Privacy Policy
Because this is a business that spans New Zealand and Japan, so is how we handle personal information — explained against the actual law in both countries, not generic language. What we collect, why, and how it's handled, as specifically as we can make it.
What's covered here
Who This Policy Covers
This policy explains how Navigate Japan Limited ("NJL", "we", "us"), operating its Japan property and short-stay service as Navigate Japan Stays ("NJS"), collects and handles personal information. It applies to:
- Visitors to the Navigate Japan Stays website who register interest or make an enquiry.
- Property owners who engage NJS to source, manage, or operate a property on their behalf.
- Guests who book or stay at an NJS-managed property, once bookings open.
- Anyone who otherwise contacts us about NJS services.
NJL is incorporated in New Zealand and its founder operates from Auckland. NJS's on-the-ground service is delivered in Japan, working with local ground operations partners across the regions where it operates. Because of that, two separate privacy law systems apply to the same information at different points — New Zealand's Privacy Act 2020 and Japan's Act on the Protection of Personal Information. Section 4 explains both; Section 5 explains what happens when information moves between the two countries.
Information We Collect
What we collect depends on how you interact with us. Some of this is not yet happening — NJS has not yet opened bookings — and is described here so the policy is ready before it is needed, not because it reflects current activity.
| Who | What we collect | When |
|---|---|---|
| Website visitors | Name, email address, and any details submitted through the "Register Interest" form. | Now |
| Property owners | Contact details, property information, identity verification documents, and bank account details for payouts. | From onboarding |
| Guests | Name, contact details, and payment information for booking and payment processing. | Once bookings open |
| Guests (regulatory) | Name, address, occupation, and nationality, and for guests without a Japanese address, passport details — as required by Japanese lodging law for the guest register. | Once bookings open |
Why guest passport information is collected
Japanese law governing short-stay and lodging businesses requires operators to maintain a guest register, and to record passport details for guests without a Japanese address. This is not an NJS choice — it is a legal requirement of operating a lodging business in Japan, and it is collected and retained only for that purpose.
How We Use Your Information
- To respond to enquiries and register interest submitted through the website.
- To source, assess, and manage properties on behalf of owners, and to make payouts.
- To process bookings, payments, and guest communications once NJS is operational.
- To meet the guest-register and reporting obligations of Japanese lodging law.
- To meet our own accounting, tax, and legal obligations in New Zealand and Japan.
- To send updates about NJS, only where you have agreed to receive them.
We do not sell personal information, and we do not use it for purposes unrelated to the above without asking first.
The Legal Frameworks That Apply
4.1 New Zealand — Privacy Act 2020
As a New Zealand company, NJL is subject to the Privacy Act 2020, which is built around Information Privacy Principles (IPPs). Following the Privacy Amendment Act 2025, there are now 14 principles, not the 13 originally enacted — a new principle, IPP 3A, took effect from 1 May 2026 and specifically addresses information collected about someone otherwise than directly from that person.
What IPP 3A means for NJS in practice
Where NJS receives information about a guest or owner from someone other than that person — for example, from a booking platform, from one of our ground operations partners, or from another member of a travelling party — we must take reasonable steps to make sure the individual concerned knows that their information was collected, why, and who it was given to. This policy, and confirmation at the point of booking, are intended to satisfy that requirement.
The other 13 principles cover, among other things: collecting information only for a lawful purpose connected to what we actually do (IPP 1); collecting it fairly and, where practical, directly from the person concerned (IPPs 2–4); keeping it secure (IPP 5); giving individuals the right to see and correct their own information (IPPs 6–7); keeping it accurate and not for longer than needed (IPPs 8–9); and restricting further use, disclosure, and cross-border transfer to specific permitted grounds (IPPs 10–12).
4.2 Japan — Act on the Protection of Personal Information
Japan's Act on the Protection of Personal Information (APPI) applies to NJS directly, even though NJL is incorporated in New Zealand. Under Article 171, APPI's extraterritorial provisions cover any business handling personal information about individuals located in Japan in connection with providing them goods or services — which describes exactly what NJS does for guests and, once operating, for Japan-based owners.
