Privacy Policy

Governing law: New Zealand — Privacy Act 2020

1. About this policy

This Privacy Policy explains how Proof Trade Limited (NZCN 9439220) ("PROOF", "we", "us", "our") collects, uses, stores, and discloses personal information in connection with the PROOF platform at prooftrade.co.nz.

PROOF is a verified, invite-only B2B marketplace that connects independent New Zealand alcohol brands with licensed retailers and on-premise venues. Both brands and venues must apply and be approved before accessing the Platform.

By registering for or using the Platform, you agree to the collection and use of your information in accordance with this policy. This policy is governed by the New Zealand Privacy Act 2020 and its 13 information privacy principles.

2. Who we collect information from

• Brand applicants and registered brand accounts
• Store and venue applicants and registered venue accounts
• Visitors to the prooftrade.co.nz website
• Anyone who contacts us directly at hello@prooftrade.co.nz

3. What information we collect

Brand accounts.

• Name and contact details of the primary account holder
• Business name and trading name
• New Zealand Business Number (NZBN) for verification
• Business email address and phone number
• Business address and region
• Bank account details for payout processing – collected and held by our payment partner Stripe, not directly through PROOF.
• Product information, order history, and transaction data
• Login credentials (passwords stored in encrypted form only)

Store and venue accounts.

• Name and contact details of the primary account holder
• Business or venue name
• Liquor licence number for verification
• Venue licence documents (uploaded as PDF or photo) for verification, retained while account is open and for 7 years after the Venues' account is closed.
• Business email address and phone number
• Delivery address, order history, and transaction data
• Login credentials (passwords stored in encrypted form only)

Website visitors.

• IP address and approximate location, browser and device information, pages visited, and referring website, collected via cookies and analytics tools (see section 9).

Platform activity.

• Page views, including which product listings and brand storefronts are viewed
• Searches performed on the Platform
• Add-to-cart events and checkout started
• Favourites saved by venue accounts

Brands can access aggregated page-view data for their own storefronts and product listings only. They cannot see activity on other brands’ pages. Platform activity data is retained for 2 years from the date it is recorded.

Information that we collect from third parties.

We may also collect personal information about individuals from third parties. As soon as reasonably practicable after collection, we take reasonable steps to make those individuals aware of the collection and its purpose, the intended recipients, the name and address of the collecting and holding agencies, any law authorising or requiring the collection, and their rights of access and correction, as required by information privacy principle 3A of the Privacy Act 2020.

4. How we use your information

We use the information we collect to:

• verify your identity and eligibility, process applications, and approve accounts;
• enable brands and venues to transact with each other;
• process payments via our payment partner Stripe, and process payouts to brands;
• maintain order records and transaction history and provide customer support;
• send transactional emails such as order confirmations, dispatch notifications, and payout notifications;
• send venue accounts platform notification emails, including but not limited to new brand alerts, new product alerts and weekly reorder reminders. Upon creating an account, venue users consent to receiving messages, which can be turned off at any time in account settings.
• send platform updates and important notices about your account or our terms;
• with your consent, send marketing emails about new brands, features, and platform news, which you may opt out of at any time;
• monitor for fraud, abuse, and breaches of our terms, and secure and improve the Platform.

We collect and use information for these purposes in accordance with the Privacy Act 2020. Where we rely on your consent — for example, for marketing — you may withdraw it at any time.

5. Aggregated data and market insights

5.1 We may create aggregated and de-identified data and insights from activity on the Platform — for example, category trends, regional demand patterns, and reorder behaviour. Aggregation is done so that the information no longer identifies or references any individual, brand, or venue.

5.2 We may use these aggregated, de-identified insights to operate, analyse, and improve the Platform and our market offering, and may share or publish them, including with brands, venues, or other third parties, provided that no individual, brand, or venue is identifiable from any insight shared outside PROOF.

6. How we share your information

We do not sell your personal information. We may share it with:

6.1 Other platform users — when a venue places an order, PROOF shares the order and delivery details with the relevant brand to enable fulfilment. A brand’s business name, product information, and region are visible to verified venue accounts.

6.2 Service providers — trusted third parties who help us operate the Platform, including Stripe (payment and payout processing; see stripe.com/privacy), cloud hosting and infrastructure providers, email delivery services, and analytics providers. They are required to protect your information and use it only for the purposes we engage them for.

6.3 Legal requirements — where required by New Zealand law, court order, or lawful request from a regulatory authority, including the Commerce Commission, New Zealand Police, or the Alcohol Regulatory and Licensing Authority.

6.4 Business transfers — if PROOF is acquired, merged, or its assets transferred, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

7. Overseas storage and disclosure

7.1 Some of our service providers — including Stripe, our cloud hosting and database provider, and our email provider — store and process information on servers located outside New Zealand. This means your information may be held or processed overseas.

7.2 Where we disclose personal information to a provider outside New Zealand, we take reasonable steps, consistent with information privacy principle 12 of the Privacy Act 2020, to ensure that the information is subject to protections comparable to those under the Privacy Act, for example through the provider’s contractual commitments and privacy safeguards.

8. Storing, protecting, and reporting on your information

8.1 Your information is stored on secure servers. We take reasonable technical and organisational measures to protect it, including encryption of passwords and sensitive data at rest, secure HTTPS connections, access controls, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8.2 If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the New Zealand Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

9. How long we keep your information, and cookies

9.1 We retain your information for as long as your account is active and for a reasonable period afterwards to meet legal obligations, resolve disputes, and enforce our agreements. Transaction and order records are retained for 7 years to meet financial record-keeping requirements. Application data for declined applicants is retained for 12 months and then deleted.

9.2 PROOF does not set any first-party cookies on prooftrade.co.nz. Sign-in sessions and age verification are maintained through your browser's local storage. Stripe may set its own cookies on payment pages (see stripe.com/privacy), and Google Fonts may collect limited usage data when typefaces are loaded. Our hosting provider records aggregate visitor statistics for site performance monitoring. You can manage local storage and any third-party cookies through your browser settings.

10. Your rights under the Privacy Act 2020

You have the right to:

• request access to the personal information we hold about you;
• request correction of information that is inaccurate, incomplete, or misleading;
• request that we delete your information, where the retention purpose no longer applies and we are not required by law to retain it;
• withdraw consent to marketing communications at any time; and
• complain to the Office of the New Zealand Privacy Commissioner if you believe we have breached the Privacy Act.

To exercise any of these rights, contact us at hello@prooftrade.co.nz. We will respond within 20 working days as required by the Privacy Act 2020. Even if you opt out of marketing, we will continue to send transactional and account-related emails necessary to operate your account.

11. Our Privacy Officer, and complaints

11.1 Our Privacy Officer is responsible for handling privacy queries and complaints and can be contacted at hello@prooftrade.co.nz.

11.2 If you are not satisfied with our response to a privacy complaint, you may contact the Office of the New Zealand Privacy Commissioner at privacy.org.nz.

12. Changes to this policy, and contact

We may update this policy from time to time. When we do, we will update the effective date and notify registered users by email of any material changes. Continued use of the Platform after changes are notified constitutes acceptance of the updated policy.

Proof Trade Limited

hello@prooftrade.co.nz

prooftrade.co.nz

Auckland, New Zealand