THIS UNCHARTED WORLD
Privacy policy
How Living Lettuce Limited handles your personal information.
This website
This website is hosted by Amazon Web Services in Sydney, Australia. The host processes technical information needed to serve and secure the website. No advertising pixels or Google Analytics are active. Your cookie preference is stored in your browser. Booking details are processed through Bókun and card payments through Stripe.
1. In short
We collect the minimum we need to take you on a walk safely and to get you a receipt. We collect your name, contact details, and — if you tell us — anything about your health, mobility or diet that we need in order to look after you. We share it with the people who make the booking work, and with emergency services if you need them. We do not sell it. You can ask to see it or correct it at any time.
2. Who we are
Living Lettuce Limited, trading as This Uncharted World (NZBN 9429052544378), of 79 North Avon Road, Richmond, Christchurch 8013, New Zealand, is the agency responsible for the personal information described in this policy under the Privacy Act 2020.
Privacy contact: Barnaby Carter-Scofield · hello@thisunchartedworld.com
3. What we collect
3.1 When you book
| Information | Why we need it |
|---|---|
| Name | To identify your booking and take a headcount |
| Email address | To send your confirmation, meeting instructions and any weather or safety update |
| Phone number | So a guide can reach you if you are late, separated from the group, or if we need to cancel at short notice |
| Country of residence | For our own understanding of who our guests are, and occasionally for a guide's context |
| Number and ages of people in your party | Pricing, group size, and knowing whether children are present |
| Tour, date and departure time | To run the tour |
| Payment confirmation | Card details are handled by our payment provider — we never see or store your full card number |
3.2 Health, dietary and accessibility information
If you tell us about an allergy, medical condition, mobility need or dietary requirement, we collect it because we need it to keep you safe and to order food you can eat.
Under the Privacy Act this is sensitive information and we treat it that way:
- We only collect what is relevant to running the tour safely.
- It appears on the guide's tour manifest for the day and nowhere else.
- We tell a food venue about an allergy so they can serve you safely — we give them the requirement, not your medical history.
- The daily manifest is destroyed after the tour, other than what we must retain for our health and safety records.
- We would disclose it to emergency services if you needed medical help and could not tell them yourself.
You do not have to give us this information. If you choose not to, we may not be able to keep you safe on the tour or meet a dietary requirement, and we will tell you honestly if that is the case.
3.3 On tour
We may take photographs and video on tours for our marketing. Tell your guide if you would rather not appear, and we will make sure you do not. You can ask us later to remove an image of you — see section 9.
We record incidents as we are required to under the Health and Safety at Work Act 2015. If you are involved in an accident or incident on a tour, we will record what happened, who was involved and what was done. Where the event is notifiable, we must report it to WorkSafe New Zealand and keep the record for at least five years.
3.4 On our website
We do not currently use Google Analytics or advertising pixels. Essential cookies support website administration and booking, and your optional cookie preference is stored in your browser.
4. Why we collect it, and what we do with it
We collect personal information only for these lawful purposes connected with our business:
- To take, confirm and manage your booking.
- To run the tour safely — headcounts, contacting you, knowing about a medical condition or allergy.
- To meet a dietary requirement at a venue.
- To contact you about a change, a delay, a weather cancellation or a safety matter.
- To process payments and refunds.
- To meet our legal obligations — tax records, health and safety records, notifiable event reporting.
- To ask for a review after your tour, and — only if you have opted in — to send you occasional news about our tours. Every marketing email has an unsubscribe link, and one click is enough.
We do not sell your personal information, and we do not use it for automated decision-making or profiling.
5. When your booking comes to us from somewhere else
This section matters, and it is required by IPP3A of the Privacy Act 2020, which came into force on 1 May 2026.
If you booked through Viator, GetYourGuide, a travel agent, a cruise line, a hotel concierge or any other platform, we did not collect your information from you — we received it from them. Under IPP3A we have to tell you that this has happened, and this section, together with your booking confirmation email, is how we do it.
What you should know:
| What we collect | Your name, contact details, tour, date, party size, and any note you gave the platform — including dietary or accessibility requirements |
| Where we got it | From the booking platform, travel agent or partner you booked through |
| Why we hold it | The purposes in section 4 — running your tour, contacting you, keeping you safe |
| Who else sees it | The people listed in section 6 |
| Who we are | Living Lettuce Limited t/a This Uncharted World, 79 North Avon Road, Richmond, Christchurch 8013, New Zealand |
| Your rights | You can ask us for a copy of what we hold and ask us to correct it — section 9 |
We send this notification as part of your booking confirmation, as soon as reasonably practicable after we receive your booking.
