Privacy Policy

1. Who We Are

Hub Hawke's Bay is a community events and business discovery platform operated by BayRevive Limited (Company No. 9364277, NZBN 9429053056061), a company incorporated in New Zealand and trading as Hub Hawke's Bay.

Our platform is available at hawkesbayhub.co.nz. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our website and services.

BayRevive Limited is the Privacy Act agency responsible for your personal information. By using Hub, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information you provide directly

• Account registration: Name, email address, and password (or Google sign-in credentials).
• Business listings: Business name, contact details, address, category, description, and any images you upload.
• Event submissions: Event title, description, date, time, venue, ticket pricing, and images.
• Reviews: Written reviews and star ratings you submit for businesses.
• Contact & support: Messages submitted through our contact form.
• Ticket purchases: Name and email associated with ticket orders (payment details are handled entirely by Stripe — we never receive your card number).

2.2 Information collected automatically

• Usage data: Pages visited, features used, time on site, and click patterns — collected via Google Analytics.
• Device & browser information: Browser type, operating system, screen resolution, and referring URL.
• IP address: Used for security purposes and approximate location (city/region level only).
• Cookies: Small files stored in your browser to maintain your session and remember preferences. See Section 4.

2.3 Information from third parties

• Google Sign-In: If you register or log in with Google, we receive your name and email address from Google as part of the authentication process.
• Stripe: Stripe provides us with confirmation of successful payments and order metadata (event name, amount) but never shares your full card details with us.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Providing our services: Creating and managing your account, displaying your business listing, processing event submissions, and delivering ticket purchase confirmations.
• Communications: Sending transactional emails such as ticket receipts, event reminders you've opted into, and responses to support requests.
• Platform improvements: Analysing usage patterns (via Google Analytics) to understand which features are useful and how to improve the platform.
• Safety & security: Detecting and preventing fraud, abuse, or unauthorised access to accounts.
• Legal compliance: Meeting our obligations under New Zealand law, including the Privacy Act 2020.

We will not use your information for purposes that are incompatible with those listed above without first obtaining your consent.

4. Cookies & Analytics

4.1 Cookies we use

We use the following types of cookies:

• Essential cookies: Required for the platform to function — for example, keeping you logged in and maintaining your session. These cannot be disabled.
• Analytics cookies: Set by Google Analytics to help us understand how visitors use the site. These are not essential and can be opted out of.
• Preference cookies: Remember your settings such as light/dark mode.

4.2 Google Analytics

We use Google Analytics to collect anonymised usage statistics. Google Analytics uses cookies to track sessions and interactions. The data collected (such as pages visited and time on site) is aggregated and does not identify you personally.

To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-Out Browser Add-on. You can also control cookie use through your browser settings.

Google's privacy practices are governed by Google's Privacy Policy.

4.3 Managing cookies

When you first visit Hub, a cookie consent banner is displayed. You can choose to accept all cookies (including analytics) or essential cookies only. Your preference is stored in your browser's local storage and remembered for future visits. You can withdraw or change your consent at any time by clearing your browser's local storage or by contacting us.

You can also control and delete cookies through your browser settings. Note that disabling certain cookies may affect functionality — for example, you may need to log in again each visit.

5. Sharing Your Information

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

5.1 Service providers

We use trusted third-party services to operate Hub:

• Google Firebase & Firestore: Our database and authentication infrastructure, hosted on Google Cloud servers (primarily Sydney, Australia).
• Stripe: Payment processing for ticket sales. Stripe is a PCI-DSS Level 1 certified payment processor, and processes payments via servers in the United States and European Union.
• Resend: Our transactional email service (ticket receipts, password resets, notifications). Resend processes email metadata and content necessary to deliver your emails. Resend's servers are located in the United States.
• Google Analytics: Anonymised website usage analytics. Data is processed by Google on servers in the United States.

All service providers operate under binding data processing agreements and are required to handle your data securely and only for the purposes we specify.

5.1a International data transfers

Some of our service providers are located outside New Zealand, including in Australia and the United States. By using Hub, you acknowledge that your personal information may be transferred to and processed in countries outside New Zealand. Where we transfer data internationally, we take steps to ensure the receiving party provides an adequate level of protection for your information, including through contractual safeguards.

