Privacy statement

What we collect

Only what we need to collect your vehicle, do the work, and invoice you:

• Your name and contact details — mobile, and email if you give us one
• The pick-up and return address, plus access notes for carpark buildings or gate codes
• Vehicle details — make, model, colour, plate, odometer
• Job notes, including pre-existing damage recorded at the walk-around
• Your booking history and what you were charged

We don't collect payment card details through this website, and we don't ask for your date of birth, driver licence, IRD number or bank account number.

Why we collect it

• To arrange the pick-up, carry out the detail, and return your car
• To quote, invoice and take payment, and to answer your questions
• To keep a record of what was done, and of any damage that already existed before we touched the car
• To contact you about your booking — confirmation, arrival time, follow-up if something isn't right
• To send you occasional offers, only if you ticked the optional marketing box

We don't use your information for automated decision-making or profiling, and we don't build advertising audiences from it.

Who sees it

Our groomers and the business owner, and nobody else — except:

• Our accountant, for GST and income tax records
• Our insurer, only if there's a claim involving your vehicle
• Anyone we're legally required to tell, such as Police or a court, if compelled

We don't sell, rent or trade your information, and we don't pass it to marketing or data-broker companies.

Where it's held, and for how long

When you send a booking through this website, it is saved in the business's own booking register — a database file kept on the owner's own equipment in Wellington. There is no cloud copy of it. The owner reaches that file either over a private network (Tailscale) or through Cloudflare Access, which emails a one-time code to the owner's own address before the bookings page will load at all; a password is still required after that. We don't share the register with anyone outside the business, apart from the people listed above who need it to do the work, the accounting and the insurance, and the messaging service that carries the owner's new-booking alert — that copy is described below. Paper job sheets stay at the workshop. We keep job and invoice records for at least seven years, because tax law requires it. Marketing consent records are kept until you opt out.

The booking form does not store anything in your browser, and you don't need an account to use it.

This website, cookies and overseas disclosure

This site:

• sets no cookies for customers — no tracking, no advertising, no analytics. The only cookie this site ever sets is a sign-in cookie for the owner's own bookings page, and it never reaches a customer's browser
• loads no third-party fonts, scripts, analytics or advertising pixels — every font, image and script on these pages is served by this website itself
• runs no trackers and no advertising code at all — nothing is set on your device and no profile of you is built, here or anywhere else

How the site reaches you, and who carries it. We publish this website through Cloudflare, a network and security company that sits in front of our own server in Wellington. Your visit — and the booking you send us — therefore travels across Cloudflare's network, which handles the connection to your device: that includes your device's IP address and, on the way in, the booking itself. A network that size works in many countries, so that traffic can be processed outside New Zealand. Cloudflare is a carrier, not a customer of ours: it does not keep your booking for us, does not sell it and does not use it for advertising. The register itself is ours, on our own equipment, as described above — and our own server keeps no visitor IP addresses at all: access logging is switched off, and the only thing held in memory is a short-lived counter that stops password guessing and form spam. The same applies to the owner's own visits: when the bookings page is opened, that traffic travels across Cloudflare too, and Cloudflare is a carrier there as well — the register stays on our own equipment, and our server keeps no log of who signed in or from where.

Google customer reviews. When the review section is visible, our server requests this business's public reviews and reviewer profile photos from Google. Your browser receives them from our server, not directly from Google. We do not send your IP address, booking details or browser identifiers to Google for this feature. Google receives our server's network address and the business lookup; its processing may take place overseas. Review content and photos are not saved or cached; we retain only aggregate API usage counts to limit costs. Google's Privacy Policy applies to its service. Clicking a Google Maps review or author link leaves this website and opens Google's service, where Google's own privacy practices apply.

The booking form stores nothing in your browser.

New-booking alerts to the owner. So the owner hears about your booking straight away, our server sends a short alert to the owner's own phone through Telegram, a messaging service run from outside New Zealand. It is server to server: your browser never contacts Telegram, and Telegram never sees your device or your IP address for this. The alert carries the details of your booking: your name, phone number and email address, your street address, the service and add-ons, the vehicle, the pick-up or drop-off, the date and time window, the total with GST, whether you agreed to receive marketing emails, and anything you type in the notes box, so keep notes to what the workshop needs to know. Telegram holds that message on its own servers while delivering it, and it stays in the owner's chat history; its Privacy Policy applies to that copy, and its systems work in many countries, so the message can be processed outside New Zealand. Telegram is a carrier here, as Cloudflare is above: the register itself stays on our own equipment. If the owner has not switched alerts on, no alert is sent at all.

Under the Privacy Act, disclosing personal information overseas has to be disclosed, and we have to take reasonable steps to make sure it is protected to a comparable standard. That is why Cloudflare and Telegram are named here rather than left unsaid. If we ever add something else that touches your details — an online payment provider or a live chat widget, for example — we'll update this statement first and say what leaves New Zealand and to whom.

Service feedback and return vouchers

If you opt in, we may email a Google Maps review invitation, a feedback survey and a separate 10% return voucher after your service. Reviews and surveys are optional, and voucher eligibility never depends on leaving a review or its rating. We use Google's Gmail service to deliver these emails; message contents and the recipient address are processed by Google. Your browser does not contact Gmail to send these emails.

We store feedback with the related order and retain the unique voucher, recipient email and redemption record to prevent reuse. Vouchers have no expiry and can be used once with the recipient email address. Your voucher is redeemed only when a new booking is successfully saved. We record email delivery status to avoid duplicate sends. Links contain private random tokens; keep your survey and voucher links private.

You can unsubscribe using the link in any follow-up email or by replying with UNSUBSCRIBE. Unsubscribing stops future follow-up and promotional messages without cancelling your bookings or an existing voucher. If you choose to open Google Maps, Google's privacy practices apply there.

Your vehicle, your keys, and any camera

Keeping your car safe is part of the job: keys are logged in and out, the odometer is recorded, and the car is stored securely between collection and return. If we ever install workshop cameras, we'll note that here and limit footage to the workshop, retained for a short period.

Opting out of messages

Reply STOP to any text, click unsubscribe in any email, or just tell us. We'll act on it. Booking confirmations and arrival texts for a job you've booked are service messages, not marketing, and we'll keep sending those while the booking is active.

Access, correction and complaints

You can ask to see the personal information we hold about you, and ask us to correct it if it's wrong. Email info@crystalcarvalet.co.nz or call 027 575 6789 and we'll respond within 20 working days, usually much sooner.

If you think we've handled your information badly, tell us first so we can fix it. If you're still not satisfied, you can complain to the Office of the Privacy Commissioner.

Security and breaches

We limit access to booking records, keep devices locked with passwords and two-factor where available, and don't carry customer records around on paper unless we need to for the day's run. If a privacy breach causes or is likely to cause serious harm, we'll notify affected people and the Privacy Commissioner as the Privacy Act 2020 requires.

Children's information

We don't intentionally collect information about children. If a booking is for a family vehicle, we ask for the account holder's details only. We do clean child seats — but the booking stays in the customer's name.

Contact

This statement covers privacy only. Service terms, payment and liability are in our terms of service, and the NZ rules that shape how we operate are summarised in how we comply.