Legal
Privacy policy
Last updated 11 October 2026
Who we are
Dealership.nz is operated by Hamish Palmer, a sole trader based in Australia, trading as Dealership.nz ("we", "us"). We carry on business in New Zealand through this site, so we follow the Information Privacy Principles of the New Zealand Privacy Act 2020. Our privacy officer is Hamish Palmer: help@dealership.nz.
What we collect
- Account: your name, email address, password (stored only as a one-way hash), and two-factor authentication settings.
- Profile: anything you add, such as a phone number, your suburb and a profile photo.
- Dealerships: business name, MVT registration number, address and map location, opening hours, website, public email, logo, cover image and the other details on your Dealership page.
- Listings: vehicle details, photos, price, location, and any registration plate, VIN, WoF and registration details or Consumer Information Notice you enter.
- Activity: enquiries and messages, trade offers, reviews, reports of listings and members, saved searches and favourites, and anything you send us through the contact page.
- Billing: your Stripe customer reference and subscription status. Your card details go straight to Stripe; we never see or store them.
- API: the names and scopes of your API keys. The keys themselves are stored only as one-way hashes.
- Technical: IP address, browser type, the pages you request and error reports. We use these to keep the site secure, limit abuse (for example, too many sign-in attempts) and fix problems.
Most of this comes from you. Some comes from other members (a message or review they send about you) and from Stripe (whether a payment went through). We don't buy information about you.
What other people can see
- Your listings are public: the vehicle details, photos, price, suburb and region, and an approximate map location.
- Private sellers are shown by first name. Dealerships are shown by business name, with the address, MVT number and contact details on their Dealership page.
- A dealership's used-vehicle listings show the Consumer Information Notice, which includes the registration plate and VIN, as the law requires. On a private listing the plate is shown only if you enter it.
- Your phone number is shown only if you switch that on in your profile.
- Your email address is never shown on the site. When a seller accepts a dealer's trade offer, the two of them can see each other's email address so they can arrange the swap. Everything else happens in the site's messages.
- Reviews you write appear on the seller's page with your first name.
Photos are re-saved when you upload them, which removes hidden data such as the GPS location your phone may store in a photo.
How we use it
To run the marketplace: show your listings, deliver messages, send the emails the site needs to send (verification, new enquiries, unread messages, billing and security notices) and the saved-search alerts you've turned on. Also to take payments, keep accounts secure, prevent fraud and abuse, enforce our terms, deal with reports, meet legal obligations, and improve the site using overall usage patterns.
We don't sell personal information, we don't use it for third-party advertising, and we don't send marketing email. Every saved-search alert has an unsubscribe link, as the Unsolicited Electronic Messages Act 2007 requires.
Who we share it with
Only as needed to run the site:
| Service | What it receives | Where |
|---|---|---|
| Vultr (hosting) | The site's database, photos and backups | Sydney, Australia |
| Stripe (payments) | Your name, email, card details and payment history | United States and other countries |
| Postmark (email delivery) | Your email address and the content of emails we send you | United States |
| Cloudflare (DNS and network security) | Your IP address and the pages you request, when traffic passes through its network | Global network |
| Sentry (error monitoring) | Technical details of errors, which can include your account id and IP address (never passwords or form contents) | European Union or United States |
| Map tile provider (named on each map) | Your IP address and the map area you view | Depends on the provider |
We also disclose information when the law requires it, such as a court order or a request from the Police or a regulator that we're legally bound to meet, and to protect someone from serious harm.
Overseas handling
We're based in Australia and the site is hosted there, so your information is held outside New Zealand, and some of the services above are elsewhere. Before we disclose information outside New Zealand we take the steps Information Privacy Principle 12 requires: we use only providers we reasonably believe are subject to comparable privacy safeguards, by law or by contract.
How long we keep it
We keep your information while your account is open. When you delete your account, we delete your profile, your listings and their photos, the enquiries and messages you sent, your saved searches, favourites and reviews, and we cancel your subscriptions. We keep records of payments for seven years, as New Zealand and Australian tax law requires; Stripe keeps its own records. Deleted information drops out of our backups within 14 days.
Security
Passwords and API keys are stored only as one-way hashes, connections to the site are encrypted, two-factor authentication is available on every account, and access to the system is limited to the operator. No online service can promise perfect security. If a privacy breach is likely to cause anyone serious harm, we'll tell the Office of the Privacy Commissioner and the people affected as soon as practicable.
Your rights
Under the Privacy Act 2020 you can ask for a copy of the personal information we hold about you and ask us to correct it. You can change most of it yourself from your profile, Dealership page and listings, and delete your account from the security page. For anything else, email help@dealership.nz; we'll respond within 20 working days. If we decline to correct something, you can ask us to attach a statement of the correction you wanted.
Cookies
We use only the cookies needed to keep you signed in and to protect forms from forgery. The site also keeps on-screen notices (such as "Listing published") in your browser's own storage for a few minutes, so they survive a page change. There are no analytics or advertising cookies.
Children
Accounts are for people aged 18 or over.
Complaints and changes
If you're unhappy with how we've handled your information, tell us first and we'll respond within 20 working days. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz. We'll post any changes to this policy here with a new date, and email account holders about material changes.