who is responsible for your information
looopoi provides operational intelligence software for hospitality and event venues. When a venue uses looopoi, that venue is the agency responsible for the personal information it collects through our platform. looopoi processes that information on their instructions.
If you are a guest or a staff member and want your information corrected or deleted, you can contact the venue directly, or contact us at privacy@looopoi.com and we will pass it on.
what we collect
From guests giving feedback
A rating, a service category, an optional written comment, optionally the name of the staff member who served you, a table or area reference, and optionally your name and phone number so the venue can follow up. Providing your name and contact details is always optional.
From guests joining a loyalty programme
First name, mobile number, an optional email address, a date of birth, the venue they joined at, whether they agreed to marketing, and their points, stamps and visit history.
The date of birth is collected for one reason: age verification. Where a venue offers a reward that includes alcohol, staff must be able to confirm the guest is old enough, and a birth year alone is not precise enough to know whether someone is 18 today. Staff see only whether the guest is over 18 — never the date. Birthday rewards use only the day and month.
Agreeing to join a loyalty programme and agreeing to receive marketing are recorded separately. Marketing is never pre-ticked.
From venue staff
Name, role, work contact details, a numeric access PIN, shift times, points and recognition records, and performance review responses.
From venue operators
Business name, contact name, email, phone, country and venue details.
Automatically
Access codes used, times of access, and browser type — for security and support purposes only.
We do not collect payment card details through the platform. We do not use tracking cookies for advertising.
why we collect it
- So venues can respond to guest feedback quickly
- To recognise staff performance
- To produce shift and event reports
- To keep the service secure and support our users
- To improve the product in aggregate, non-identifying form
staff performance reviews
looopoi includes a two-way review feature. Where a review is submitted anonymously, the reviewer's identity is not stored against the review. We record only that a submission was made, so that nobody can submit twice.
Review results are hidden until enough responses have been received that no individual reviewer can be identified.
Reviews are the venue's employment records. Staff can request access to reviews about themselves through their employer.
who we share it with
We do not sell personal information. We do not share one client's data with another client. We never use your data to train external AI models.
We use service providers who process data only to deliver the service: cloud database and application hosting, AI assistant processing, website hosting and email routing, and contact form delivery. All are bound by confidentiality obligations. A current list of sub-processors is available on request from privacy@looopoi.com.
where it is stored
Information is stored on servers operated by our infrastructure providers, who hold SOC 2 Type II and ISO 27001 certification. Our primary database is hosted in Singapore (Asia Pacific). Where information is transferred outside New Zealand, we take reasonable steps to ensure comparable safeguards apply, as required by Information Privacy Principle 12.
how long we keep it
| Data | Retention |
|---|---|
| Guest feedback with contact details | 24 months, then contact details removed and the feedback retained anonymously |
| Guest feedback without contact details | Retained anonymously |
| Staff records | Subscription term plus 12 months |
| Performance reviews | 24 months |
| Access and security logs | 12 months |
| Loyalty membership and points | Points expire after 24 months without a visit. A membership with no activity for 24 months may be deleted |
| Account and billing records | 7 years, as required by NZ tax law |
When a venue closes its account we delete or anonymise its data within 90 days, other than records we are legally required to keep.
how we protect it
Data is encrypted in transit and at rest. Access is role-based and logged. Each client's data is isolated to their own account. Full detail is on our Security page.
your rights
Under the Privacy Act 2020 you can ask us to confirm whether we hold information about you, give you a copy, and correct it if it is wrong. Email privacy@looopoi.com and we will respond within 20 working days.
You can also ask us to delete information about you. We will do so unless we are legally required to keep it, and we will tell you if that is the case.
deleting a loyalty membership
A guest can ask a venue's staff, or email us at privacy@looopoi.com, to delete their loyalty membership. The membership is closed, the personal details are removed and the points are cancelled. A record that a transaction happened may remain in the venue's totals, with nothing that identifies the person.
Deleting a membership cancels any points in it. We say so before we act on the request, so nobody loses a reward by accident.
breaches
If a privacy breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Privacy Commissioner as required by the Privacy Act 2020.
children
looopoi is a workplace tool and is not directed at children. We do not knowingly collect information from anyone under 16 other than as a staff member of a venue in lawful employment.
changes
We will post any changes here and update the date below. Material changes will be emailed to account holders.
Privacy question or a request about your data?
privacy@looopoi.comIf you are not satisfied with our response you may complain to the Office of the Privacy Commissioner at privacy.org.nz