Privacy notice

SmartSpotter Australia Pty Ltd ABN 25 602 319 933 

1. About this Privacy Policy

(a)      This Privacy Policy explains how SmartSpotter Australia Pty Ltd ABN 25 602 319 933 (SmartSpotter, we, us, our) collects, holds, uses and discloses personal information in connection with SmartSpotter in New Zealand, and how you can access or correct it or make a complaint. SmartSpotter Australia Pty Ltd is an Australian company. Under section 4 of the Privacy Act 2020, that Act applies to us in respect of personal information we collect or hold in the course of carrying on business in New Zealand, and we comply with it and with its information privacy principles (IPPs).

(b)      This policy applies to:

(i)        Spotters: people who use the SmartSpotter app to accept and complete Tasks (sections 3 to 7);

(ii)       website visitors: people who visit www.smartspotter.com/en-nz or contact us through it (section 8); and

(iii)      client contacts: people who deal with us on behalf of our business clients (section 9).

(c)       Words with capital letters that are not defined here (such as Task, Submission, Client and Software) have the meaning given in our New Zealand Spotter Terms and Conditions. Clause 10 of those terms summarises how we handle Spotters’ personal information, and this policy explains it in more detail.

2. The short version

(a)      We never give Clients your name, contact details, bank details or any other details that identify you. Clients only receive the results of a Task: the photos and answers in a Submission.

(b)      We do not sell your personal information and we do not share it with our related companies. We share Spotters’ personal information only with Amazon Web Services (AWS), which hosts our app and data on servers in the Netherlands; our bank and our payment platform provider, Payment Logic; service providers that help us run the app and website (such as analytics providers); other Spotters, who see only your first name, profile picture and ranking position; and anyone we are required by law to disclose it to.

(c)       Spot results (the photos, answers and other Submissions) belong to SmartSpotter and are never deleted.

(d)      You can ask us at any time for access to, or correction of, your personal information, and you can complain to us and then to the Privacy Commissioner.

SPOTTERS

3. What we collect from Spotters, how and why

Kinds of personal information

(a)      When you register and use the Software, we collect:

(i)        your name and contact details (such as your email address, phone number and postal address or postcode);

(ii)       your profile details: profile picture, gender, date of birth and whether you have a car available;

(iii)      your bank account details, so we can pay you;

(iv)      tax information: your in-app hobby declaration confirming that you undertake Tasks as a private hobby, and your IRD number and GST number if you give them to us;

(v)       details of people you refer to us as new Spotters (such as their name and email address);

(vi)      identifiers of the device you use to access the Software, and technical log data (such as IP address, email address and the times you log in);

(vii)     location data while the Software is in use (for example, when you open the app, look for nearby Tasks or complete a Task); and

(viii)    photos and other Submissions, including their metadata (such as the time, date and location at which a photo was taken), and your Task, approval, ranking and payment history.

How we collect it

(b)      We collect most personal information directly from you, when you register, complete your profile, give your hobby declaration (or IRD or GST number), refer someone, accept and complete Tasks and contact us. Some information (such as device identifiers, location data and photo metadata) is collected automatically by the Software from your device. Location data is collected only while the Software is in use and only if you allow location access in your device settings.

(c)       If you refer someone to us, please make sure they are happy for you to give us their details. We use those details only to invite them to join SmartSpotter and to track the referral. Because we collect their details from you rather than from them, our invitation will tell them, as required by IPP 3A, that we have their details, why, who we are, and how they can access or correct their information. We will not contact them again if they do not join.

(d)      If you do not give us information we need (for example, your bank details or your hobby declaration), we may not be able to offer you Tasks or pay you.

Why we collect it

(e)      We collect, hold and use Spotters’ personal information to:

(i)        create and manage your account and verify that you are 18 or older (using your date of birth) and located in New Zealand;

(ii)       show you Tasks, including Tasks near you and Tasks suited to your profile (for example, Tasks that need a car), and send you Task notifications;

(iii)      review, verify and approve Submissions, including checking that a Task was completed in person at the correct store and detecting fraud or manipulation;

(iv)      pay you, keep payment and tax records and meet our tax obligations;

(v)       deliver Task results (photos and answers only) to Clients;

(vi)      show the Spotter ranking and run our referral program;

(vii)     send you marketing emails, if you have agreed to receive them (section 10);

(viii)    respond to your questions, review requests and complaints;

(ix)      keep the Software secure, maintain it and improve it; and

(x)       comply with the law.

