Privacy Policy

This Privacy Policy explains how Wots TCG Vault NZ collects, uses, stores, and protects personal information, in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).

1. Information we collect

• Account details: full name, username, email, password (hashed), location.
• Facebook profile information, if you connect your Facebook account.
• Government-issued ID documents, submitted for seller verification only.
• Listing, order, payment, and messaging data generated through your use of the Platform.
• Technical data: IP address, device/browser information, for security and fraud prevention.

2. How we use information

• To operate the marketplace: listings, orders, payments, messaging, reviews.
• To verify seller identity and reduce fraud.
• To communicate with you about your account, orders, and policy updates.
• To comply with legal, tax, and regulatory obligations.

3. Identity documents

Government ID documents are uploaded directly to encrypted, access-restricted storage. Access is limited to trained verification reviewers and is logged. Documents are retained only as long as necessary for verification and compliance purposes, after which they are scheduled for deletion.

4. Facebook data

Connecting Facebook links your account for login and verification purposes. We do not publish your Facebook profile link publicly unless you explicitly opt in via your account settings. We do not access or store private Facebook data beyond your public profile identifier and (if provided) email and profile photo.

5. Sharing information

We share information with service providers strictly as needed to operate the Platform: our payment processor (Stripe), object storage provider, and email provider. We do not sell personal information to third parties.

6. Your rights

Under the Privacy Act 2020 you may request access to, or correction of, your personal information. Contact privacy@wotstcgvault.co.nz to make a request.

7. Data retention & deletion

We retain account and transaction data for as long as your account is active and as required for tax/legal record-keeping thereafter. Identity documents follow a shorter, dedicated retention schedule described above.

Placeholder notice: this document is a starting template only. Obtain review from a qualified New Zealand privacy/data-protection lawyer before launch, including confirmation of retention periods, cross-border data transfer disclosures (if using overseas cloud providers), and AML/CFT identity-verification obligations if applicable.