Privacy Policy

Last updated: August 2026

1. Introduction / Who we are

Rainbow Ski Club Inc., trading as Rainbow Ski Area (we, us or Rainbow Ski Area), is an incorporated society and not-for-profit ski club based in St Arnaud, Nelson Lakes, New Zealand. This policy explains how we collect, hold, use and disclose personal information through skirainbow.co.nz, our membership, sales and backcountry-access services, and our other dealings with you.

We are committed to handling personal information in accordance with the Privacy Act 2020 (New Zealand), including its 13 Information Privacy Principles. “Personal information” means information about an identifiable individual.

2. What personal information we collect

We collect only the information reasonably necessary for our functions and activities. The information we collect depends on how you interact with us.

Hive Pass membership platform

When you purchase, hold or manage a membership or season pass through Hive Pass, we collect and maintain:

• full name;
• date of birth;
• email address and phone number; and
• membership type, package and related membership or season-pass record.

Backcountry Access App

When you apply for backcountry gate access through our online application, we collect:

• your name and email address;
• your Hive Pass member code;
• the trip dates requested; and
• the names or other details you provide for group members.

If you are not a season-pass member, the application may require a $20 payment. Payment card details are collected and processed by Stripe, not by Rainbow Ski Area through the application. We may receive payment confirmation, transaction identifiers and status information needed to administer the application and payment.

Salespoint point-of-sale system

For purchases made on site, Salespoint records transaction information, such as items or services purchased, date and time, amount and payment status. Payment information is processed through the relevant payment provider and/or terminal. We do not ordinarily retain full payment-card details.

Other information

We may also collect correspondence, feedback, enquiries, booking or service information, and technical information generated when you use our website or online services, such as IP address, device or browser information, log data and cookie information where applicable.

3. How we collect it

We generally collect information directly from you when you join, buy a pass or product, submit a backcountry application, make a payment, contact us, or use our website or services. We may receive information from service providers that operate our systems, including Hive Pass, Stripe, Salespoint, Vercel, Supabase and Resend, where this is necessary to provide the relevant service.

We will tell you why information is being collected, who will receive it, whether providing it is required, and what may happen if you do not provide it, where this is not already clear from the context. If you choose not to provide information needed to process a membership, payment or access application, we may be unable to provide that service.

4. Why we collect it

We collect personal information for legitimate club and operational purposes, including to:

• administer memberships, season passes and member records;
• process purchases, payments, refunds and related records;
• receive, assess, approve or decline backcountry gate-access applications, including confirming eligibility and requested trip dates;
• communicate with you about your membership, purchases, applications, access approvals, service updates and other transactional matters;
• operate, secure, troubleshoot and improve our website, systems and services;
• meet legal, regulatory, accounting, safety, insurance and record-keeping obligations; and
• respond to enquiries, complaints, incidents or disputes.

5. How we use it

We use personal information for the purpose for which it was collected, for directly related purposes, or where otherwise permitted or required by law. In particular, we use membership data to manage season passes and member records; backcountry application data to administer the application, verify the relevant member code, make an approval decision and communicate that decision; and transaction data to complete and account for purchases.

Backcountry access is subject to administrative approval before access is granted. Providing an application or making a payment does not itself guarantee approval. We may use the information in the application to manage this process and related communications.

We will not sell your personal information. We do not use personal information for unrelated purposes without taking steps required by the Privacy Act, such as obtaining consent where appropriate.

6. Third-party services and data sharing

We use carefully selected service providers to operate our services. They may handle personal information on our behalf, or in connection with a transaction you initiate. We share only the information reasonably necessary for the relevant service and require providers to handle it appropriately under their applicable terms, safeguards and privacy commitments.

• Hive Pass (hivepass.co) provides our membership-management platform and holds the membership and season-pass information described above.
• Vercel hosts the Backcountry Access App.
• Supabase provides cloud database and related services for the Backcountry Access App.
• Stripe processes payments for non-season-pass backcountry applicants and may process payment information under its own privacy terms.
• Resend sends transactional emails from noreply@skirainbow.co.nz, including application and service communications.
• Salespoint provides our point-of-sale system for on-site purchases.

We may also disclose information to our officers, employees, contractors and authorised volunteers who need it to perform their duties; professional advisers, insurers, banks and payment providers; and government, regulatory or law-enforcement agencies where required or authorised by law. We may disclose information where necessary to protect the safety, rights or property of the club, our members or others.

Overseas processing: Some providers may store or process personal information outside New Zealand, including in the United States. This may include Supabase and Vercel, and may also include Stripe and other service providers used to support payments or cloud services. Before making an overseas disclosure, we take reasonable steps to ensure it is permitted by Information Privacy Principle 12, including by using providers subject to privacy safeguards, contractual protections, or another permitted basis for overseas disclosure. Overseas recipients may be subject to the laws of the country in which they operate.

7. Data storage and security

We hold information in our club records and in the systems described above. We take reasonable safeguards against loss, unauthorised access, use, modification, disclosure, misuse and other misuse of personal information. These safeguards include access controls, limiting access to people who need it for their role, use of reputable service providers, and technical and organisational measures appropriate to the nature of the information.

No internet transmission or electronic storage system is completely secure. If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will comply with our obligations under the Privacy Act, including notifying affected individuals and the Office of the Privacy Commissioner where required.

8. Data retention

We keep personal information only for as long as it is needed for the purpose for which it was collected, to maintain appropriate club and transaction records, or to meet legal, accounting, tax, insurance, safety or dispute-resolution requirements. We then securely delete, anonymise or otherwise dispose of it. Retention periods may differ depending on the type of record and applicable obligations.

9. Your rights under the Privacy Act 2020

You have the right to ask whether we hold personal information about you and to request access to it (Information Privacy Principle 6). You may also ask us to correct personal information you believe is inaccurate, out of date, incomplete, irrelevant or misleading (Information Privacy Principle 7). If we do not make a requested correction, you may ask us to attach a statement of correction to the information.

To make an access or correction request, contact us using the details below. Please provide enough information for us to identify you and the information you seek. We may need to verify your identity before responding. We will respond within the timeframes required by the Privacy Act, normally within 20 working days, and will explain our decision if we cannot provide access or make a correction.

If you have a privacy concern, please contact us first so we can try to resolve it. You may also complain to the Office of the Privacy Commissioner at privacy.org.nz, by phone on 0800 803 909, or by using the Commissioner’s online complaint process. The Commissioner can investigate complaints about possible interference with privacy.

10. Cookies and analytics

Our website and online services may use essential cookies, local storage, logs and similar technologies to make services work, maintain security, remember preferences and understand technical performance. We may use analytics tools if enabled to understand how visitors use our website and to improve it. Information generated by these technologies may include IP address, browser, device, pages viewed, referring page and time of visit.

You can usually control cookies through your browser settings. Disabling cookies may affect the availability or functionality of some parts of our website or online services. Where we introduce non-essential cookies or analytics that require notice or consent, we will provide appropriate information and choices.

11. Changes to this policy

We may update this policy when our practices, services or legal requirements change. The current version will be published on our website with its “Last updated” date. We encourage you to review it from time to time. If a change is significant, we will take reasonable steps to bring it to your attention where appropriate.

12. Contact us