(f)       We will not use your personal information for any other purpose unless you consent or the Privacy Act 2020 otherwise allows it.

4. Who we share Spotters’ personal information with

(a)      Clients. Clients receive only the results of a Task: the photos and answers in your Submission. They never receive your name, contact details, bank details or any other details that identify you. Before results are given to a Client, we may blur, crop or delete images of people (see section 6).

(b)      We share Spotters’ personal information only with:

(i)        Amazon Web Services (AWS), which hosts the Software and our data on servers located in the Netherlands;

(ii)       our bank and our payment platform provider, Payment Logic, to process payments to you;

(iii)      service providers that help us run the app and website (such as analytics providers);

(iv)      other Spotters, who can see only your first name, profile picture and ranking position in the Spotter ranking; and

(v)       any person or authority to whom we are required by law to disclose it (for example, Inland Revenue, or a court or law enforcement agency under a warrant or court order).

(c)       We do not sell or rent personal information, and we do not share Spotters’ personal information with our related companies, or with Clients or anyone else for their own marketing.

5. Overseas disclosure and storage

(a)      Our Software and data are hosted by AWS on servers located in the Netherlands. This means Spotters’ personal information is stored outside New Zealand.

(b)      AWS stores and processes the information only on our behalf and not for its own purposes. Under section 11 of the Privacy Act 2020, this means the information is treated as held by us, not disclosed to AWS, and we remain responsible for it. We protect it by using AWS’s contractual data-processing terms, which restrict AWS to storing and processing the data on our instructions and require it to keep the data secure, by encrypting the data, and by controlling who in our business can access it. AWS is also subject to the European Union’s General Data Protection Regulation.

(c)       As SmartSpotter is an Australian company, your personal information may also be accessed by our staff in Australia.

(d)      Where we disclose personal information to a service provider outside New Zealand, we do so only as permitted by IPP 12, for example where the recipient is subject to privacy laws that, overall, provide comparable safeguards to the Privacy Act 2020, or where we have agreed contractual protections with the recipient.

(f)       Google Analytics, which we use on our website (section 8), may process information about website visitors in the United States.

6. People who appear in photos

(a)      Spotters photograph shelves, products, displays, prices and signage, not people. Our Spotter Terms and Conditions require Spotters not to deliberately photograph anyone, to retake a photo where reasonably possible if a person can be identified, and not to make audio recordings of any person unless a Task expressly instructs it and all consents required by law have been obtained.

(b)      If a person can still be identified in a photo, we may blur, crop or delete the image before the results are given to a Client.

(c)       If you think you appear in a photo taken for SmartSpotter, contact us (section 20) and we will look into it and, where appropriate, blur or delete the image.

7. Automated decisions

(a)      We do not use computer programs to make decisions about approving or rejecting Submissions, or about suspending or closing Spotter accounts. These decisions are made by our staff, who review each Submission and any account issue.

(b)      If this changes, we will update this policy to explain the kinds of personal information used and the kinds of decisions involved before we start.

(c)       If you disagree with a decision about a Submission, you can ask for it to be reviewed under clause 6(f) of the New Zealand Spotter Terms and Conditions. For anything else, contact us (section 20).

OTHER PEOPLE WE DEAL WITH

8. Website visitors

(a)      Contact and enquiry forms. If you contact us through our website, by email or by phone, we collect your name, email address, phone number, company (if any) and the content of your message, and use them to respond to you.

(b)      Cookies and analytics. Our website uses cookies and similar technologies, including Google Analytics (through Google Tag Manager). These collect information such as your IP address, cookie identifier, device and browser type, pages visited and the referring website, so that we can understand how the website is used and improve it. Google may process this information outside New Zealand, including in the United States. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google’s browser add-on.

(c)       Social media links. Our website links to our LinkedIn, Instagram and Facebook pages. If you follow those links, the relevant platform’s privacy policy applies.

9. Client contacts

(a)      If you deal with us on behalf of a Client or prospective Client, we collect your name, position, business email address, business phone number, and invoicing and payment details of your organisation, and your log-in details for the SmartSpotter client dashboard.

(b)      We use this information to provide our services, manage the client relationship, give you access to the dashboard, invoice and keep business records, and (if you have agreed) send you marketing emails about our services (section 10). We share it only with AWS, service providers that help us run the app and website, and anyone we are required by law to disclose it to. We keep it for the term of the client relationship and afterwards for as long as we need it for legal, tax or record-keeping purposes.

