Privacy policy

This website

This website is hosted by Amazon Web Services in Sydney, Australia. The host processes technical information needed to serve and secure the website. We use Google Analytics to understand how people find and use the website and which visits lead to bookings. Booking details are processed through Bókun and card payments through Stripe. You can manage optional analytics through “Privacy choices” in the footer.

1. In short

We collect information to run your walk safely, manage your booking and receipt, and understand how our website and marketing lead to bookings. We collect your name, contact details, and — if you tell us — anything about your health, mobility or diet that we need in order to look after you. We share it with the people who make the booking work, and with emergency services if you need them. We do not sell it. You can ask to see it or correct it at any time.

2. Who we are

Living Lettuce Limited, trading as This Uncharted World (NZBN 9429052544378), of 79 North Avon Road, Richmond, Christchurch 8013, New Zealand, is the agency responsible for the personal information described in this policy under the Privacy Act 2020.

Privacy contact: Barnaby Carter-Scofield · hello@thisunchartedworld.com

3. What we collect

3.1 When you book

3.2 Health, dietary and accessibility information

If you tell us about an allergy, medical condition, mobility need or dietary requirement, we collect it because we need it to keep you safe and to order food you can eat.

Under the Privacy Act this is sensitive information and we treat it that way:

• We only collect what is relevant to running the tour safely.
• It appears on the guide's tour manifest for the day and nowhere else.
• We tell a food venue about an allergy so they can serve you safely — we give them the requirement, not your medical history.
• The daily manifest is destroyed after the tour, other than what we must retain for our health and safety records.
• We would disclose it to emergency services if you needed medical help and could not tell them yourself.

You do not have to give us this information. If you choose not to, we may not be able to keep you safe on the tour or meet a dietary requirement, and we will tell you honestly if that is the case.

3.3 On tour

We may take photographs and video on tours for our marketing. Tell your guide if you would rather not appear, and we will make sure you do not. You can ask us later to remove an image of you — see section 9.

We record incidents as we are required to under the Health and Safety at Work Act 2015. If you are involved in an accident or incident on a tour, we will record what happened, who was involved and what was done. Where the event is notifiable, we must report it to WorkSafe New Zealand and keep the record for at least five years.

3.4 On our website

We use Google Analytics to measure visits, tour views, date and party selections, checkout steps, completed bookings and completed refunds. This helps us improve the website, understand which tours interest visitors, identify checkout problems and measure our marketing.

Analytics can include browser and device information, approximate location, referring websites and campaign information, pages viewed, interactions, pseudonymous browser/session identifiers, and the tour, ticket categories, quantities, currency, purchase/refund value and a transaction identifier. We do not send your name, contact details, booking answers, health or dietary information, payment-card details or gift-card codes to Google Analytics. Google processes analytics information overseas, including in the United States.

Analytics and Google Ads measurement are on by default when you use this website. You can turn them off through “Privacy choices” in the footer at any time, regardless of your location. Turning measurement off also turns personalised ads off and stops future optional analytics and advertising measurement from this browser; it does not itself erase information already collected. Your saved choices are respected on later visits in this browser. Essential website and booking functions remain available.

Your choice is stored in this browser. When analytics is enabled, Google may use analytics cookies, and our server links an eligible completed booking to that browser's analytics session. When measurement is on, advertising storage and advertising measurement data are enabled to help us measure which Google Ads lead to visits and bookings. We also use Google Analytics Advertising Features and Google Ads remarketing to build audiences of previous visitors, show our tour ads to people still planning a trip, and exclude people who have booked. We and Google use first-party cookies such as Google Analytics cookies, and Google advertising cookies or other identifiers, together to connect website activity with advertising. Google may combine this activity with its advertising data according to your Google settings. We do not send your name, email address, phone number or payment details to Google Analytics.

Personalised ads are on by default for visitors detected outside the European Economic Area, the United Kingdom and Switzerland who have not opted out. For visitors in those regions, and where we cannot determine a country, personalised ads remain off until you turn them on in “Privacy choices”. Previous acceptance of measurement alone is not treated as acceptance of personalised ads. We estimate country using your connection address and a country database held on our server, without sending the address to a separate geolocation service for that lookup; detection is approximate. You can turn personalised ads off separately while retaining measurement. Turning measurement off also turns personalised ads off.

You can also manage personalised advertising through Google My Ad Center and use the Google Analytics opt-out browser add-on. See how Google uses information from sites that use its services.

For information about Google's processing, see How Google uses information from sites or apps that use its services. Contact hello@thisunchartedworld.com with questions or a request about your information.

