Privacy Policy

1. Who this policy covers

ParkUp.nz Limited collects and holds personal information for ParkUp. Our address is our registered office as recorded on the New Zealand Companies Register. This policy applies to visitors, account holders, hosts, travellers, organisers, ride participants, storage users, people who contact support and prospective hosts in our outreach records.

This policy explains our practices under the Privacy Act 2020. It is a notice, not a request to waive your privacy rights and not blanket consent to every possible use.

Sources: Privacy Act principles and Privacy Act 2020.

2. Information we collect

Information you give us

• Account: email address, password in hashed form, authentication dates and account status.
• Profile: names, username, biography, photo, hometown, private location text, public city and region, phone number, roles, interests, skills, pets, vehicle and self-containment details.
• Listings and events: descriptions, photos, prices or exchange preferences, public location fields, private addresses, coordinates, access, arrival and payment instructions, facilities, hazards and cost notes.
• Requests and bookings: dates, status, introductions, group and vehicle details, exchange preferences, long-stay needs and agreed price information.
• Messages and community content: conversations, feed posts, event wall posts and other content you choose to share.
• Support and reports: contact details, complaint or ticket content, target user or content, evidence and resolution notes.
• Notifications: message content, delivery details, preferences, read status and delivery errors.

Information collected automatically

Normal web requests can include your IP address, browser type, device information, requested page, time and referring page. ParkUp stores JWT access and refresh tokens and your email in your browser's localStorage so you can stay signed in. Anyone with access to that browser profile may be able to use the session, so sign out on a shared device.

Information collected from other people or sources

We may receive information about you in a report, booking, event, verification result or support request. Our internal host-outreach records may include publicly available or referred organisation and contact details, source links, outreach history and notes. Where Information Privacy Principle 3A applies, we will take reasonable steps to tell you about indirect collection unless an exception applies.

Sources: Information Privacy Principle 3 and Privacy Commissioner guidance on Principle 3A.

3. Why we collect and use information

We collect and use information where it is reasonably necessary to:

• create and secure accounts;
• publish profiles, listings and community content chosen for public display;
• support request-to-book, messaging, rides, events and future storage flows;
• share private details at the relevant approval point;
• send requested service and notification messages;
• answer support, privacy and safety requests;
• assess reports, moderate content, prevent fraud and enforce the Terms;
• maintain, troubleshoot and improve ParkUp;
• meet legal, tax, regulatory and record-keeping duties.

If information is mandatory, the collection notice should explain why and what happens if you do not provide it. Optional fields remain optional. We do not need every type of information for every user.

4. Public and approval-gated information

Public profiles and listings can show the name, photo, biography, city or region, roles, interests, listing description, photos, public location fields, facilities, exchange preferences and other content marked for public display.

Email addresses, phone numbers, private profile location text, access instructions and private arrival details are not intended for public display. For stays, the host shares the exact address and arrival details after approving a request. Event organisers control address sharing through the event page. Ride participants agree pickup and destination details directly.

Messages are visible to their participants and may be accessed by authorised ParkUp staff where reasonably necessary for support, safety, legal compliance, fraud prevention or moderation. Reports may contain information about another person. We limit access according to role and purpose.

5. Service providers and overseas handling

ParkUp uses or may use providers for:

• hosting, databases, backups and object storage;
• email delivery;
• maps and map assets;
• future payment processing;
• support, monitoring and security.

The website currently makes browser requests to OpenStreetMap tile servers and unpkg for map assets. Those services can receive ordinary request information such as your IP address, browser information, requested tile coordinates and referring information.

Some providers may store or access information outside New Zealand. Before disclosing information overseas, we will use a provider subject to the Privacy Act, require comparable safeguards, use an agent acting only on our instructions, or obtain informed authorisation where the law requires it. We are finalising the production provider list and countries. We will update this policy when those details are confirmed rather than name unconfirmed providers now.

Sources: Information Privacy Principle 12 and Privacy Commissioner overseas disclosure guidance.

6. Identity verification information

Identity verification is available and optional. If you choose it, we collect two images: a photo of your New Zealand driver licence or passport, and a selfie of you holding that document. We collect nothing else for this purpose.

A person at ParkUp reviews the two images and decides whether to mark your profile verified. We do not use a third-party verification service, and we do not use automated face matching, facial recognition or liveness detection. No biometric template of your face is created or stored, so the Biometric Processing Privacy Code 2025 does not currently apply to this feature. If that ever changes, we will complete a privacy impact assessment and publish a new policy version naming the provider, the information and the countries involved before collecting anything under it.

The images are held in a private area of our system, separate from profile photos and listing images. They are never shown on your profile, returned by our public API or shared with other members. Only staff reviewing verification can see them. You can ask us to delete them at any time by emailing hello@parkup.nz, and doing so after a successful check does not remove your verified mark.

Some people carry a verified mark from the earlier ParkUp system and did not send us a document here. The Identity Verification Policy sets out the full process, what the mark does and does not mean, and how to challenge a decision.

Sources: Biometric Processing Privacy Code 2025 and Privacy Commissioner identity-verification example.

7. Retention and account closure

We keep personal information only while it has a lawful purpose. ParkUp is finalising an operational retention schedule for profiles, verification material, locations, messages, reports, bookings, tax records, support records, deleted content, backups and outreach data. Until that work is complete, we will review deletion requests by data class and avoid promising one automatic period for everything. Account closure is the exception, and it is settled.

You can close your account yourself from Settings. We send a confirmation link to your email address, and nothing happens until you click it. Once confirmed, your account is deactivated straight away, your listings, requests and messages stop being visible to other people, and the account is permanently removed after 30 days. That gap is deliberate, so you can change your mind. You can still email hello@parkup.nz if you would rather we did it for you.

After those 30 days the removal is permanent and we cannot restore the account. Some booking, tax, safety, fraud, dispute or legal records may be kept where a lawful purpose remains, and relevant business and tax records may need to be kept for at least seven tax years. Content you posted into a shared space, such as a message another person received, may remain visible to them.

Backups may retain information for a limited cycle before secure deletion. A legal hold, active dispute or safety investigation may delay deletion of relevant material. We will explain a material refusal or delay where the law allows.

Sources: Information Privacy Principle 9, secure deletion guidance and Inland Revenue record-keeping guidance.

8. Security

We use access controls, secure transport, password hashing, provider safeguards and operational controls intended to protect information. No online service can promise absolute security. Tell us promptly if you think your account or personal information has been compromised.

9. Access, correction and questions

You can ask for access to personal information ParkUp holds about you and ask us to correct it. Some profile fields can be updated in settings. For a formal request, account closure or privacy question, email hello@parkup.nz. This is ParkUp's privacy contact.

We may need to confirm your identity before giving access or changing sensitive information. If we do not make a requested correction, you can ask us to attach a statement of correction where the Privacy Act provides for it. You may also complain to the Office of the Privacy Commissioner.

10. Privacy breaches

We assess, contain and document suspected privacy breaches. If a breach has caused or is likely to cause serious harm, we will notify the Privacy Commissioner and affected people as soon as practicable. Our operational target is to assess notification within 72 hours of becoming aware of a potentially notifiable breach.

Source: Privacy Commissioner breach guidance.

11. Changes to this policy

We will publish the new version and effective date. We will give prominent notice of a material change to how information is collected, used or disclosed, and seek a fresh action where a new law or higher-risk feature requires it. We will not use a general update to justify an incompatible retrospective use.