This applies even to information we don't collect directly
Current guidance from Japan's Personal Information Protection Commission confirms that APPI's extraterritorial reach applies not only when NJS collects information directly from a guest, but also when it receives that information indirectly — for example, passed on by a booking platform or by one of our ground operations partners. NJS cannot treat indirectly-received guest information as outside the scope of Japanese privacy law.
A further amendment to APPI was enacted in July 2026, introducing administrative fines for the first time — previously enforcement relied on criminal penalties. That amendment is not yet in force; implementation is expected by cabinet order within two years of its July 2026 promulgation. It does not change NJS's obligations today, but it is worth revisiting this policy once it takes effect.
Cross-Border Transfers Between Japan and New Zealand
Because NJS collects information in Japan while NJL's own records and oversight sit in New Zealand, guest and owner information will routinely cross the border in both directions. Both legal systems specifically regulate this, and their requirements need to be satisfied together, not just one or the other.
| Direction | Governing rule | What it requires |
|---|---|---|
| Japan → New Zealand (guest/owner data collected in Japan, held or reviewed by NJL in NZ) | APPI cross-border transfer rules | Informed consent that discloses the receiving country (New Zealand), New Zealand's data protection law, and the safeguards NJL applies — unless a specific APPI exception applies. |
| New Zealand → Japan (any information NJL holds that is shared back to our ground operations partners or Japan-based systems) | Privacy Act 2020, IPP 12 | A lawful basis for the disclosure — such as the recipient being bound by comparable safeguards, typically addressed through the terms of each Ground Operations Partner Agreement. |
This section needs a lawyer's sign-off before publication
This plan gives the shape of what's required, but the exact consent wording for the Japan-to-New Zealand direction is a specific legal drafting task — it needs to name New Zealand's data protection standards accurately and describe NJL's actual safeguards, not generic language. Confirm this with a lawyer who can advise on both sides of the transfer before this policy is published or bookings open.
Data Retention and Security
We keep personal information only for as long as it is needed for the purpose it was collected, or as required by law — whichever is longer. Guest register information required under Japanese lodging law is retained for the period that law specifies. Owner and financial records are retained in line with New Zealand and Japanese tax and accounting record-keeping requirements. Exact retention periods for each category of information will be confirmed and added here once NJS's accountant and Japanese legal adviser have reviewed the applicable record-keeping rules.
We take reasonable steps, consistent with IPP 5 under New Zealand law and APPI's security-of-data requirements under Japanese law, to protect personal information against loss, misuse, and unauthorised access. This includes limiting who can access guest, owner, and payment information to those who need it to do their job, and reviewing security measures as NJS's systems and vendors are finalised.
Your Rights
Under New Zealand's Privacy Act 2020, you can ask to see the personal information we hold about you and ask us to correct it if it is wrong. Under Japan's APPI, guests and owners in Japan have comparable rights, and recent amendments to the PPC's guidelines have expanded individuals' rights to request cessation of use, deletion, and cessation of onward disclosure of their information in specific circumstances.
To exercise any of these rights, contact us using the details in Section 9. We will respond within a reasonable time and may need to verify your identity first.
Cookies, Children's Information, and Changes
Cookies and the website: The NJS website may use basic cookies or similar technology to remember your language preference and understand how the site is used. It does not currently use advertising or tracking cookies. This section will be updated if that changes.
Children's information: NJS services are intended for adults. We do not knowingly collect personal information from children, except where a child is named as part of a family booking made by a parent or guardian, in which case the same protections in this policy apply.
Changes to this policy: We may update this policy as NJS moves from its current pre-launch stage into active operation — particularly once a payment processor, exact retention periods, and the Japan-to-New Zealand consent wording in Section 5 are finalised. The version number and date at the top of this page will always reflect the current version.
Contact Us and Complaints
For any question about this policy or your personal information, contact info@navigatejapanltd.com.
If you are not satisfied with our response, you have the right to complain to the relevant regulator. In New Zealand, that is the Office of the Privacy Commissioner. In Japan, that is the Personal Information Protection Commission (PPC). Which regulator has jurisdiction may depend on where you are located and which part of the service your complaint relates to — we will help direct you to the right one if you are unsure.