ReShopMe — Privacy & Cookies Policy

Version 2.1 · Effective 10 August 2026 · Replaces the version of 6 October 2023.

1. Introduction

1.1 This is the Privacy & Cookies Policy of ReShopMe Limited ("ReShopMe", "we", "us", "our"), a company incorporated in New Zealand. It forms part of our Terms & Conditions and should be read with them and with our Refunds & Returns Policy.

1.2 It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.

1.3 We handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles. Where we deal with people in Australia we also have regard to the Australian Privacy Act 1988.

1.4 Privacy Officer. Our Privacy Officer is Dr Neil Loftus. Questions, requests and complaints go to the Privacy Officer at support@reshopme.com.

1.5 We may revise this policy. The current version is always at this link, and we will tell you about significant changes by email or through the site. Older versions no longer apply.

2. Information you give us

2.1 To open an account: a valid email address. Depending on what you do, we may also collect your name, contact number, delivery address and, if you sell, your ship-from address and payout details.

2.2 When you sell: your listings, photographs, descriptions, prices, shop name and profile.

2.3 When you buy: your delivery address and order history. Card details are entered directly with our payment provider — we never see or store your full card number.

2.4 When you contact anyone through ReShopMe: the content and metadata of in-app messages and calls between you and another user or our support team.

2.5 When you take part in a livestream: if you host, the video and audio of your stream, which is recorded and may be replayed after the event. If you watch or comment, your username and comments are visible to others in the stream.

2.6 Identity verification information (new). Where we are required to verify your identity — see section 6 — we collect identity documents and supporting information, which may include your full name, date of birth, address and, in some cases, information about the source of your funds.

2.7 When you use our content tools (new). The photographs and reference images you upload — including images of you, or of another person who has given you consent — and the content generated from them. This is likeness data: accounts holding it must use two-factor authentication, and section 7.3 sets out when it is deleted.

3. Information we collect automatically

3.1 We use cookies and similar technologies (log files, clear GIFs, local storage). Section 11 explains what for and how to control them.

3.2 We collect your IP address, device and operating system, browser type, device characteristics, the referring website, and which pages you visit and when.

3.3 We receive and record some of this — including an email or IP address — about a person who is not yet registered, in connection with certain features.

3.4 Public information. Your username is public. Others can see the date you joined, your ratings and reviews, photos of items you are selling or have sold, your profile information, your listings and your shop pages.

3.5 If you connect or register using a third-party service, you grant us permission to receive information from that service.

4. Why we use your information

We use your information to:

4.1 provide the service — create and run your account, list items, take payment, arrange delivery, pass messages between buyers and sellers, and produce the content you ask our content tools to generate;

4.2 process payments, refunds, claims and payouts, including holding funds and deciding claims;

4.3 identify and authenticate you, and keep accounts secure;

4.4 prevent and detect fraud, scams and misuse, including identifying accounts operated by the same person;

4.5 meet our legal obligations, including our obligations under the AML/CFT Act 2009 (section 6), tax law and consumer law;

4.6 contact you about your account, orders and claims;

4.7 improve the service, through analytics and aggregate research;

4.8 market to you, where you have chosen to receive it. You can opt out of marketing at any time. (The 2023 policy asserted a general right to use your information for "targeted online and offline marketing" — that is narrowed here to what you have agreed to.)

5. Sharing your information

5.1 We do not sell your personal information.

5.2 Between buyers and sellers. To complete a sale we share information between the two users involved — the delivery address and contact details a seller needs to send your order, and a seller's return address where you need to send something back. By buying or selling you are directing us to share your information in this way.

5.3 What the other user may do with it. Only what the transaction requires. You must not add another user to a mailing list, send unsolicited commercial messages, or otherwise misuse their information.

5.4 Service providers, only so far as they need it: our payment providers, carriers and the shipping platform that books them, our tracking provider, our messaging and calling provider, our email provider, and our hosting and analytics providers.

5.5 Authorities. We disclose personal information where the law requires it or permits it, including to the New Zealand Police Financial Intelligence Unit, the Department of Internal Affairs as our AML/CFT supervisor, and other agencies investigating an offence. See section 6.3.

5.6 To protect our rights — to establish, exercise or defend legal claims.

5.7 Aggregated or anonymised information may be shared with business partners. It does not identify you.

6. Anti-money laundering — what this means for your privacy

6.1 Since 1 June 2025, online marketplaces that handle the funds for a sale are reporting entities under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. We handle those funds, so we are one. Our supervisor is the Department of Internal Affairs.

