Penny: Your key to travel

Last updated: 28 April 2026

Kiwi Cash Limited, trading as Penny (“us”, “we”, or “our”) operates the Penny platform (“Service”).

Our registered office is at 3535 State Highway 1, RD 4, Riverlands, 7274, New Zealand. You can contact us about this policy or about your personal information at help@go-penny.com.

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. It is intended to comply with the New Zealand Privacy Act 2020 (including Information Privacy Principle 3A, which applies to information we collect from sources other than you from 1 May 2026).

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

Information Collection And Use

We collect several different types of information for various purposes to provide and improve our Service to you.

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). Personally, identifiable information may include, but is not limited to:

  • Email address
  • First name and last name
  • Date of birth
  • Nationality
  • Phone number
  • Billing address and, where applicable, a separate shipping/delivery address (street address, suburb, city, state/province, postcode, country)
  • Vehicle registration information
  • License plate and other security imagery
  • Cookies
  • Usage data
  • Device identifying data

We may also collect information on how the Service is accessed and used (“Usage Data”). This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

In some cases we may hold your personal information without an associated Penny account being created on the Service. For example, where you stayed at a camp ground we operate, and you did not use a Penny account, we may hold your contact, vehicle, booking and payment details for the purposes of providing your stay, recording the transaction, and meeting our record-keeping obligations, even where no account has been created. This is incidental to our normal practice, which is to set up a Penny account for each guest.

Information We Receive From Other Sources

In addition to the information you give us directly, we receive personal information about you from the following third-party sources. Where this applies to you, the agency collecting and holding that information is Kiwi Cash Limited (contact details above), the recipients are our staff and the Participating Providers described later in this policy, and you have the right to access and correct any of this information by contacting us.

  • Self-Contained Vehicle (SCV) status — from the Plumbers, Gasfitters and Drainlayers Board (PGDB) public register. When you add a vehicle to your account, we may look up its SCV certification status (including certification number, expiry, and supplier) on the PGDB public register, which is publicly available information. We use this to confirm whether your vehicle is eligible for self-contained-only sites and to display its certification status to site operators when you book.

  • Reports, complaints, and operational notes — from camp ground operators in the Penny network. When you stay at a camp ground in the Penny network that is run by a third-party operator, the operator may pass us information about your stay that you did not enter yourself. This may include incident reports, complaints from operators or other guests, no-show or arrival flags, observations about your vehicle or self-containment status, and other operational notes that arise during or after your booking. We receive this information so that we can investigate and respond to incidents, manage user behaviour on the platform, support operators with their own record-keeping, and (where serious) make decisions about your continued access to the Service. We will take reasonable steps to make you aware when we receive substantive information of this kind about you, unless an exception under the Privacy Act applies (for example, where notification would prejudice an investigation or where you have already been made aware).

  • NZMCA membership status — from the New Zealand Motor Caravan Association. If you tell us you are an NZMCA member, we may receive confirmation of your membership status, membership number and expiry from NZMCA in order to apply member-only pricing or access rules to your bookings.

  • Billing address and summarised payment details — from Stripe. When you pay through our Service, our payment processor Stripe sends us limited information about the transaction. The details we receive depend on the payment method you choose:

    • Card payments: your billing address, the country of issue, the card brand, the last four digits of the card, and the card expiry month and year.
    • Direct debit / bank account payments (NZ Direct Debit): your billing address, the bank or institution name, the country of the account, a masked or partial account identifier (such as the last digits of the account number) for easy identification on transactions, and the status of any authorisation or mandate you have given Stripe to debit the account. Your full bank account number is held by Stripe and is accessible to authorised Penny staff through the Stripe dashboard for the limited purposes of administering the direct debit (for example, verifying or correcting the mandate). It is not transmitted into, or stored within, Penny's own systems.

    Stripe collects the underlying card or bank account details from you directly through its own forms and holds those details under its own privacy terms. We use the summarised information Stripe sends us to verify the payment, identify the customer behind a transaction, fulfil and ship physical goods to the correct address, issue receipts and invoices, prevent fraud, and comply with our record-keeping obligations under the AML/CFT Act 2009. We do not receive or store your full card number in Penny's own systems.

The purpose of each of these collections is to provide and operate the Service, verify eligibility for particular sites or pricing, process payments, and meet our legal obligations. We will take reasonable steps to make you aware of these collections at or near the time they occur (for example, in the operator-assisted sign-up flow or in your booking confirmation), unless you have already been made aware or another exception under the Privacy Act applies.

Tracking & Cookies Data

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information.

Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyze our Service.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

Examples of Cookies we use:

  • Session Cookies. We use Session Cookies to operate our Service.
  • Preference Cookies. We use Preference Cookies to remember your preferences and various settings.
  • Security Cookies. We use Security Cookies for security purposes.

Use of Data

We use the collected data for various purposes:

  • To provide and maintain the Service
  • To notify you about changes to our Service
  • To allow you to participate in interactive features of our Service when you choose to do so
  • To provide customer care and support
  • To provide analysis or valuable information so that we can improve the Service
  • To monitor the usage of the Service
  • To detect, prevent and address technical issues
  • To verify vehicle self-containment status and membership entitlements (such as NZMCA membership) so that we can apply the correct pricing and site eligibility rules to your bookings
  • To process payments and issue receipts, including card and direct debit payments processed through our payment processor (Stripe) and cash payments taken at sites operated by Penny
  • To verify your billing address with Stripe as part of fraud prevention, and to use your shipping or delivery address to fulfil and dispatch physical goods you have ordered
  • To verify your identity and conduct customer due diligence, including using your date of birth and nationality, where required under the Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) Act 2009 and to satisfy guest-registration and visitor-statistics requirements that camp ground operators are subject to
  • To meet our obligations, and to assist participating camp ground operators in meeting their obligations, under New Zealand legislation, including the Privacy Act 2020, the Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) Act 2009, the Camping-Grounds Regulations 1985, and any applicable local council bylaws governing camp grounds and freedom camping

Transfer Of Data

Your information, including Personal Data, may be transferred to – and maintained on – computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

Disclosure Of Data

Legal Requirements

We may disclose your Personal Data in the good faith belief that such action is necessary to:

  • To comply with a legal obligation
  • To protect and defend the rights or property of KiwiCash
  • To prevent or investigate possible wrongdoing in connection with the Service
  • To protect the personal safety of users of the Service or the public
  • To protect against legal liability

Your Rights to Access and Correct Your Information

Under the Privacy Act 2020 you have the right to ask us:

  • whether we hold any personal information about you;
  • to give you access to that information; and
  • to correct that information if you believe it is wrong.

You can exercise these rights at any time from within the Service or by contacting us at help@go-penny.com. We will respond as soon as reasonably practicable and in any case within the timeframes set by the Privacy Act. There is no charge for making a request, and you can make a complaint to the Office of the Privacy Commissioner (privacy.org.nz) if you are not satisfied with our response.

Destruction of Data

You may request account closure and permanent anonymisation of your personal data at any time from within our platform. We are required by New Zealand law to retain your data for a minimum of five (5) years, under the Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) Act 2009. Destruction of your personal data will be scheduled for 5 years following the date of your final transaction with us, or immediately if you have not performed any transactions.

Security Of Data

The security of your data is important to us but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Participating Providers

We may employ third party companies and individuals to facilitate and benefit from our Service (“Participating Providers”), to provide the Service on our behalf, to perform Service-related services or to assist us in analyzing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Analytics

We may use third-party Service Providers to monitor and analyze the use of our Service.

Google Analytics

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en

Links To Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.