GENERAL

10. Direct marketing

(a)      We send marketing emails (such as news about SmartSpotter and new opportunities for Spotters) only to people who have consented to receive them, as required by the Unsolicited Electronic Messages Act 2007.

(b)      Every marketing email identifies SmartSpotter as the sender, includes our contact details and includes a functional unsubscribe facility. You can also opt out at any time by contacting us (section 20). We will act on an unsubscribe request within 5 working days, and we do not charge for it.

(c)       We do not use or disclose Spotters’ personal information for other organisations’ marketing.

(d)      Task notifications, payment notifications and other messages about your account are not marketing, and you will continue to receive them while you have an account. You can turn off push notifications in your device settings.

11. Anonymity

(a)      You can browse our website, and make general enquiries, without telling us who you are or by using a pseudonym.

(b)      Spotters cannot use the Software anonymously or under a pseudonym, because we need to verify your identity and age, check your Submissions and pay you into your bank account.

12. Unsolicited personal information

If we receive personal information that we did not ask for and do not need (for example, information sent to us by mistake), we will securely delete or de-identify it as soon as practicable, where lawful and reasonable to do so.

13. Children

The Software is only for people aged 18 or older, and we do not knowingly collect personal information from anyone under 18. If we learn that a Spotter is under 18, we will close the account and delete their personal information, except for records we must keep by law.

14. How we hold and protect personal information

(a)      We hold personal information electronically in the Software and in our systems hosted by AWS. As required by IPP 5, we take reasonable security safeguards to protect it against loss, unauthorised access, use, modification or disclosure, and other misuse. These include encryption of data in transit and at rest, access controls so that only staff who need the information can see it, secure log-in, and monitoring of our systems.

(b)      You can help protect your account by keeping your password private and your phone locked.

(c)       As required by IPP 9, we do not keep personal information for longer than we need it for lawful purposes. When we no longer need it and are not required by law to keep it, we take reasonable steps to destroy or de-identify it.

15. How long we keep personal information

(a)      Account and profile information: we keep this while your account is open. You can delete your account yourself in the app. When your account is deleted, we delete your personal account data, except the records described in paragraphs (b) and (e).

(b)      Payment and tax records (including, where applicable, your hobby declaration and any IRD or GST number): we keep these for 7 years, as required by the Tax Administration Act 1994.

(c)       Location data used for fraud checks: always.

(d)      Server logs (IP address and email address): always.

(e)      Spot results (photos, answers and other Submissions): these belong to SmartSpotter and are never deleted. We keep them indefinitely as business records and as deliverables to our Clients. Where reasonably practicable, we de-identify Submissions from your account when it is deleted. Submissions given to Clients never identify you.

(f)       Referral details: for as long as needed to send the invitation and track the referral.

(g)      Enquiries and complaints: for as long as needed to deal with them and keep a record of how they were handled.

16. Privacy breaches

We comply with the notifiable privacy breach rules in Part 6 of the Privacy Act 2020. If a privacy breach has caused, or is likely to cause, serious harm to anyone whose personal information is involved, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, and tell them what steps they can take.

17. Access and correction

(a)      Under IPP 6 and IPP 7, you can ask us for access to the personal information we hold about you, or ask us to correct it, by contacting us (section 20). Spotters can also view and update most of their account details directly in the Software.

(b)      We will need to verify your identity before acting on a request. We will respond as soon as reasonably practicable and no later than 20 working days after we receive your request. We do not charge for making a request or for correcting information, and we will only charge a reasonable fee for giving access where the Privacy Act 2020 allows it.

(c)       If we refuse access or correction (where the Privacy Act 2020 allows it), we will tell you why and that you can complain to the Privacy Commissioner. If we do not correct information as you asked, you can give us a statement of the correction you sought, and we will attach it to the information so that it is read with it.

18. Complaints

(a)      If you have a concern or complaint about how we have handled your personal information, please contact us first (section 20) with the details. We will acknowledge your complaint within [5 working days — confirm] and give you a written response within 20 working days.

(b)      If you are not satisfied with our response, you can complain to the Privacy Commissioner: www.privacy.org.nz, phone 0800 803 909, or PO Box 10094, Wellington 6143.

19. Changes to this Privacy Policy

We may update this policy from time to time. The current version will always be on our website and in the Software. If we make a significant change that affects Spotters, we will also tell Spotters by email or in the Software before it takes effect.

20. Contact us

Privacy Officer

SmartSpotter Australia Pty Ltd

64 Talevera Road, Macquarie Park NSW 2113, Australia

Email: info‑au@smartspotter.com.au