Privacy policy

Last updated: 25 October 2026

This policy explains how PlateYard collects, uses, shares and protects personal information when you use plateyard.co.nz. We follow the Privacy Act 2020 and its information privacy principles (IPPs). We have written it in plain English. If anything is unclear, email us at hello@plateyard.co.nz.

1. Who we are

PlateYard runs an online marketplace where people in New Zealand can list, find and enquire about personalised number plates.

• Operator: PlateYard
• Postal address: PO Box 30126, Lower Hutt 5040, New Zealand
• Email: hello@plateyard.co.nz

In this policy, "PlateYard", "we", "us" and "our" mean PlateYard. "You" means anyone who visits or uses the site, whether or not they have an account.

2. Our Privacy Officer

PlateYard has a Privacy Officer. They handle privacy questions, requests to access or correct your information, and complaints. They also make sure we follow the Privacy Act. You can contact them at privacy@plateyard.co.nz or by post at the address above.

3. What we collect

We only collect what we need to run the marketplace (IPP 1).

Information you give us

• Account details: your email address, display name and password. We never store your password itself. We store only a secure one-way hash of it.
• Age confirmation: when you sign up, we record the date and time you confirmed that you are 18 or over.
• Listings: the plate combination, asking price, description, whether plates have been made or the sale is entitlement only, and any other details you add.
• Seller declaration: when you list a plate, we record the date and time you confirmed that you hold the entitlement to it or are authorised by the holder to sell it.
• Selling in trade: whether you mark a listing as selling in trade. Listings marked this way show a "Trader" badge.
• Wanted posts: the plates or styles you are looking for and any details you add.
• Messages and offers: private messages between you and other users, and offers together with their status (pending, accepted or declined).
• Contact details you choose to share: if you turn on contact sharing in a conversation, we keep the details you enter and a record of when each of you agreed to share and when either of you stopped (see section 6).
• Sold prices: these are recorded only if you choose to share them.
• Reports, disputes and blocks: reports you make about listings, messages or users, any dispute about who holds a plate, and the users you block.
• Correspondence: anything you send to hello@plateyard.co.nz or privacy@plateyard.co.nz, including privacy requests and complaints.
• Paid features (when available): if you buy an optional paid feature such as a Featured listing, we keep a record of what you bought, when and for how much. Card payments will be handled by a payment provider. We will not see or store your full card number.

Information collected automatically

• Cookies and browser storage: see section 7.
• Listing activity: view and save counts for listings. We use a hashed visitor value only to avoid counting the same visitor twice (see section 7).
• Page analytics: our hosting platform's built-in analytics records each page view: the page, the page you came from, your browser type and language, and a country worked out from your device's time zone. It does not record your IP address.
• Security and abuse controls: we limit how many messages, listings, wanted posts, sign-ups and password reset requests can be sent in a set time. To do this we use hashed values taken from your visitor cookie and from your browser's type and language settings (see section 9).

What we don't collect

We do not ask for your date of birth, home address, driver licence, bank account or card details for plate sales. We do not collect your precise location. We do not run advertising trackers or sell advertising based on your activity.

4. Information we get from other people (indirect collection)

Sometimes we receive information about you from someone else. For example:

• another user reports your listing, message or account;
• someone tells us they hold a plate you have listed, or disputes your right to sell it;
• another user mentions you in a message or a report;
• a government agency or the Police contacts us about a listing.

When this happens, we use the information only for the purposes in section 5. Usually that means checking a report, settling a dispute or keeping the site safe. If we collect information about you this way, we will take reasonable steps to tell you about it as soon as reasonably practicable, as required by IPP 3A. This policy is part of how we tell you. We may contact you directly too. We may not tell you if an exception in the Privacy Act applies. For example, telling you might put someone's safety at risk or get in the way of an investigation.

If you give us information about another person, such as in a report, only give what is needed and make sure you are allowed to share it.

5. Why we use your information

We use personal information to:

1. create and run your account and let you sign in;
2. publish your listings and wanted posts, and show your display name to other users;
3. deliver messages and offers between buyers and sellers, and share contact details only when both of you agree;
4. keep a record of seller declarations and look into disputes about who holds a plate;
5. send account emails, such as password reset codes and important notices about your account or these policies;
6. prevent and investigate spam, scams, fraud, misuse and breaches of our Terms of Use, including through rate limits, moderation and blocks;
7. produce price estimates and market statistics from listing data. Estimates use plate and price data and do not identify the people involved;
8. understand how the site is used so we can improve it, using page analytics that do not identify you;
9. handle paid features if we offer them;
10. respond to your questions, requests and complaints; and
11. meet our legal obligations.

We will not use your information for any other purpose unless you agree or the Privacy Act allows it. We do not sell personal information. We will only send you marketing emails if you have agreed to them. Every marketing email will have an unsubscribe link, as required by the Unsolicited Electronic Messages Act 2007.

6. What other users can see

• Public: your display name, your listings and wanted posts (including a "Trader" badge on any listing you mark as selling in trade), and any sold prices you choose to share. Search engines may index public listings. Copies can stay in their caches for a while after you remove a listing.
• Never shown to other users: your email address, your password, and the times you confirmed your age or made seller declarations.
• Automatic contact filtering: we automatically remove phone numbers, email addresses and links from listings, wanted posts, display names and private messages. This stops contact details from being shared by accident.
• Contact sharing is your choice, and both people must agree. In a conversation, you can choose to share contact details with that one person. Each of you only sees the other's details once you both agree. They are shown only to the two of you, only for arranging that plate sale, and only until either of you withdraws. If either of you withdraws, or one of you blocks the other, the details are hidden from then on and we delete the text that was shared. We keep only the dates of the agreement and the withdrawal. While sharing is on, messages between you are not filtered. Once it ends, contact details in those messages are hidden again.
• Blocks are private. We do not tell the person you block. Our moderators can see how many people have blocked an account, which helps them spot misuse.
• Wanted posts come off the public board after 90 days unless you renew them.