6.2 We may have to verify your identity. If your transactions with us reach the threshold set by the AML/CFT regulations, or where the Act otherwise requires it, we must collect and verify identity information before you can continue. We may limit or suspend an account until we receive it.

6.3 We may have to report you, and we may not be able to tell you. If we have reasonable grounds to suspect that activity is connected with an offence, the Act requires us to report it to the Financial Intelligence Unit — and it also prohibits us from telling you that we have done so, or from telling you what a report contains. If we suspend an account or decline a transaction, we may therefore be unable to give you a reason.

6.4 We must keep records for at least five years, and that obligation overrides a request to delete them. See section 7.

6.5 We monitor transaction patterns and account information, including to identify accounts operated by the same person or by people acting together. That is a legal requirement, not a commercial choice.

7. How long we keep it

7.1 We keep your information for as long as we need it for the purpose we collected it, and no longer. That is what information privacy principle 9 of the Privacy Act 2020 requires of us. If you no longer want us to hold it, you may close your account.

7.2 We keep it longer where the law requires it, and in those cases we cannot delete it on request:

• Anti-money laundering records — identity information, transaction records and related material covered by section 6.4 — for at least five years.
• Invoices, receipts and accounting records — for seven years, as the Companies Act 1993 requires of us.

7.3 Inactive accounts. If you do not sign in for 24 months we retire the account: we return any remaining credit balance to you, less a service fee, and we delete:

• the content you purchased from our content tools, and
• the material used to create it, including any photographs of you or images you uploaded as references.

7.4 We warn you first, three times. We email the address on your account at 21, 22 and 23 months after your last sign-in. Each email tells you the date on which the account will be retired if you remain inactive, and what will happen to your credit balance and your content. Signing in stops it — any sign-in resets the 24-month period and cancels the retirement.

7.4a To return a credit balance we need an account in your own name, and we may need to verify it before we can pay it out. If we cannot reach you or cannot complete the payment, the balance remains money we owe you, and is dealt with under the Unclaimed Money Act 1971.

7.5 What is not deleted at 24 months. Deletion under 7.3 does not reach the records we are required to keep under 7.2. Your order history, invoices and any identity information collected for anti-money laundering purposes are retained for their full periods, whether or not your account is active, and whether or not it has been closed. We say this here because the deletion notice would otherwise read as a promise to erase everything, and it is not one.

8. Sending information overseas

8.1 ReShopMe operates across New Zealand and Australia, and some of our providers are outside New Zealand. Your information may therefore be held or processed overseas — including in Australia, the United States and the European Union, depending on the provider.

8.2 Before we send personal information overseas we take reasonable steps to satisfy ourselves that it will be protected by comparable safeguards, as the Privacy Act 2020 requires.

8.3 If you buy from or sell to someone in another country, the delivery details needed to complete that order will be disclosed to them there.

9. Your rights

9.1 Access and correction. You may ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. You can change much of it yourself in your account settings. We will respond within the time the Privacy Act allows.

9.2 We may decline a request where the Act permits — including where releasing it would reveal information covered by section 6.3.

9.3 Complaints. Contact our Privacy Officer first. If you are not satisfied, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

10. Security

10.1 Your account is protected by a password. Please choose it carefully, keep it secure, and sign out on shared devices.

10.2 Information is encrypted in transit. Card details are handled by our payment provider — your card number is safe even from us. We follow generally accepted industry standards for the information we do hold.

10.3 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10.4 If a privacy breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.

11. Cookies

11.1 We use cookies and similar technologies to:

• keep the site working — sign you in, hold your cart, and keep it secure. These are strictly necessary and cannot be turned off;
• remember your preferences;
• understand how the site is used, so we can improve it;
• support fraud prevention and account-security checks, including recognising a device that has been used before.

11.2 You can block or delete cookies in your browser. If you block the strictly necessary ones, parts of the site will not work — you will not be able to stay signed in or check out.

11.3 Where we use non-essential cookies we will ask for your consent, and you can withdraw it at any time.

12. Community

12.1 ReShopMe is a marketplace and a community. Reviews, comments, shop pages and livestream chat are public. Use common sense about what you post: anything you put there can be read, collected and used by others. You are responsible for the personal information you choose to post.

13. Children

13.1 You must be 18 or over to use ReShopMe. We do not knowingly collect personal information from anyone under 18, and we delete it if we discover we have.