The platform you booked through is a separate agency and holds its own information about you under its own privacy policy. What they do with your data is governed by their policy, not ours.
6. Who we share it with
| Who | What they get | Why |
|---|---|---|
| Bókun (booking and channel management) | Booking details, contact details, requirements | It is the system the booking runs in |
| Viator / GetYourGuide and other channels | Booking details for bookings made through them | To confirm and manage the booking |
| Our payment provider | Payment information | To take payment. We never see your full card number |
| Our guides | The day's manifest — names, party size, phone number, and any medical, mobility or dietary note | To run the tour and to look after you |
| Food and drink venues on the route | A dietary requirement or allergy, without your name where possible | So they can serve you safely |
| Emergency services | Whatever they need | If you need medical or emergency help |
| WorkSafe New Zealand | Incident details | Where an incident is notifiable under the Health and Safety at Work Act 2015 |
| Our insurer | Incident details | If a claim arises |
| Our accountant, and Inland Revenue | Transaction records | Tax and statutory reporting |
We share the minimum needed in each case. We do not disclose your information to anyone else unless you ask us to, or unless we are required or permitted to by law.
7. Information sent overseas
Some of the services we rely on are based outside New Zealand — our booking platform, the OTAs we sell through, our payment provider and our email systems. That means your information may be stored or processed overseas.
IPP12 of the Privacy Act 2020 requires us to make sure your information is properly protected before we send it outside New Zealand. Before using an overseas provider we satisfy ourselves that they are subject to privacy safeguards comparable to New Zealand's — through the provider's own binding privacy commitments, contractual protections, or because they operate under a law the Privacy Commissioner has recognised as comparable.
Current overseas destinations: Bókun (Iceland / European Union), Viator (United States), GetYourGuide (Germany), Google Analytics (United States), and our payment and email providers.
8. Keeping it safe, and how long we keep it
Security. We store personal information in access-controlled systems, limit access to the people who need it, use strong authentication, and keep printed manifests only for as long as the tour requires before destroying them. No system is perfectly secure, but we take reasonable steps to protect what we hold.
Retention. We do not keep personal information longer than we need it:
| What | How long |
|---|---|
| Booking and contact records | 7 years — required for tax records |
| Daily tour manifests (paper) | Destroyed after the tour |
| Dietary and medical notes | Held only for the booking; removed once the tour is complete, except where an incident record requires it |
| Completed Pre-Tour Checklists | 12 months |
| Incident records | 7 years |
| Notifiable event records | At least 5 years from the date we notify WorkSafe — required by section 57 of the Health and Safety at Work Act 2015 |
| Marketing list | Until you unsubscribe |
| Worker records | 7 years after employment or engagement ends |
9. Your rights
Under the Privacy Act 2020 you have the right to:
- Ask what we hold about you, and to be given a copy (IPP6).
- Ask us to correct it if it is wrong, and if we do not agree to correct it, to have your requested correction attached to the record (IPP7).
- Ask us to delete a photograph of you, or to stop using it.
- Unsubscribe from marketing at any time — one click in any email.
- Complain, to us and then to the Privacy Commissioner.
How to ask: email hello@thisunchartedworld.com with "Privacy request" in the subject line. We will confirm your identity and respond as soon as reasonably practicable, and within 20 working days, as the Privacy Act requires.
There is no charge for a request unless it is unusually large, in which case we will tell you the cost before we do the work.
10. Privacy breaches
If something goes wrong and personal information is lost, accessed without authorisation or disclosed by mistake, we will contain it, work out what happened, and assess the risk to the people affected.
If a breach has caused, or is likely to cause, serious harm, the Privacy Act 2020 requires us to notify the Office of the Privacy Commissioner and the people affected as soon as practicable after we become aware of it. We will tell you what happened, what information was involved, what we have done and what you can do.
11. Children
Children under 16 travel on our tours with a responsible adult who makes the booking. We collect a child's first name and age only, and only for the group manifest and pricing. We do not market to children and we do not knowingly collect a child's contact details.
12. Complaints
Tell us first — hello@thisunchartedworld.com — and we will investigate and respond within 20 working days.
If you are not satisfied with our response, you can complain to:
Office of the Privacy Commissioner Freephone 0800 803 909 · privacy.org.nz · PO Box 10094, Wellington 6143
13. Changes to this policy
We will update this policy when what we do changes, or when the law does. The current version and its effective date are always at the top of this page.
Contact
This Uncharted World — Living Lettuce Limited 79 North Avon Road, Richmond, Christchurch 8013, New Zealand · hello@thisunchartedworld.com NZBN 9429052544378
Privacy Policy v1.0 · Effective 3 September 2026 · Privacy Act 2020
Reviewed 7 September 2026 · This Uncharted World