Privacy policy

Last updated: 31/08/2026

1. WHO WE ARE

1.1 Exchange Store Limited ("Exchange Store", "we", "us" or "our") operates an online luxury resale platform through which users can list, buy and sell pre-loved designer fashion and accessories.

1.2 We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 2020.

1.3 If you have any questions about this Privacy Policy, or if you wish to exercise your privacy rights, you can contact us at:

Exchange Store Limited

Email: admin@exchangestore.com

Privacy Officer: Sabrina Soar

1. WHAT THIS PRIVACY POLICY COVERS

2.1 This Privacy Policy explains how we collect, hold, use and disclose personal information when you:

(a) visit or use our website;

(b) create or update an account;

(c) list an item for sale;

(d) buy an item;

(e) provide an item to us for authentication, quality control or fulfilment;

(f) contact us;

(g) sign up to receive marketing communications;

(h) interact with us on social media; or

(i) otherwise use or interact with our services.

2.2 This Privacy Policy should be read together with our Terms & Conditions and any other policies published on our website.

1. WHAT PERSONAL INFORMATION WE COLLECT

3.1 The personal information we collect depends on how you interact with us and our services.

3.2 Information you provide directly

We may collect personal information you provide directly to us, including:

(a) your name;

(b) email address;

(c) phone number;

(d) billing address;

(e) delivery address;

(f) account login details;

(g) bank account details or payout information for seller payments;

(h) item listing details;

(i) photographs and descriptions of items;

(j) size, measurement, brand, condition, repair, alteration and provenance information relating to items;

(k) communications with us, including customer support enquiries, complaints, claims and dispute correspondence;

(l) information you provide when submitting an authenticity concern, return request, refund request or other claim;

(m) identity, verification or fraud-prevention information where reasonably required; and

(n) any other information you choose to provide to us.

3.3 Transaction and account information

We may collect information relating to your use of our services, including:

(a) account activity;

(b) order history;

(c) purchase history;

(d) sale history;

(e) item listing history;

(f) payout history;

(g) refund and return information;

(h) shipping and tracking information;

(i) authentication and quality control records;

(j) buyer and seller claim records;

(k) fraud, chargeback, risk or compliance information; and

(l) correspondence relating to transactions.

3.4 Payment information

Payments may be processed by third-party payment providers. We do not generally store full payment card details ourselves.

We may receive limited payment-related information, such as:

(a) payment status;

(b) transaction identifiers;

(c) billing name;

(d) payment method type;

(e) card type;

(f) the last four digits of a payment card;

(g) chargeback or failed payment information; and

(h) fraud or payment risk information.

3.5 Information collected automatically

When you visit or use our website, we and our service providers may collect:

(a) IP address;

(b) browser type;

(c) device information;

(d) operating system information;

(e) pages viewed;

(f) links clicked;

(g) products or listings viewed;

(h) referral URLs;

(i) approximate location derived from IP address;

(j) cookie identifiers;

(k) diagnostic and analytics data; and

(l) information about how you interact with our website and emails.

3.6 Information collected from third parties

We may collect personal information about you from third parties, including:

(a) payment processors;

(b) banks, card issuers or payment platforms;

(c) courier and logistics providers;

(d) authentication providers, including My Haute NZ or other appointed authentication partners;

(e) fraud prevention, identity verification or risk assessment providers;

(f) e-commerce, website hosting and technology providers, including Shopify or similar providers;

(g) analytics, advertising and marketing providers;

(h) social media platforms where you interact with our pages, advertisements or content;

(i) professional advisers;

(j) regulators, law enforcement agencies, courts or dispute bodies where relevant; and

(k) other users, where information is provided in connection with a transaction, claim, dispute, delivery, sale or listing.

1. INDIRECT COLLECTION OF PERSONAL INFORMATION

4.1 Sometimes we collect personal information about you from someone other than you. This is called indirect collection.

4.2 Examples of indirect collection may include where:

(a) a payment provider gives us payment, fraud or chargeback information;

(b) a courier gives us tracking, delivery or address information;

(c) an authentication provider gives us information relating to an item, transaction or authenticity assessment;

(d) another user provides information about you in connection with a transaction, claim or dispute;

(e) a social media platform provides information about your interaction with our content or advertisements;

(f) a fraud prevention or verification provider gives us information relevant to account security, identity verification or platform integrity; or

(g) we receive information from publicly available sources where relevant to an item, transaction, claim or legal issue.

