Privacy Policy

BookTrade is operated in New Zealand by Book Trade Ltd (NZBN 9429053578747). Book Trade Ltd collects and holds the personal information described in this policy. Its business address is 35 Farm Road, Northland, Wellington 6012, New Zealand.

Our Privacy Officer is Cameron Paulik and can be contacted at support@booktrade.co.nz.

Depending on how you use BookTrade, we may collect:

• your name, username and email address;
• your delivery address and information needed to fulfil an order;
• account preferences, listings, purchases, sales, refunds and support messages;
• payment references supplied by Stripe, such as Checkout Session and Payment Intent identifiers;
• courier, consignment and tracking information; and
• security and technical records such as IP address, request time, browser details and error logs.

Passwords are stored as one-way password hashes. Card details are entered on Stripe's hosted checkout and BookTrade does not receive or store your full card number or card security code.

Most of what we hold, you gave us yourself. A small amount reaches us from other organisations instead, and New Zealand's Information Privacy Principle 3A requires us to tell you when that happens. Those sources are:

• Stripe, our payment processor, which tells us whether your payment succeeded and gives us reference numbers for the payment, the charge and any refund, so that we can create your order, reconcile our records and refund you. Stripe does not give us your card number or security code.
• NZ Post, whose address checker returns a verified, correctly formatted version of the delivery address you start typing during checkout, so that your parcel is addressed accurately.
• The courier carrying your order, which returns the consignment and tracking number and the scan events recorded as your parcel moves, so that we can tell you where it is and confirm it arrived. Those scan records describe the delivery and the courier depot handling it.

We use this information for the purposes described in the next section, and disclose it only to the recipients listed under "Who receives it". Your rights are the same for this information as for anything you gave us directly: you may ask for a copy of it, ask us to correct it, or ask us questions about it, by contacting our Privacy Officer.

We do not buy personal information, and we do not collect it from social media, data brokers, marketing lists or public records.

We use personal information only where reasonably necessary to:

• create and secure your account;
• process purchases, refunds and seller records;
• arrange delivery and provide tracking;
• communicate about orders and support requests;
• prevent fraud, misuse and security incidents;
• maintain business, tax and accounting records; and
• comply with New Zealand law.

Providing account information is voluntary, but without the required email and delivery details we may be unable to create an account, complete an order or arrange delivery.

We disclose only the information reasonably required for the relevant service. Recipients may include:

• authorised BookTrade administrators and support providers;
• Stripe and the banks or payment providers involved in processing or refunding a payment;
• NZ Post, for checking and formatting a delivery address;
• the courier that carries your order, which needs your name, delivery address and contact details to deliver it and to provide tracking;
• Trade Me, where we book that courier through Trade Me Book a Courier. In that case an administrator enters into Trade Me only the delivery details needed to produce the courier label. Trade Me does not receive your BookTrade account, order history or payment information, and we do not receive orders or customer information from Trade Me;
• hosting, email and encrypted-backup providers acting for BookTrade; and
• regulators, courts or law-enforcement agencies where disclosure is required or permitted by law.

Some service providers may process information outside New Zealand. We select established providers and take reasonable steps to ensure that information handled on our behalf remains subject to appropriate privacy and security safeguards.

We use safeguards appropriate to the information we hold, including encrypted web connections, password hashing, access controls, security logging, restricted production access and encrypted backups. No internet service can guarantee absolute security.

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected or to meet a legal obligation. New Zealand tax and company law requires us to keep business and accounting records for seven years, so the financial record of a purchase — what was sold, when, and for how much — is kept for that period. Other profile, support and operational information is deleted or de-identified when it is no longer required. Backup copies expire under our backup-retention schedule.

You may request deletion of your account by contacting our Privacy Officer. We will verify the request and then remove the information that identifies you: your name, username, email address, the delivery address saved on your account, saved payment-out details, your password and security settings, the recipient details held against your deliveries, the courier's tracking records for them, and the courier labels printed for them.

We keep limited transaction information where it is reasonably required for accounting, for a legal claim, or for an active dispute about an order. That can include the delivery address recorded against a past order, which is held separately from the address saved on your account and may be kept as part of the record of that order. Where delivery information is still needed for one of those reasons, we keep only what that reason requires and for no longer than it requires. If you want to know what is still held about a past order after your account is deleted, ask our Privacy Officer.

You may ask for a copy of personal information BookTrade holds about you, ask for incorrect information to be corrected, or ask questions about how it is used. Contact our Privacy Officer at support@booktrade.co.nz. We may need to verify your identity before releasing information.

If a privacy breach occurs that has caused or may cause serious harm, BookTrade will notify the Office of the Privacy Commissioner and affected people as soon as reasonably practicable, unless a legal exception applies.