See Google Privacy Policy

HubSpot
See HubSpot Privacy Policy

Remarketing
We also use remarketing tracking cookies and conversion pixels from vendors such as Google and Meta to present special offers to you for our products or services over the Google Content Network and via social networks. This means you may see an ad for one of our products or services as a result of visiting our website. However, your personal data is not used by any remarketing service other than to present you special offers and messages from us. When you first visit our website you will be prompted to accept or decline the use of these cookies that aren't strictly necessary for the functioning of the website. Cookie consent can be withdrawn at any time by clicking here.

Our main processors are HubSpot, Aircall, Google, Meta, Cognito Forms and Sinch MessageMedia. Each is bound by a written Data Processing Agreement incorporating the 2021 EU Standard Contractual Clauses (SCCs) or other adequacy mechanism.

7. Children

The website is not for use by children under the age of 16 years and Wilderness does not knowingly collect, store, share or use the personal data of children under 16 years. If you are under the age of 16 years, please do not provide any personal data, even if prompted by the website to do so. If you are under the age of 16 years and you have provided personal data, please ask your parent(s) or guardian(s) to notify Wilderness and Wilderness will delete all such personal data.

8. Marketing emails

We will only send you marketing communications for the lawful purposes set out in the table above. If you wish to update your marketing preferences or opt-out of receiving marketing communications, please use the ‘Manage Preferences’ or 'unsubscribe' link provided in our emails, or otherwise contact us directly and we will stop sending you communications.

9. CCTV and on-site security

We operate closed-circuit television (CCTV) cameras at our offices, vehicle-depots and yards for the lawful purpose and legitimate interests of protecting the safety of our staff and visitors, preventing theft and vandalism, and assisting in the investigation of incidents (Article 6 (1)(f) EU GDPR and UK GDPR / Information Privacy Principle 1, NZ Privacy Act).

How the system works

• Cameras continuously record video (no audio) 24/7.
• Live and recorded footage is viewed only by authorised security or management personnel.
• Footage is processed on-site; although the system uses automated video analytics to detect motion and intrusions, it does not perform facial recognition, biometrics, or automated decision-making that produces legal or similarly significant effects on you.
• CCTV footage is deleted after 90 days but will be held longer (as necessary) if evidence of an incident.

10. Data Security

Wilderness aims to safeguard and protect your personal data from unauthorised access, improper use or disclosure, unauthorised modification or unlawful destruction or accidental loss, and Wilderness utilises and maintains certain reasonable processes, systems, and technologies to do so.

We employ Multi Factor Authentication (MFA) for all staff and admin accounts, annual penetration tests, and a 72-hour data breach notification procedure.

However, you acknowledge that no transmission over the Internet is completely secure or error-free, and that these processes, systems, and technologies utilised and maintained by Wilderness are subject to compromise. Accordingly, we cannot be held responsible for unauthorised or unintended access that is beyond our control.

11. International transfers

For the most part, your personal data is collected, stored and processed outside the European Economic Area (EEA).

If we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented.

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Where we have entered into EU-approved standard contractual clauses with the recipient to give personal data the same protection it has in Europe.
• When we transfer personal data outside NZ, the EU or the UK, we rely on: (a) adequacy regulations (e.g., NZ-EU, UK); (b) the 2021 EU & UK SCCs; or (c) the EU–US Data Privacy Framework.
• All CCTV data is stored locally on secure servers at our premises and is not transferred overseas.

12. Retention of your personal data

We apply a general rule of keeping personal data only for as long as required to fulfill the purposes for which it was collected.  In general, we retain your personal data for a period of time corresponding to a statute of limitation, for example to maintain an accurate record of your dealings with us. However, in some circumstances we may retain personal data for other periods of time, for instance where we are required to do so in accordance with legal, tax and accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request, for so long as required. 

Retention Periods

* Extension clause – We may retain data beyond the periods above where: (a) a legal hold or dispute is in place; (b) statutory limitation periods require; or (c) an individual has made a rights request that is still pending.
Retention periods are enforced via automated lifecycle-management rules in HubSpot, Aircall, Google Cloud and other platforms.  Compliance is reviewed annually by the Privacy Officer and evidenced in an internal audit report.
Encrypted backups containing personal data are held for a maximum of ninety (90) days after the source data is deleted, solely for disaster-recovery purposes, after which they are overwritten.
Where this policy calls for anonymisation, we use techniques that irreversibly prevent the data from being re-identified, in line with Recital 26 EU GDPR, UK GDPR and the NZ Privacy Commissioner’s De-identification Guidelines.