4. Why we collect it, and what we do with it

We collect personal information only for these lawful purposes connected with our business:

1. To take, confirm and manage your booking.
2. To run the tour safely — headcounts, contacting you, knowing about a medical condition or allergy.
3. To meet a dietary requirement at a venue.
4. To contact you about a change, a delay, a weather cancellation or a safety matter.
5. To process payments and refunds.
6. To meet our legal obligations — tax records, health and safety records, notifiable event reporting.
7. To ask for a review after your tour, and — only if you have opted in — to send you occasional news about our tours. Every marketing email has an unsubscribe link, and one click is enough.

We do not sell your personal information, and we do not use it for automated decision-making or profiling.

To understand website use, improve the booking journey and measure which marketing leads to bookings.

5. When your booking comes to us from somewhere else

This section matters, and it is required by IPP3A of the Privacy Act 2020, which came into force on 1 May 2026.

If you booked through Viator, GetYourGuide, a travel agent, a cruise line, a hotel concierge or any other platform, we did not collect your information from you — we received it from them. Under IPP3A we have to tell you that this has happened, and this section, together with your booking confirmation email, is how we do it.

What you should know:

We send this notification as part of your booking confirmation, as soon as reasonably practicable after we receive your booking.

The platform you booked through is a separate agency and holds its own information about you under its own privacy policy. What they do with your data is governed by their policy, not ours.

6. Who we share it with

We share the minimum needed in each case. We do not disclose your information to anyone else unless you ask us to, or unless we are required or permitted to by law.

Google Analytics receives the website measurement information described in section 3.4 to help us understand visits, checkout and marketing.

7. Information sent overseas

Some of the services we rely on are based outside New Zealand — our booking platform, the OTAs we sell through, our payment provider and our email systems. That means your information may be stored or processed overseas.

IPP12 of the Privacy Act 2020 requires us to make sure your information is properly protected before we send it outside New Zealand. Before using an overseas provider we satisfy ourselves that they are subject to privacy safeguards comparable to New Zealand's — through the provider's own binding privacy commitments, contractual protections, or because they operate under a law the Privacy Commissioner has recognised as comparable.

Current overseas destinations: Bókun (Iceland / European Union), Viator (United States), GetYourGuide (Germany), Google Analytics (United States), and our payment and email providers.

8. Keeping it safe, and how long we keep it

Security. We store personal information in access-controlled systems, limit access to the people who need it, use strong authentication, and keep printed manifests only for as long as the tour requires before destroying them. No system is perfectly secure, but we take reasonable steps to protect what we hold.

Retention. We do not keep personal information longer than we need it:

9. Your rights

Under the Privacy Act 2020 you have the right to:

• Ask what we hold about you, and to be given a copy (IPP6).
• Ask us to correct it if it is wrong, and if we do not agree to correct it, to have your requested correction attached to the record (IPP7).
• Ask us to delete a photograph of you, or to stop using it.
• Unsubscribe from marketing at any time — one click in any email.
• Complain, to us and then to the Privacy Commissioner.

How to ask: email hello@thisunchartedworld.com with "Privacy request" in the subject line. We will confirm your identity and respond as soon as reasonably practicable, and within 20 working days, as the Privacy Act requires.

There is no charge for a request unless it is unusually large, in which case we will tell you the cost before we do the work.

10. Privacy breaches

If something goes wrong and personal information is lost, accessed without authorisation or disclosed by mistake, we will contain it, work out what happened, and assess the risk to the people affected.

If a breach has caused, or is likely to cause, serious harm, the Privacy Act 2020 requires us to notify the Office of the Privacy Commissioner and the people affected as soon as practicable after we become aware of it. We will tell you what happened, what information was involved, what we have done and what you can do.

11. Children

Children under 16 travel on our tours with a responsible adult who makes the booking. We collect a child's first name and age only, and only for the group manifest and pricing. We do not market to children and we do not knowingly collect a child's contact details.

12. Complaints

Tell us first — hello@thisunchartedworld.com — and we will investigate and respond within 20 working days.

If you are not satisfied with our response, you can complain to:

Office of the Privacy Commissioner Freephone 0800 803 909 · privacy.org.nz · PO Box 10094, Wellington 6143

13. Changes to this policy

We will update this policy when what we do changes, or when the law does. The current version and its effective date are always at the top of this page.

Contact

This Uncharted World — Living Lettuce Limited 79 North Avon Road, Richmond, Christchurch 8013, New Zealand · hello@thisunchartedworld.com NZBN 9429052544378

Privacy Policy v1.0 · Effective 3 September 2026 · Privacy Act 2020