Privacy Policy
How Chocka collects, uses and protects personal information — and how that differs from the information the businesses on Chocka collect from their own customers.
v1.2 · effective 9 October 2026 · New Zealand Privacy Act 2020. Chocka’s privacy officer: hello@chocka.co.nz.
1. Two different roles — read this first
Chocka is a platform that lets independent businesses run their own branded booking sites. That means personal information on Chocka sits in one of two roles, and it matters which:
- Information Chocka holds in its own right — mainly the details of the people who sign up to run a booking site, and platform-level operational data. This policy covers that.
- A business’s customers’ information — captured when someone books, registers or pays on a business’s site. For that information the business is the collecting agency under the Privacy Act 2020, and Chocka only processes it on the business’s behalf, as its agent. That relationship is governed by the business’s own privacy notice and by the Data Processing Agreement (Terms, Schedule 1). If you booked with a business, ask that business about its handling of your information.
2. What we collect
- Account information — name, email, phone number, the site handle and business details you give when you sign up and configure a site.
- Billing information — plan, subscription status and payment references. Card details are handled by our payment provider, not stored by Chocka.
- Usage and technical data — logs, device and browser information, and cookies. Some cookies keep you signed in and keep the service secure. Others, unless you turn them off, help us measure our own advertising (see section 8). When you sign up for Chocka, we also note your device’s IP address and browser type, and any Meta (Facebook or Instagram) ad identifiers in your browser, so we can tell whether a Meta ad led to your sign-up. We keep these for 30 days.
- How you found Chocka — when you visit our site from a link or an ad, we note where you came from: the campaign tags in the link (such as
utm_source), the ad platform’s click reference (such as Google’sgclidor Meta’sfbclid), the site that referred you, and the first page you landed on. We keep this for your first visit and your most recent one. If you sign up, we also keep your answer to “How did you hear about Chocka?”. - Communications — messages you send us and our replies.
We collect this information directly from you, from your use of the platform, and from providers that help us run it. We collect only what we need (IPP 1).
3. How we use it
- To provide, secure and support the platform.
- To bill you and manage your plan.
- To send you service messages (account, security, billing and important product notices).
- To improve the product, keep it safe, and prevent fraud and abuse.
- To understand which of our marketing brings businesses to Chocka, and how far they get in setting up (for example, when they publish their first session or take their first paid booking), including telling Google and Meta when one of their ads led to a sign-up or to a business getting started. We use this to decide where to spend our own marketing. It is never used to market to your customers.
- To meet our legal obligations.
We do not sell personal information. If you run a business on Chocka, or help run one, we email you about new features and changes to the product. Every one of those emails has a link to stop them, and stopping them doesn’t affect service messages.
5. How we protect it
We use reasonable safeguards (IPP 5): encryption in transit, access controls, least-privilege, and strict tenant isolation enforced at the database layer, designed so that one business’s data cannot be read by another. No system is perfectly secure, but if a privacy breach likely to cause serious harm occurs, we will act on our obligations under Part 6 of the Privacy Act 2020 and notify those affected and the Privacy Commissioner where required.
6. How long we keep it — and the erasure rule
We keep personal information only as long as we need it for the purposes above or as the law requires (IPP 9), then delete or de-identify it.
We keep “how you found Chocka” (section 2) with your business’s account for as long as the account exists, and delete it with the account. If you never sign up, it stays only in a cookie in your browser and expires after 90 days.
The IP address and browser details we keep for measuring our ads (section 2) are deleted 30 days after you sign up.
Executed agreements are an exception you should know about. When someone accepts a waiver, terms or similar agreement through a Chocka site, the record of that acceptance — the version of the text shown, the typed name, the timestamp and the IP address — is a legal record. We (and the business) may lawfully retain that record even after a request to delete personal information, because it may be needed to establish or defend a legal claim. When we action an erasure request we remove the personal information we no longer have a lawful basis to keep, while retaining the minimum executed-agreement record for 6 years from the end of the relationship.
7. Your rights
Under the Privacy Act 2020 you can ask to access the personal information we hold about you (IPP 6) and to correct it (IPP 7). You can export your account and site data from the platform, and close your account. To make a request or raise a concern, email hello@chocka.co.nz. If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner.
If your request is about information a business collected from you, we will pass it to that business, which is the collecting agency for that information.
9. Contact and changes
Chocka is operated by Magnetar Group Limited, trading as Chocka (NZBN 9429053576446), of 6 Heke St, Ngaio, Wellington 6035, New Zealand. We may update this policy; material changes will be notified and take effect on the stated date. Questions or requests: hello@chocka.co.nz.