4.3 Where we collect personal information about you indirectly, we will take reasonable steps to ensure you are aware of the collection and the matters required by law, unless an exception applies.

4.4 We may provide this notice through this Privacy Policy, our Terms & Conditions, account notices, transaction communications, email communications or other appropriate means.

1. WHY WE COLLECT PERSONAL INFORMATION

5.1 We collect, use and hold personal information for purposes including to:

(a) provide, operate and improve our services;

(b) create and manage user accounts;

(c) review, approve and manage listings;

(d) facilitate purchases and sales;

(e) process payments, refunds and seller payouts;

(f) arrange shipping, delivery and fulfilment;

(g) conduct quality control and authentication checks;

(h) engage third-party authentication providers;

(i) communicate with buyers and sellers about orders, listings, claims, updates and support matters;

(j) verify identity where reasonably required;

(k) detect, investigate and prevent fraud, counterfeit activity, chargebacks, misuse of our services and other unlawful or harmful conduct;

(l) resolve disputes, complaints, authenticity concerns and claims;

(m) enforce our Terms & Conditions and other policies;

(n) improve website functionality, customer experience, security and business operations;

(o) analyse website traffic, customer behaviour and business performance;

(p) send marketing communications where permitted by law or with your consent;

(q) comply with legal, regulatory, tax, accounting and record-keeping obligations;

(r) protect the rights, property, safety, reputation and interests of Exchange Store, our users, brand owners and third parties; and

(s) carry out any other purpose authorised by you or permitted by law.

1. WHEN WE COLLECT PERSONAL INFORMATION

6.1 We may collect personal information when:

(a) you visit or use our website;

(b) you create or update an account;

(c) you list or submit an item for sale;

(d) you buy an item;

(e) you enter delivery, billing, payment or payout details;

(f) you send an item to us;

(g) we inspect, authenticate or quality check an item;

(h) you contact us by email, website form, social media or another channel;

(i) you submit a claim, complaint, return request, refund request or authenticity concern;

(j) you respond to a survey, promotion or campaign;

(k) you subscribe to or interact with marketing communications;

(l) you browse our website or interact with cookies, pixels or similar technologies; or

(m) a third party provides information to us in connection with a transaction, authentication, payment, shipping, fraud review, dispute or legal matter.

1. COOKIES, PIXELS AND ANALYTICS

7.1 We may use cookies, pixels and similar technologies to:

(a) keep you logged in;

(b) remember your preferences;

(c) operate and secure the website;

(d) understand site traffic and usage;

(e) improve website performance and user experience;

(f) analyse customer behaviour;

(g) measure the effectiveness of marketing campaigns; and

(h) support advertising, remarketing and retargeting.

7.2 You can manage cookies through your browser settings. Disabling cookies may affect the functionality and performance of our website.

7.3 Third-party providers, such as analytics, advertising, social media or e-commerce providers, may also use cookies or similar technologies in connection with our website.

1. WHO WE DISCLOSE PERSONAL INFORMATION TO

8.1 We may disclose personal information to:

(a) service providers who help us operate our business, including website hosting, e-commerce, cloud storage, analytics, email, customer support, marketing, payment processing and fraud prevention providers;

(b) payment processors, banks, card issuers and payment platforms;

(c) courier and logistics providers;

(d) authentication and quality control partners, including My Haute NZ or other appointed authentication providers;

(e) technology and software providers, including Shopify or similar providers;

(f) professional advisers, including lawyers, accountants, insurers and auditors;

(g) debt collection agencies, where lawful and reasonably necessary;

(h) regulators, law enforcement agencies, courts, tribunals, dispute bodies or government agencies where required or permitted by law;

(i) brand owners, rights holders or their representatives where reasonably necessary to investigate suspected counterfeit, stolen or infringing goods;

(j) actual or prospective purchasers, investors, funders or advisers in connection with a sale, merger, acquisition, restructure, investment or financing transaction involving Exchange Store;

(k) other users, where reasonably necessary to complete a transaction, resolve a claim or manage a dispute;

(l) any person authorised by you; and

(m) any other person where disclosure is permitted or required by law.

