Skycity New Zealand Privacy Policy

This Privacy Policy outlines how SKYCITY Casino and its related entities in New Zealand collect, use, store, and disclose personal information. The policy exists to inform individuals of our data handling practices in accordance with the Privacy Act 2020 and other applicable laws. It explains the purposes for which personal information is processed, including account management, transaction processing, regulatory compliance, and security. The document also details the rights individuals have regarding their personal information. This policy applies to all interactions with SKYCITY Casino, including visits to our properties such as SKYCITY Casino Hamilton, and use of our digital services.

Data Collection and Types of Information Processed

SKYCITY Casino collects personal information necessary for the operation of its services and to meet legal obligations. This collection occurs through various interactions, including account registration, transaction processing, customer service engagements, and through security systems on our premises and digital platforms. The information collected is limited to what is reasonably necessary for the identified purposes.

The categories of personal information processed include, but are not limited to, the following types. Identification and contact details such as full name, date of birth, address, email, and telephone number. Financial and transactional data including payment method details, deposit and withdrawal history, and game play activity. Verification information such as copies of driver’s licences, passports, or other government-issued ID required for identity verification under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. Technical data encompasses IP addresses, device identifiers, browser type, and activity logs from website and app usage. Compliance records include details of self-exclusion orders, incident reports, and responsible gambling interactions. Operational data may include communication records, preferences, and survey responses.

Visitors to our properties should be aware that CCTV is in operation for security purposes, which captures imagery. Furthermore, promotional materials, including SKYCITY Casino photos, may be taken at events where signage is displayed indicating photography is occurring.

Data Usage and Legal Basis for Processing

Personal information is processed for specific, lawful purposes. The primary legal bases for processing are the performance of a contract, compliance with a legal obligation, legitimate interests pursued by SKYCITY Casino, and, in specific circumstances, consent.

Processing activities are conducted for the following core purposes. Account and service administration, including the creation and management of player accounts, processing transactions, and providing customer support. This is necessary for the performance of the contract with the player. Regulatory compliance involves identity verification, age confirmation, source of wealth checks, and reporting obligations as mandated by the Gambling Act 2003 and anti-money laundering legislation. This constitutes processing under legal obligation. Security and integrity measures include monitoring transactions for fraud, using CCTV for patron and staff safety, and protecting our systems from cyber threats. This is conducted under legitimate interest. Service communication includes sending essential operational information related to account status or changes to terms. Marketing communications for promotional offers are only sent where consent has been obtained or as otherwise permitted by law.

Operational planning, such as analysing venue usage to manage staffing or facility hours, is conducted under legitimate interest. For instance, understanding patronage patterns helps inform operational decisions, but does not involve tracking individual movements for marketing. Information regarding SKYCITY Casino opening hours tomorrow is publicly available and not dependent on personal data collection.

Data Storage, Security Measures and Retention Rules

SKYCITY Casino implements technical and organisational measures to protect personal information from unauthorised access, disclosure, alteration, or destruction. Data is stored within secure systems located in New Zealand and, in some cases, with trusted cloud service providers under strict contractual safeguards.

Security measures include encryption of data in transit and at rest, strict access controls based on the principle of least privilege, and regular security testing and monitoring. Physical security at locations, including managed SKYCITY Casino free parking areas, incorporates measures to protect both persons and property, which indirectly supports data security by preventing unauthorised physical access to systems.

Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Retention periods are determined based on the nature of the information and the legal context. For example, transactional records are retained for a minimum of seven years as required by financial and gambling regulations. CCTV footage is retained for a limited period in accordance with internal security policies, unless required for an investigation. Upon expiry of the applicable retention period, data is securely deleted or anonymised so it can no longer be associated with an individual.

Player Rights and Data Access Procedures

Individuals have certain rights regarding their personal information under the Privacy Act 2020. SKYCITY Casino has established procedures to facilitate the exercise of these rights, which are subject to verification of the requester's identity and any applicable legal exceptions.

The rights include the following. The right to access personal information held about you. The right to request correction of personal information if it is inaccurate, incomplete, or misleading. The right to request deletion of personal information in specific circumstances, such as where it is no longer necessary for the purpose it was collected. The right to object to processing based on legitimate interests, including for direct marketing purposes. The right to restrict processing in certain situations, such as where the accuracy of the data is contested.

To exercise any of these rights, a written request must be submitted to the Privacy Officer. The request must contain sufficient detail to identify the individual and the information or action sought. SKYCITY Casino will verify the identity of the requester, which may require the provision of certified identification documents, to prevent unauthorised disclosure. We will respond to requests within the timeframes stipulated by law. If a request is refused, we will provide reasons for the refusal, as required under the Privacy Act 2020. Complaints regarding privacy practices can be lodged directly with SKYCITY Casino or with the Office of the Privacy Commissioner.