Privacy Policy

CoinShed Ltd is a company incorporated in New Zealand and is the data controller for personal information collected through the CoinShed platform. We are subject to the Privacy Act 2020 (NZ) and any applicable regulations made under it. Our registered address is in Auckland, New Zealand. Contact us at admin.coinshed@gmail.com for any privacy-related enquiries.

We collect personal information for the following purposes: (a) to create and manage your account; (b) to enable you to list, browse, and transact on the platform; (c) to verify your identity when you choose to do so; (d) to communicate with you about your account, listings, and messages; (e) to detect, investigate, and prevent fraud, illegal activity, and policy violations; (f) to comply with legal obligations under New Zealand law, including the AML/CFT Act 2009 and the Privacy Act 2020; and (g) to improve the platform through anonymised analytics. We rely on contractual necessity, legal obligation, and legitimate interests as our legal bases for processing.

Your data is used only to operate CoinShed. We do not use your personal information to build advertising profiles, sell to data brokers, or share with marketing partners. We do not display advertising on CoinShed and have no advertising network integrations. Your email address may be used to send transactional messages (e.g. listing approved, new message received, password reset). You can manage notification preferences in your account settings.

We do not sell your personal information to any third party. We share data only in the following limited circumstances: (a) with other users, to the extent necessary to facilitate a transaction (e.g. your public profile and listing details are visible to other users); (b) with service providers who assist us in operating the platform, including cloud hosting, email delivery, and analytics services, who are bound by confidentiality obligations; (c) with law enforcement, regulatory authorities, or courts where we are required to disclose information by law, including under the AML/CFT Act 2009, a court order, or a production order; and (d) with a successor entity in the event of a sale or merger of the business, subject to equivalent privacy protections. Any international transfer of data will be subject to appropriate safeguards.

We retain your account information for as long as your account is active. After account deletion, we retain certain data for up to 7 years where required by law (e.g. for AML/CFT compliance and tax purposes). Identity verification documents are deleted promptly after the verification process is complete. Message content is retained for 2 years after the associated listing expires, to support dispute resolution. Analytics data is anonymised and retained for up to 24 months. You may request deletion of your personal information at any time — we will delete what we can and explain what we must retain and why.

Under the Privacy Act 2020 (NZ) you have the right to: (a) access the personal information we hold about you; (b) request correction of inaccurate information; (c) request deletion of your data (subject to legal retention requirements); (d) withdraw consent where processing is based on consent; and (e) complain to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act. To exercise any of these rights, contact us at admin.coinshed@gmail.com. We will respond within 20 working days as required by the Act.

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, disclosure, or loss. These include encryption of data in transit (TLS), hashed password storage, access controls, and regular security reviews. We will notify you and the Office of the Privacy Commissioner of any notifiable privacy breach as required by the Privacy Act 2020. No system is perfectly secure — you should use a strong, unique password and enable two-factor authentication where available.

CoinShed is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a person under 18, we will delete it promptly. If you believe we have inadvertently collected information from a minor, please contact us immediately at admin.coinshed@gmail.com.

We may update this Privacy Policy from time to time. Where changes are material, we will notify registered users by email or via a platform notice at least 14 days before the changes take effect. The "last updated" date at the top of this page indicates when the policy was most recently revised. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

For any questions, requests, or complaints about this Privacy Policy or our handling of your personal information, contact us at admin.coinshed@gmail.com. Complaints that are not resolved to your satisfaction may be referred to the Office of the New Zealand Privacy Commissioner at www.privacy.org.nz or by calling 0800 803 909.