Privacy policy and collection notice
How KiwiFlights NZ Limited collects, uses, stores and discloses your personal information, and how you can access or correct it. Written to comply with Privacy Act 2020 and the Information Privacy Principles.
On this page
01 What we collect
We collect only what we need to sell you a ticket and look after you while you travel:
| Category | What it includes | Why we need it |
|---|---|---|
| Identity | Full name as shown in your passport, date of birth, gender marker, nationality | Airlines require it to issue a ticket; border authorities require it to admit you |
| Travel document | Passport number, issue and expiry date, issuing country; visa details where relevant | Advance Passenger Information required by law in most destinations |
| Contact | Email, mobile, postal address | Sending your confirmation and reaching you if a flight changes |
| Payment | Cardholder name, billing address, and a token representing the card | Taking payment and evidencing it |
| Preferences | Seat, meal, cabin, loyalty numbers, past bookings | Booking what you actually want without asking you twice |
| Sensitive information | Health or mobility needs, dietary requirements that reveal belief, accessibility assistance | Only where you volunteer it so we can arrange assistance — see below |
Sensitive information
Health information is subject to the Health Information Privacy Code 2020 in addition to the Privacy Act 2020. We collect it only with your consent, only where necessary to arrange what you have asked for, and disclose it only to the airline and ground handlers who need to act on it.
We do not buy personal information from data brokers, and we do not build profiles of you from third-party tracking.
02 How we collect it
Almost always directly from you — when you search, request a quote, make a booking, call us, or create an account.
We also collect it from a person making a booking on your behalf. If you book for someone else, you must have their authority to give us their information and you must show them this policy.
Some information comes from airlines and payment providers as a booking progresses: ticket numbers, PNR records, schedule changes, payment authorisation results.
Our website records standard technical information — IP address, browser, pages viewed. See our Cookie policy.
03 Why we use it
We use your personal information to:
- search fares, prepare quotes, make bookings and issue tickets;
- take payment and issue receipts and invoices;
- contact you about a booking — including at short notice about a schedule change or cancellation;
- provide support before, during and after travel;
- meet our legal obligations, including tax records and border reporting requirements;
- investigate and resolve complaints; and
- improve our service, using aggregated data that does not identify you.
Marketing
We send offers only to people who have asked for them. Every marketing message identifies us and carries a working unsubscribe link, which we action within five working days. You can also opt out at any time in your account or by replying to any message.
This complies with Unsolicited Electronic Messages Act 2007. We never use your booking data to send you marketing on behalf of a third party.
Operational messages are different. If your flight is cancelled we will contact you whether or not you have opted out of marketing. You cannot unsubscribe from those, and we would be failing you if you could.
Automated decision-making
We do not use automated decision-making that produces legal or similarly significant effects for you. Fare ranking and quote assignment are automated, but a person reviews and sends every quote.
04 Who we disclose it to
We disclose your personal information to:
- Airlines and their ground handlers — necessarily, to issue and operate your ticket;
- Global distribution systems (Amadeus, Sabre, Travelport) which hold the booking record;
- Border, customs and security authorities in departure, transit and destination countries, where required by their law;
- Payment processors and acquiring banks, to take and settle payment;
- Insurers, where you buy a policy through us;
- Our professional advisers and auditors, under confidentiality obligations;
- Law enforcement or regulators, where we are legally required or authorised to do so.
We do not sell your personal information. We do not disclose it for another organisation's marketing.
05 Overseas disclosure
International travel means international data
This is unavoidable. If you fly from New Zealand to London via Doha, your details will be held by an airline in Qatar, a GDS with servers in Europe or North America, and border agencies in Qatar and the United Kingdom.
Your information is likely to be disclosed to recipients in the countries on your itinerary, and to service providers in Singapore, the United States, the United Kingdom and the European Union.
Under Information Privacy Principle 12 of the Privacy Act 2020 we may only disclose personal information overseas where the recipient is subject to comparable safeguards, or where you authorise the disclosure after being informed the recipient may not be required to protect the information in a way that provides comparable safeguards. Where disclosure to a foreign government or airline is required by that country's law in order for you to travel, we rely on your authorisation given when you book.
06 Security and retention
We hold your information in access-controlled systems with encryption in transit and at rest. Card data is captured directly by our PCI DSS compliant payment provider and tokenised; we never see or store a full card number. Staff access is limited to those who need it, logged, and reviewed.
We keep booking records for seven years after travel, which is what New Zealand tax law requires and what we would need to defend a claim. Quote requests that do not become bookings are deleted after 24 months. Marketing consent records are kept as long as the consent is live, plus two years.
If something goes wrong
We maintain a data breach response plan. Where a privacy breach has caused or is likely to cause serious harm we will notify affected individuals and the Office of the Privacy Commissioner (OPC) as soon as practicable, as required by Part 6 of the Privacy Act 2020.
07 Your rights
You may ask us at any time to:
- give you access to the personal information we hold about you;
- correct anything inaccurate, out of date or incomplete;
- delete information we no longer need to keep;
- stop marketing to you; or
- explain how a particular piece of information was obtained or used.
Write to support@kiwiflights.co.nz with enough detail to identify yourself. We respond within 20 working days and do not charge for access requests.
We may refuse access in the limited circumstances the law allows — for example where it would unreasonably affect another person's privacy. If we refuse, we will tell you why in writing and how to complain.
Some information cannot be deleted on request because we are legally required to keep it, such as the transaction records behind an issued ticket.
08 Complaints about privacy
Contact our Privacy Officer first at support@kiwiflights.co.nz , marked "Privacy complaint". We acknowledge within 5 working days and aim to resolve within 30 days.
If you are not satisfied you may complain to the Office of the Privacy Commissioner — privacy.org.nz , 0800 803 909. The Privacy Commissioner generally expects you to raise the matter with us first.
§ Contacting us about this document
KiwiFlights NZ Limited · NZBN 9429 0512 8874
Unit 205, 26 Morningside Drive, Morningside, Auckland, 1025, NZ
support@kiwiflights.co.nz
· +64-800-700-093 (within New Zealand) · +64-800-700-093 (international)
This page describes the New Zealand trading entity. If you booked in the other market, switch the jurisdiction above — the contracting entity, currency and governing law are different.
Something trickier than a return flight?
Multi-city trips, groups of nine or more, flying home from a different city, or dates that need to move — a search box gives up here, a person doesn’t. Ask us to price it. It costs nothing and usually comes back cheaper.
We’ll watch the fare for you
The best seats sell 3–6 months ahead, not in a last-minute sale. Leave your email and we’ll tell you when a good fare opens up on your route.