Privacy Policy

Buyers & Website Visitors: Name, email address, phone number (optional), country of residence, budget range, preferred regions, property preferences, and privacy acknowledgements submitted through our Private Collection registration form.

Real Estate Agents: Name, professional email, phone number, agency or brokerage, approximate listing volumes, agent biography, profile photographs, and Stripe billing details for subscription management.

Technical Information: IP address, browser type, device identifiers, and interaction data used solely to improve platform performance and security.

We process your personal information strictly for the following purposes:

• To verify and match high-value buyers with off-market and curated property portfolios.
• To send weekly property newsletters tailored to your preferred New Zealand regions.
• To process agent account registrations, subscription billing via Stripe, and property listing approvals.
• To route property enquiries and inspection requests to the relevant listing agent on your behalf.
• To notify you of new listings matching your saved search criteria.
• To respond to general enquiries submitted through our Contact page.
• To use AI-assisted tools to help curate, draft, and refine editorial content and property descriptions, always under human editorial oversight. AI is never used to make automated decisions about buyer eligibility or agent approval without admin review.

We enforce strict access controls to ensure your data is only visible to authorised parties:

• Buyer Data: Private Collection registrations are visible to admin only. Buyer contact details are never shared with agents without explicit admin approval and buyer consent.
• Agent Data: Agent profile information and enquiry details are visible only to that specific authenticated agent and admin. No agent can view another agent's data.
• Property Enquiries: Enquiry details submitted through listing pages are delivered to the relevant listing agent only. No other agent or user has access.
• Admin Access: A single admin role with strong password requirements has access to all platform data for operational and compliance purposes.

We implement comprehensive security measures to protect your personal information:

• Row-Level Security: Database-level access controls ensure agents see only their own listings and enquiries, and buyers see only their own saved properties.
• Session Security: Secure session handling with HTTPOnly and Secure cookie flags. Agent and buyer sessions time out after 60 minutes of inactivity.
• HTTPS Encryption: All data transmission is encrypted via HTTPS across the entire platform.
• Form Security: CSRF protection, rate limiting (5 submissions per IP per hour), and honeypot fields prevent spam and automated attacks.
• Input Validation: All form inputs are validated and sanitised server-side before storage or display.
• Data Minimisation: We collect only data strictly necessary for each form's purpose.

Buyer Registrations: Stored securely for 24 months from last activity. You may request deletion at any time via the link in your confirmation email or by contacting us.

Agent Accounts: Retained while subscription is active. Agents may delete their account at any time via dashboard settings, which permanently purges all data.

Property Enquiries: Retained for 12 months to facilitate follow-up communications.

Deleted Records: When you request deletion, your records are fully purged from our database, not simply flagged as inactive.

Under the New Zealand Privacy Act 2020, you have the right to:

• Request access to your personal information held by us.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information ("Delete My Account" for agents, "Remove My Registration" for buyers).
• Withdraw consent for data processing at any time.
• Lodge a complaint with the Office of the Privacy Commissioner if you believe your privacy rights have been violated.

All email notifications containing personal details are sent securely:

• Emails are sent only to the admin email and the directly relevant party — never CC'd or BCC'd to other addresses.
• Email subject lines use reference numbers only (e.g., "New Private Collection Registration — REF #0042") — never include full personal details.
• All emails are sent via encrypted channels using our verified domain contact.nzluxuryhomes.nz.

We use trusted third-party providers who are contractually bound to handle your data securely:

• Stripe: Payment processing and subscription billing. PCI DSS compliant.
• Resend: Email delivery service for transactional communications.
• Meta Pixel (Facebook): Analytics and advertising measurement. Uses cookies and device identifiers to understand how visitors interact with our website so we can improve our content and the relevance of property advertising. You can opt out via your browser's cookie settings or through the network ad advertising preferences at facebook.com/settings.
• Base44: Platform infrastructure and database hosting with enterprise-grade security.

For privacy enquiries, data access requests, or deletion requests, please contact:

Email: jeff@nzluxuryhomes.nz

NZBN: 9429053855633

Postal Address: 54 Montgomery Square, Nelson