Privacy Policy

Last updated: June 2026 · Effective immediately

BlueTika Limited (ABN/NZBN: [To be added], "BlueTika", "we", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with the Privacy Act 2020 of New Zealand.

1. Information We Collect

1.1 Information You Provide

  • Registration data: name, email address, phone number, password, role preference (buyer/seller)
  • Seller information: business name, NZBN, address, bank/Stripe details for payouts, tax information
  • Communication: messages with other users, dispute reports, support inquiries, feedback
  • Account verification: government-issued ID documents, proof of address, biometric data for passkeys
  • Payment information: processed securely via Stripe — we never store full card numbers
  • Profile data: avatar, store description, social media links, shipping addresses

1.2 Information Collected Automatically

  • Device & browser data: IP address, browser type, operating system, device identifiers
  • Usage data: pages visited, search queries, time spent, click patterns, referral sources
  • Log data: access timestamps, error reports, security event logs
  • Cookies & tracking: session cookies, authentication tokens, analytics via Plausible
  • Location data: approximate location derived from IP address

2. How We Use Your Information

We use your personal information for the following purposes:

  • Service delivery: to create accounts, process orders, deliver products/services, and manage transactions
  • Communication: to send order confirmations, security alerts, policy updates, and customer support responses
  • Platform improvement: to analyse usage patterns, fix bugs, develop new features, and enhance security
  • Trust & safety: to verify identities, prevent fraud, enforce terms of service, and handle disputes
  • Legal compliance: to meet obligations under NZ tax law, consumer protection law, and anti-money laundering regulations
  • Marketing (opt-in): to send promotional emails about features, events, and partnerships (you can unsubscribe anytime)

3. Legal Basis for Processing

Under the Privacy Act 2020, we rely on these grounds:

  • Contractual necessity: processing required to provide marketplace services
  • Consent: explicit consent for marketing communications and analytics cookies
  • Legitimate interests: platform security, fraud prevention, service improvement
  • Legal obligation: compliance with NZ Tax Administration Act and Consumer Guarantees Act

4. Information Sharing & Disclosure

4.1 Service Providers

We share data with trusted processors who assist our operations. All are bound by confidentiality agreements and comply with NZ privacy standards:

  • Stripe: payment processing and payout disbursement (PCI-DSS compliant)
  • Cloudflare: hosting, CDN, D1 database, KV storage, R2 object storage, Workers runtime, Turnstile CAPTCHA
  • Amazon SES: transactional email delivery
  • Plausible Analytics: privacy-friendly web analytics (no personal data collected)

4.2 Other Users

When you list or purchase products, your name and email may be shared with other users to facilitate the transaction. Your phone number and address are shared only with your consent.

4.3 Legal Requirements

We may disclose information if required by law, court order, or to protect the rights, property, or safety of BlueTika, its users, or the public.

5. Cross-Border Data Transfers

Some of our service providers operate outside New Zealand (primarily Cloudflare's global infrastructure). Under the Privacy Act 2020, we take reasonable steps to ensure overseas recipients comply with NZ privacy principles. Data may be stored in servers located in New Zealand, Australia, the United States, and other jurisdictions.

6. Data Security

We implement industry-standard security measures:

  • Encrypted data in transit (TLS 1.3) and at rest
  • Passwords hashed with PBKDF2 (100,000 iterations)
  • JWT tokens with secure HttpOnly cookies
  • Rate limiting and brute-force protection
  • IP blocklist and security event logging
  • Regular security audits and vulnerability scanning

7. Data Retention

We retain personal information only as long as necessary:

  • Active accounts: retained while your account is active
  • Deleted accounts: personal data deleted within 30 days of account deletion, except transaction records retained for 7 years for NZ tax compliance
  • Security logs: retained for 90 days unless part of an ongoing investigation
  • Marketing preferences: retained until you unsubscribe

8. Your Rights Under the Privacy Act 2020

You have the right to:

  • Access: request a copy of your personal information we hold
  • Correction: request correction of inaccurate or incomplete data
  • Deletion: request deletion of your personal information (subject to legal retention requirements)
  • Restriction: request we restrict processing of your data in certain circumstances
  • Portability: request transfer of your data in a machine-readable format
  • Withdraw consent: withdraw consent for marketing communications at any time
  • Lodge a complaint: contact our Privacy Officer (see below) or the Office of the Privacy Commissioner (opc.org.nz, 0800 807 884)

9. Data Breach Notification

In the event of a data breach that is likely to cause serious harm, we will:

  • Notify affected individuals as soon as practicable
  • Report to the Office of the Privacy Commissioner within 72 hours of becoming aware
  • Take immediate remediation steps to contain and investigate the breach

10. Children's Privacy

BlueTika is not intended for persons under 18 years of age. We do not knowingly collect personal information from children. If we discover we have collected data from a minor, we will delete it promptly.

11. Cookies & Tracking Technologies

See our Cookie Policy for full details on cookies, analytics, and third-party tracking.

12. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA. Please contact us at hello@bluetika.nz for details.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or site notification. Continued use of the platform after changes constitutes acceptance.

14. Contact — Privacy Officer

BlueTika Limited
Privacy Officer
Email: privacy@bluetika.nz
Address: Auckland, New Zealand

If you are not satisfied with our response, you can lodge a complaint with the Office of the Privacy Commissioner:
Phone: 0800 807 884 · opc.org.nz