8.2 We do not sell personal information to third parties.

1. OVERSEAS DISCLOSURE

9.1 Some of our service providers may store, access or process personal information outside New Zealand, including through cloud-based software, e-commerce infrastructure, payment processing, analytics, advertising, email and customer support tools.

9.2 Where we disclose personal information to an overseas recipient, we will take reasonable steps to ensure that the recipient is subject to privacy protections that provide safeguards comparable to those in the New Zealand Privacy Act 2020, or otherwise ensure that the disclosure is permitted by law.

9.3 By using our services, you acknowledge that your personal information may be processed by service providers located outside New Zealand where this is reasonably necessary for the operation of our business and services.

1. HOW WE PROTECT PERSONAL INFORMATION

10.1 We take reasonable steps to protect personal information from loss, misuse, interference, unauthorised access, modification or disclosure.

10.2 These steps may include:

(a) access controls and staff permissions;

(b) secure platforms and password protection;

(c) two-factor authentication where appropriate;

(d) encryption and payment security measures where available;

(e) limiting access to personal information to those who need it for business purposes;

(f) using reputable third-party providers;

(g) internal procedures for handling privacy requests, complaints and suspected privacy breaches; and

(h) reviewing security practices from time to time.

10.3 However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

1. HOW LONG WE KEEP PERSONAL INFORMATION

11.1 We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

(a) provide our services;

(b) manage user accounts;

(c) complete transactions;

(d) resolve claims, complaints and disputes;

(e) investigate fraud, counterfeit concerns, chargebacks or unlawful conduct;

(f) enforce our Terms & Conditions;

(g) meet tax, accounting, legal and regulatory obligations;

(h) maintain business and transaction records; and

(i) protect our legal rights.

11.2 When personal information is no longer required, we will take reasonable steps to delete it, securely destroy it or de-identify it.

1. ACCESS AND CORRECTION

12.1 You may request access to the personal information we hold about you.

12.2 You may also request correction of your personal information if you believe it is inaccurate, incomplete, out of date or misleading.

12.3 To make an access or correction request, please contact us using the details in this Privacy Policy.

12.4 We may require reasonable evidence to verify your identity before responding to a request.

12.5 We will respond to access and correction requests in accordance with the Privacy Act 2020.

1. MARKETING COMMUNICATIONS

13.1 We may send you marketing or promotional communications where you have opted in, where you are an existing customer and the communication is permitted by law, or where otherwise permitted by law.

13.2 Marketing communications may include emails about new arrivals, promotions, campaigns, events, services, content or updates.

13.3 You can opt out of marketing communications at any time by using the unsubscribe link in the message or by contacting us.

13.4 Even if you opt out of marketing communications, we may still send you service-related communications, including order updates, account notices, transaction emails, claim communications and important service or legal notices.

1. CHILDREN

14.1 Our services are not directed to children under 16.

14.2 We do not knowingly collect personal information from children under 16 without appropriate authorisation.

14.3 If we become aware that we have collected personal information from a child under 16 without appropriate authorisation, we may delete that information or take other steps we consider appropriate.

1. THIRD-PARTY WEBSITES AND SERVICES

15.1 Our website may contain links to third-party websites, services, payment platforms, social media platforms or other online services.

15.2 We are not responsible for the privacy practices, content or security of third-party websites or services.

15.3 We encourage you to review the privacy policies of any third-party websites or services you use.

1. NOTIFIABLE PRIVACY BREACHES

16.1 If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will take steps required by law.

16.2 This may include notifying affected individuals and the Office of the Privacy Commissioner where required.

1. BUSINESS TRANSFERS

17.1 If Exchange Store is involved in a sale, merger, acquisition, restructure, investment, financing transaction or transfer of all or part of its business or assets, personal information may be disclosed to parties involved in that transaction and their advisers.

17.2 Where this occurs, we will take reasonable steps to ensure that personal information continues to be handled in accordance with applicable privacy law.

1. CHANGES TO THIS PRIVACY POLICY

18.1 We may update this Privacy Policy from time to time.

18.2 The updated version will be posted on our website with the revised "Last updated" date.

18.3 Your continued use of our website or services after an update means you acknowledge the updated Privacy Policy, to the extent permitted by law.

1. CONTACT US

19.1 If you have any questions, concerns or complaints about privacy, or if you wish to request access to or correction of your personal information, please contact us at:

Exchange Store Limited

Email: admin@exchangestore.com

Privacy Officer: Sabrina Soar