7. Cookies and similar technologies

We use a small number of first-party cookies and browser storage. None of them is used for advertising or to track you across other websites.

View and save counts: we store a hashed visitor value with the listing you viewed or saved. If you are signed in, we use your account instead. We delete these values after about 24 hours. We do not use your IP address for view counting.

You can block or delete cookies in your browser settings. If you block the session cookie, you will not be able to sign in. If you block the visitor cookie, view counts and some security checks will work less precisely.

8. Who we share information with

We share personal information only as described here.

• Other users: as described in section 6.
• Our hosting and platform provider (Floot): our website, database, files and backend run on the Floot platform. Floot uses Amazon Web Services and Neon infrastructure in the United States. Floot stores and processes the information for us and is not allowed to use it for its own purposes. Floot does not use it to train AI models.
• Our email delivery provider: account emails, such as password reset codes, are sent through the email service built into our hosting platform. The provider receives your email address and the message content so it can deliver them.
• Analytics provider: page analytics are processed by our hosting platform's analytics provider. This information does not include your IP address.
• Payment provider (when paid features launch): if you buy a paid feature, your payment will be processed by a payment provider under its own privacy policy.
• Software and support tools: we use other software tools to build, maintain and support the site. These tools may process limited information when that is needed to fix a problem.
• Professional advisers: we may share information with lawyers, accountants or insurers where needed, and they must keep it confidential.
• Authorities and other parties where the law allows: these include the Police, NZ Transport Agency Waka Kotahi, the Commerce Commission, the courts or a person with a court order. We share information when we are required to, or when the Privacy Act allows it, for example to prevent a serious threat to someone's safety or to help with a criminal investigation.
• A new owner of the site: if PlateYard or its assets are sold or restructured, personal information may pass to the new owner. That owner must handle it in line with this policy. We will tell you before this happens.

We are not part of NZ Transport Agency Waka Kotahi, KiwiPlates or LicenSys, and we do not share your information with them unless the law requires it. When you transfer a plate, you deal with them directly under their own privacy policies.

9. Information stored or processed outside New Zealand

Our main service providers store and process data outside New Zealand. The main locations are the United States (our hosting, database and email delivery). Public pages and files may also be served from content delivery network locations around the world.

When a provider stores or processes information only for us, the Privacy Act treats us as still holding it (section 11 of the Act). We remain responsible for protecting it. We choose providers that encrypt data in transit and at rest and that limit what they can do with our data.

If we ever disclose personal information to an overseas organisation for its own use, we will do so only where IPP 12 allows. That includes where we reasonably believe it is subject to privacy safeguards comparable to New Zealand's, or where you have agreed after we have told you it may not be protected in the same way.

10. How we protect your information

We take reasonable steps to protect personal information from loss, misuse and unauthorised access, use, change or disclosure (IPP 5). These steps include:

• encrypting the connection to the site (HTTPS) and the data we store;
• storing passwords only as secure hashes;
• storing short-lived hashes rather than raw identifiers for view counts and rate limits;
• filtering contact details from public and private content;
• limiting staff access to what each person needs; and
• applying rate limits and moderation tools to reduce spam and scams.

Our hosting provider's firewall slows down or blocks anyone sending too many requests. For requests it flags or blocks, it may briefly keep a record that includes the IP address.

No website can be completely secure. Please use a strong password that you don't use anywhere else. Tell us straight away if you think your account has been misused.

Privacy breaches: if a privacy breach has caused or is likely to cause serious harm, we will tell the people affected and the Office of the Privacy Commissioner as soon as practicable, as required by the Privacy Act.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy or as the law requires (IPP 9).

12. Your rights: access, correction and deletion

You have the right to:

• Access: ask whether we hold personal information about you and get a copy of it (IPP 6);
• Correction: ask us to correct information that is wrong. If we don't agree to correct it, you can ask us to attach a statement of the correction you wanted (IPP 7);
• Deletion: ask us to close your account and delete your information. We will do this unless we need to keep some of it for a reason in section 11.

You can change your display name, listings and wanted posts yourself on the site. For anything else, email the Privacy Officer at privacy@plateyard.co.nz. We may ask you to confirm your identity before we act. We will reply as soon as we can, and no later than 20 working days after we receive your request, as the Privacy Act requires. Making a request is free.

13. Concerns and complaints

If you are worried about how we have handled your personal information, contact our Privacy Officer first at privacy@plateyard.co.nz. Tell us what happened and what you would like us to do. We will acknowledge your complaint and try to sort it out quickly and fairly.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:

• Website: privacy.org.nz (choose "Make a complaint")
• Phone: 0800 803 909

14. Children

PlateYard is for adults. You must be 18 or over to create an account. If we learn that someone under 18 has opened an account, we will close it and delete their information.

15. Links to other websites

Our site links to other websites, such as NZ Transport Agency Waka Kotahi, LicenSys and KiwiPlates. Their own privacy policies apply when you use those sites. We are not responsible for how they handle your information.

16. Changes to this policy

We may update this policy, for example when we add new features. The date at the top shows when we last changed it. If a change significantly affects how we use your information, we will tell signed-in users on the site or by email before the change takes effect.