Privacy Policy
How Chocka collects, uses and protects personal information — and how that differs from the information the businesses on Chocka collect from their own customers.
Draft v0.1 · prepared 23 July 2026 · New Zealand Privacy Act 2020. Chocka's privacy officer: hello@chocka.co.nz.
1. Two different roles — read this first
Chocka is a platform that lets independent businesses run their own branded booking sites. That means personal information on Chocka sits in one of two roles, and it matters which:
- Information Chocka holds in its own right — mainly the details of the people who sign up to run a booking site, and platform-level operational data. This policy covers that.
- A business's customers' information— captured when someone books, registers or pays on a business's site. For that information the business is the collecting agency under the Privacy Act 2020, and Chocka only processes it on the business's behalf, as its agent. That relationship is governed by the business's own privacy notice and by the Data Processing Agreement (Terms, Schedule 1). If you booked with a business, ask that business about its handling of your information.
2. What we collect
- Account information — name, email, phone number, the site handle and business details you give when you sign up and configure a site.
- Billing information — plan, subscription status and payment references. Card details are handled by our payment provider, not stored by Chocka.
- Usage and technical data — logs, device/browser information and cookies needed to keep you signed in, keep the service secure, and understand how it is used.
- Communications — messages you send us and our replies.
We collect this information directly from you, from your use of the platform, and from providers that help us run it. We collect only what we need (IPP 1).
3. How we use it
- To provide, secure and support the platform.
- To bill you and manage your plan.
- To send you service messages (account, security, billing and important product notices).
- To improve the product, keep it safe, and prevent fraud and abuse.
- To meet our legal obligations.
We do not sell personal information. We only send marketing where you have opted in, and you can opt out at any time; service messages are not marketing.
5. How we protect it
We use reasonable safeguards (IPP 5): encryption in transit, access controls, least-privilege, and strict tenant isolation enforced at the database layer, designed so that one business's data cannot be read by another. No system is perfectly secure, but if a privacy breach likely to cause serious harm occurs, we will act on our obligations under Part 6 of the Privacy Act 2020 and notify those affected and the Privacy Commissioner where required.
6. How long we keep it — and the erasure rule
We keep personal information only as long as we need it for the purposes above or as the law requires (IPP 9), then delete or de-identify it.
Executed agreements are an exception you should know about. When someone accepts a waiver, terms or similar agreement through a Chocka site, the record of that acceptance — the version of the text shown, the typed name, the timestamp and the IP address — is a legal record. We (and the business) may lawfully retain that record even after a request to delete personal information, because it may be needed to establish or defend a legal claim. When we action an erasure request we remove the personal information we no longer have a lawful basis to keep, while retaining the minimum executed-agreement record for [retention period — confirm with legal; 6 years suggested per the Limitation Act 2010].
7. Your rights
Under the Privacy Act 2020 you can ask to access the personal information we hold about you (IPP 6) and to correct it (IPP 7). You can export your account and site data from the platform, and close your account. To make a request or raise a concern, email hello@chocka.co.nz. If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner.
If your request is about information a business collected from you, we will pass it to that business, which is the collecting agency for that information.
9. Contact and changes
Chocka is operated by Magnetar Group Limited, trading as Chocka (NZBN 9429053576446), of 6 Heke St, Ngaio, Wellington 6035, New Zealand. We may update this policy; material changes will be notified and take effect on the stated date. Questions or requests: hello@chocka.co.nz.