5.2 Business listings — public information

If you submit a business listing to Hub, the information in your listing (business name, contact details, description, location) is displayed publicly on the platform. Please only submit information you are comfortable being publicly visible.

5.3 Event tickets — sharing with event organisers

When you purchase a ticket for an event hosted by a business on Hub, we provide that business with your name and email address so they can verify attendance and communicate event details. This is limited to information necessary for the event.

5.4 Legal requirements

We may disclose your information if required to do so by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the safety of any person or to prevent illegal activity.

5.5 Business transfers

In the unlikely event that BayRevive Limited is sold, merged, or transferred, your personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. Payment Processing

All ticket payments on Hub are processed by Stripe, a leading global payment platform. When you purchase a ticket:

• Your payment details (card number, expiry, CVC) are entered directly into Stripe's secure, encrypted payment interface.
• BayRevive Limited never receives, stores, or has access to your full card number or CVV.
• Stripe operates under PCI DSS Level 1 compliance — the highest level of payment security certification.

Business organisers using Hub receive payouts through their own Stripe Connect account. As part of setting up a business account on Hub, business owners are required to complete Stripe's identity verification and bank account onboarding process, which is subject to Stripe's own privacy policy.

Stripe's privacy practices are governed by the Stripe Privacy Policy.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and meet our legal obligations:

• Account data: Retained for as long as your account is active. If you delete your account, your personal data is removed within 30 days, except where retention is required by law.
• Transaction records: Ticket purchase records and financial transaction logs are retained for seven years in accordance with standard accounting and legal requirements.
• Analytics data: Google Analytics data is retained for 26 months.
• Contact messages: Support correspondence is retained for two years.

When data is no longer needed, we securely delete or anonymise it.

8. Data Breach Notification

Under the Privacy Act 2020, we are required to notify the Office of the Privacy Commissioner and affected individuals if a privacy breach occurs that is likely to cause serious harm.

In the event of a notifiable privacy breach, we will:

• Notify the Office of the Privacy Commissioner as soon as reasonably practicable;
• Notify affected individuals as soon as reasonably practicable after notifying the Commissioner;
• Take immediate steps to contain the breach and prevent further harm;
• Conduct a post-breach review and implement improvements.

If you believe your personal information held by us has been compromised, please contact us immediately at admin@hawkesbayhub.co.nz. We will investigate and respond within 2 business days.

9. Security

We take the security of your personal information seriously. Our security measures include:

• All data transmitted between your browser and our platform is encrypted using HTTPS/TLS.
• Firebase Authentication manages passwords and Google sign-in credentials using industry-standard security practices.
• Firestore Security Rules restrict access so that users can only access their own data and business owners can only manage their own listings.
• Administrative access to user data is restricted to authorised Hub team members only.

10. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct any inaccurate or incomplete personal information.
• Erasure: Request deletion of your account and associated personal data (subject to legal retention obligations).
• Portability: Request a copy of your data in a machine-readable format.
• Objection: Object to specific uses of your personal information, including direct marketing.
• Complaint: Lodge a complaint with the New Zealand Office of the Privacy Commissioner if you believe your privacy rights have been breached.

To exercise any of these rights, please contact us at the details below. We will respond within 20 working days, as required by the Privacy Act 2020.

You can also contact the Office of the Privacy Commissioner directly if you have a concern about how we handle your information.

11. Children's Privacy

Hub is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will promptly delete it.

Users between the ages of 13 and 18 should use Hub only with the consent and supervision of a parent or guardian.

12. Links to Other Sites

Hub may contain links to third-party websites — for example, links to a business's own website or social media pages. This Privacy Policy applies only to Hub Hawke's Bay. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies before providing personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. When we make material changes, we will:

• Update the "Effective date" at the top of this page.
• Notify registered users by email where the changes are significant.

Your continued use of Hub after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or want to make a complaint, please reach out:

You may also contact the New Zealand Office of the Privacy Commissioner if you believe your privacy rights have been breached and we have not resolved your complaint satisfactorily.