13. External links

The website may contain links to third party sites. Since Wilderness does not control nor is responsible for the privacy practices of those websites, we encourage you to review the privacy policies of these third-party sites. This notice applies solely to personal data collected by our websites or in the course of our business activities.

14. Your Rights

As a data subject whose personal information we hold, you have certain rights depending upon the applicable Data Protection Legislation. If you wish to exercise any of these rights, please email privacy@wilderness.co.nz or use the information supplied in the Contact Us section below. In order to process your request, we will ask you to provide two valid forms of identification for verification purposes. Subject to the applicable Data Protection Legislation, your rights may include the following:

The right to be informed
As a data controller, we are obliged to provide clear and transparent information about our data processing activities. This is provided by this privacy policy and any related communications we may send you.

The right of access
You may request a copy of the personal data we hold about you free of charge. Once we have verified your identity and, if relevant, the authority of any third-party requestor, we will provide access to the personal data we hold about you as well as the following information:

• The purposes of the processing.
• The categories of personal data concerned.
• The recipients to whom the personal data has been disclosed.
• The retention period or envisioned retention period for that personal data.
• When personal data has been collected from a third party, the source of the personal data.

If there are exceptional circumstances that mean we can refuse to provide the information, we will explain them. If requests are frivolous or vexatious, we reserve the right to refuse them. If answering requests is likely to require additional time or occasions unreasonable expense (which you may have to meet), we will inform you.

You have the right to request access to CCTV footage in which you appear and, where technically feasible, to request erasure or restriction of processing. We may ask you to provide date, time and location details to help us locate the footage and may withhold images that would unreasonably disclose the identities of other individuals.

The right to rectification
When you believe we hold inaccurate or incomplete personal data about you, you may exercise your right to correct or complete this data. This may be used with the right to restrict processing to make sure that incorrect/incomplete data is not processed until it is corrected.

The right to erasure (the ‘right to be forgotten’)
Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data. This includes personal data that may have been unlawfully processed. We will take all reasonable steps to ensure erasure.

The right to restrict processing
You may ask us to stop processing your personal data. We will still hold the data, but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies you may exercise the right to restrict processing:

• The accuracy of the personal data is contested.
• Processing of the personal data is unlawful.
• We no longer need the personal data for processing but the personal data
• is required for part of a legal process.
• The right to object has been exercised and processing is restricted pending a decision on the status of the processing.

The right to data portability
You may request your set of personal data be transferred to another controller or processor, provided in a commonly used and machine-readable format. This right is only available if the original processing was on the basis of consent, the processing is by automated means and if the processing is based on the fulfilment of a contractual obligation.

The right to object
You have the right to object to our processing of your data where:

• Processing is necessary for the purposes of a task carried out in the public interest or in the exercise of official authority;
• Processing is based on legitimate interest;
• Processing is for the purpose of direct marketing;
• Processing is for the purposes of scientific or historic research or statistical purposes;
• Processing involves automated decision-making and profiling.

You may object to, or request human review of, any automated decision-making or profiling that has legal or similarly significant effects.

15. Contact us

Any comments, questions or suggestions about this privacy policy or our handling of your personal data should be emailed to privacy@wilderness.co.nz

Alternatively, you may contact us at our head office using the following postal address or telephone numbers:

Physical Address: Wilderness Motorhomes, 11 Pavilion Drive, Mangere, Auckland 2022, New Zealand

Postal Address: Data Protection Officer, Wilderness Motorhomes, PO BOX 53134, Auckland Airport, Auckland 2150, New Zealand

Phone: +64 9-255 5300

16. Complaints

Should you wish to discuss a complaint, please feel free to contact us using the details provided above. All complaints will be treated in a confidential manner.

You may also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of alleged infringement, if you consider that the processing of your personal data infringes applicable Data Protection Legislation

17. Changes to this notice

Any changes or updates we may make to this notice will be posted on this page.  If we have your contact details on file we will endeavour to notify you in advance of any changes to this notice that are material or may impact you.  For other changes, please check back frequently to see any updates or changes to this notice.