This policy covers thelocalmangawhai.co.nz. It does not cover anything that happens in the venue itself, or on Facebook and Instagram, which have their own privacy terms.

Who we are

The Local — Kitchen + Bar, Corner of Moir & Molesworth, Mangawhai 0505, Northland. Phone (09) 945 3838. Email admin@thelocalmangawhai.co.nz.

We are the agency responsible for personal information collected through this site. If you want to talk to someone about privacy, use the address above.

What we collect

Only what you type into one of our two forms, and only the fields we actually need to reply to you.

Our contact form:

Your name
Your email address
Your phone number — optional, and you can leave it blank
Your message

Our reservation form asks for the same four, plus the booking itself. Your phone number is required on this one, because we confirm every booking by phone or email and a table we cannot reach you about is not a booking:

How many people are coming
The day and time you would like
Anything we should know — a birthday, a dietary requirement, a high chair

That is the whole list. We don't ask for anything "just in case". This site has no accounts, no logins and no payments — we never collect a password or a card number.

The booking details are yours to give as you choose. If you would rather not put a dietary requirement in writing, leave it out and tell us when you arrive — it makes no difference to the table.

Why we collect it

To read your enquiry and reply to it, or to arrange and confirm your booking. Those are the only purposes. We do not use your details for marketing, we do not add you to a mailing list, and we do not sell, rent or trade personal information to anyone.

What we don't do

This site carries no advertising tags and no tracking pixels. There is no Google Analytics, no Meta pixel and no third-party script of any kind. Nothing on this site follows you to other websites, and nothing about your visit is sent to another company.

We do count how many people read our pages, and how often the links on them are tapped. That happens entirely on our own server and is described under counting page views below. The small script that reports a tap sends what it has to us and to nobody else.

We also deliberately don't use reCAPTCHA or a similar captcha service, because it would send information about you to an overseas provider. Instead our forms use a hidden field and a timing check that work entirely on our own server.

Cookies

One cookie, named tlm_session, and only on pages with a form. It holds a random session identifier used to confirm that a form submission came from the page we served — a standard protection against a forged request being submitted on your behalf. It contains no personal information, it is not used to track you, and it is deleted when you close your browser.

The same cookie keeps our own staff signed in to the staff-only area described below. It still holds nothing but a random identifier.

Counting page views does not use a cookie, so there is no cookie banner on this site and nothing for you to accept or refuse.

Counting page views

We keep a simple count of how often each page is read, so we know which parts of the site are useful and when people are looking. It runs on our own server. Nothing is sent to an analytics company, and no information about your visit leaves us.

For each page view we record the date and time, which of our pages it was, and whether the visitor was using a phone, a tablet or a computer. If you followed a link from another website we record the name of that website — for example google.com — but never the page you came from, and never anything you searched for.

We do not store your IP address, and we do not set a cookie to count you. So that we can tell one visit from ten page views, we store a short scrambled code worked out from your connection and your browser. That code is rebuilt from scratch every day, so it cannot be used to recognise you tomorrow, it cannot be used to follow you over time, and it cannot be turned back into your address. It is not linked to your name, your email, or anything you have ever sent us.

We count taps as well as pages. If you tap our phone number, one of our email addresses, or a link that takes you to another website — our Facebook or Instagram page, for instance — we record that one of those was tapped, and the date and time. We do not record who tapped it, what page you were on, or anything that happens after you get there: once you are on another company's website, what you do is between you and them. This is the only part of our counting that needs a script running in your browser, so if you have JavaScript turned off, or a blocker on, it simply does not happen — nothing else about the site changes.

We also count how many of our visitors are not people at all — search engines and AI assistants reading the site — because we would like to be found by both.

These counts are kept for up to 400 days, so we can compare one season with the same season a year earlier, and are then deleted automatically. Only our own management can see them, and what they see is totals — never one person's activity, because we do not hold it.

Our staff area

Part of this site is a password-protected area our staff sign in to. It is not open to the public and nothing you send us through either form appears in it.

For each staff account we hold a name, a work email address, a role, and the time of the most recent sign-in. Passwords are never stored — only a one-way cryptographic hash, which cannot be turned back into the password. Accounts are created and removed by our management, and are deleted or disabled when someone no longer needs access.

If you are a staff member and want to see or correct what is held about your account, ask a manager, or use the contact details at the end of this page.

Our server logs

Our server keeps a short technical log so we can tell whether the site is working. It is written to record what happened, not what you submitted — it deliberately contains no names, email addresses, phone numbers or message text.

Your IP address is never stored in readable form. Where we need to recognise repeat requests from the same connection — to stop a bot flooding the contact form — we store a one-way salted hash of the address, which cannot be turned back into the original. Logs are automatically deleted after 30 days.

Who can see your enquiry

Your message is emailed to one of our own mailboxes — an enquiry from the contact form to our main address, a booking request to our bookings address — and read by the people here who handle them. Both are our own mailboxes on our own domain; neither is a booking service or any other outside company. Beyond that:

Our hosting provider operates the servers this website and its email run on, and can technically access what is stored there.
Our website administrator maintains the site for us. They act on our behalf and under our instructions, and may see enquiries in the course of keeping the site and its email working. Information held by an agent in this way is treated under the Privacy Act as held by us, not as having been given to someone else.

We don't disclose your information to anyone else unless you ask us to, or the law requires it.

Where your information is stored

This website is hosted on servers provided by Hostinger. Depending on the region our hosting is provisioned in, information you send through the site may be stored on servers outside New Zealand. Where that is the case, we rely on our provider's contractual commitments to protect it to a standard comparable to the Privacy Act.

How long we keep it

Enquiry emails are kept only while they are useful — long enough to deal with your enquiry and any follow-up — and are then deleted. Technical logs are deleted automatically after 30 days.

Keeping it safe

The site is served over an encrypted HTTPS connection. Form submissions are checked before they are accepted, our configuration and credentials sit outside the publicly reachable part of the server, and the log directory cannot be fetched over the web.

No website can promise perfect security, but we don't hold sensitive information here, and we don't keep more of it or keep it longer than we need.

Seeing or correcting your information

Under the Privacy Act you have the right to ask us what personal information we hold about you, to get a copy of it, and to ask us to correct it if it's wrong. Email admin@thelocalmangawhai.co.nz or phone (09) 945 3838 and we'll sort it out. We may need to check who you are first. There's no charge, and we'll respond within 20 working days.

You can also ask us to delete an enquiry you've sent, and we will unless we need to keep it for a legal reason.

If you're not happy

Tell us first and we'll try to put it right. If you're still not satisfied you can complain to the Office of the Privacy Commissioner: privacy.org.nz, or 0800 803 909.

Changes to this policy

If we change how this site handles personal information, we'll update this page at the same time. This version was last reviewed on 1 September 2026, when booking requests began arriving at our bookings address rather than our main one. Before that, on 23 August 2026, we began counting taps on our phone number, our email addresses and the links that lead to other websites.

Privacy policy