Legal
Privacy policy
Version 1.0, in force from 21 August 2026.
Pritty Ghood Privacy Policy
Version: 1.0
Effective date: 21 August 2026
Who we are. Pritty Ghood Advertising Limited, trading as Pritty Ghood, NZBN 9429049579437, registered office 34 Edgewater Parade, Waiuku, Auckland 2123. We are the agency responsible for the personal information described here under the Privacy Act 2020.
Contact. Privacy questions, access requests and correction requests go to Info@prittyghood.com.
This policy sits alongside the Platform Terms. Where the two overlap, this policy governs how we handle personal information.
1. What we collect, and why
We only collect what we need to run the marketplace. Information Privacy Principle 1 requires a lawful purpose connected to our function, so each item below is listed with the reason it exists.
Everyone with an account
| What | Why |
|---|---|
| Name and email address | To create your account, identify you, and send you notices about your bookings |
| Password | Held by our authentication provider as a hash. We never see or store your actual password |
| Phone number, if you give us one | So a host and an advertiser can sort out a problem quickly |
| Your acceptance of these terms: date and time, the version you accepted, your IP address and browser user agent | To prove what you agreed to and when. This is a record of a contract, and we keep it |
Hosts
| What | Why |
|---|---|
| Business name, address, category, logo | To build your public listing |
| The location coordinates of your address | To place your space on a map and support searching by distance. We obtain these by sending your address to OpenStreetMap's Nominatim service |
| Photographs of your advertising space | To show advertisers what they are booking. These are public |
| Your GST registration status | To work out whether GST applies to your price and who issues the taxable supply information |
| Your nominated charity | So we know where to send the donation |
| Bank and identity details for payouts | Collected by Stripe, not by us. See section 4 |
Advertisers
| What | Why |
|---|---|
| Business or personal details, and your declaration about whether you are advertising in trade | To form the contract, and to work out which consumer protections apply to you |
| Artwork you upload | To send to the host to display. Artwork is stored privately and shared only with the host of a booking you have made |
| Booking history and messages | To operate the booking and to help if something goes wrong |
Signwriters
Business details, portfolio images and pricing, so advertisers can find you.
2. Campaign QR codes
Every campaign gets a QR code. When somebody scans it we record the time, a broad device category (mobile, tablet or desktop) and the referring page, so we can tell the advertiser how their campaign performed.
We do not store the IP address of a person who scans a code. We combine the IP address, browser user agent and referrer into a one way hash and store only that hash. It lets us tell a repeat scan from a new one without keeping anything that identifies the person scanning. We cannot reverse it.
3. Photographs of advertisements in place
Hosts photograph the advertisement in position as proof it was displayed. These photographs are stored privately and are visible only to the host who took them, the advertiser on that booking, and us.
Hosts should photograph the advertisement, not the people near it. Where a photograph does capture an identifiable person, that is personal information and we handle it accordingly.
We do not carry out facial recognition or any other biometric processing on these photographs, and we do not permit anyone else to. This is a standing commitment, consistent with the Biometric Processing Privacy Code 2025.
4. Payments
Payments are processed by Stripe. Card numbers are entered directly with Stripe and never reach our systems. We store a reference to the payment, the amounts, and the country the card was issued in, which we need because an overseas card costs more to process and changes the price we quote you.
Hosts who take payment complete an onboarding process with Stripe, which collects identity and bank details directly. That information is held by Stripe under its own terms, not by us.
5. Who we share it with
We are not in the business of selling personal information, and we do not.
- Between a host and an advertiser, we share what a booking requires: the advertiser's artwork and business identity go to the host, and the host's business and location go to the advertiser.
- Service providers who run parts of the platform for us: Supabase (database, authentication and file storage), Vercel (hosting), Stripe (payments), Resend (email delivery), and OpenStreetMap Nominatim (turning a host address into map coordinates). They act on our instructions.
- Where the law requires it, or to establish or defend a legal claim.
Some of these providers store or process information outside New Zealand. Before we send personal information overseas we satisfy ourselves that it will be protected by comparable safeguards, as Information Privacy Principle 12 requires.
6. How long we keep it
- Terms acceptance records: 7 years. These prove the existence and content of a contract, and 7 years covers the limitation period for a contract claim under the Limitation Act 2010.
- Booking, payment and donation records: 7 years, which is the period the Tax Administration Act 1994 requires business records to be kept.
- Artwork and display proof photographs: for the campaign and 12 months afterwards, so a dispute about whether an advertisement ran can be resolved.
- Account information: while your account is open, and then only what the records above require us to keep.
7. Your rights
Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email Info@prittyghood.com. We will respond within 20 working days.
You can update most of your own information from your account at any time.
You can ask us to delete your account. We will do that, except for the records in section 6 that we are required to keep. We will tell you what we are keeping and why rather than quietly retaining it.
If you are not happy with how we have handled your information, you can complain to us first, and then to the Office of the Privacy Commissioner at privacy.org.nz.
8. Security, and what happens if something goes wrong
Access to personal information is restricted to the account it belongs to and to the people on the other side of a booking who need it. Artwork, display proof photographs and payment credentials are held in private storage that is not publicly reachable. Database access is controlled row by row, so one account cannot read another's data.
If we suffer a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected, as sections 112 to 117 of the Privacy Act 2020 require.
9. Cookies
We use cookies that are necessary to keep you signed in and to keep the site secure. We do not use advertising or cross site tracking cookies.
10. Changes to this policy
If we change this policy we will publish the new version here with a new version number and effective date. If a change materially affects how we handle your information we will tell you before it takes effect.