Last updated 2 October 2026

Privacy policy

This policy is published by Bidsmarts Limited ("we", "us") for the BIDSMARTS software and for this website. The application name shown where a YouTube channel is connected is bidsmarts.

BIDSMARTS is supplied to the main agency (the "Agency"), which may have multiple offices (each an "Office"). Personal information means information about an identifiable individual.

Questions and requests concerning this policy may be sent to [email protected].

1. Definitions

In this policy:

• Staff means a person authorised by the Agency to use BIDSMARTS.
• Registered Online Bidder means a person who registers through BIDSMARTS to bid in an auction conducted by an Office.
• Phone Viewer means a person to whom an Office issues a code for the sole purpose of watching one auction.
• Connected Service means a system, other than YouTube, that the Agency or an Office connects to BIDSMARTS, including a system that holds the Agency's listings.
• Auction Record means the record of an auction conducted through an Office, including the property, the bids, the acceptance of registrations, and the contact particulars of the Registered Online Bidders and Phone Viewers for that auction.

2. Persons to whom this policy applies

This policy applies to a visitor to this website, the Agency, Staff, a Registered Online Bidder, a person registered in the room, a Phone Viewer, and an Agency or Office that connects a YouTube channel or a Connected Service.

Information is held for the Agency. It is made available to Staff whom the Agency has authorised for the relevant Office, and to such other Staff as the Agency authorises across its Offices. We do not disclose it to any other agency.

3. This website

This website describes BIDSMARTS. A request for access is made by email to the address above. Where a person sends that email, we hold the message for the purpose of answering it.

This website does not use advertising cookies or analytics cookies.

4. Staff

When the Agency authorises a member of Staff, we hold the name, the email address, and the sign-in credential for that account. We hold a telephone number, and an auctioneer licence number, only where the Agency or that person supplies it. A sign-in session ends after 7 days. Where a person enables a second sign-in check, we hold the means of performing that check with the account.

5. Registered Online Bidders and persons in the room

A Registered Online Bidder provides an account email address and name, and for an auction provides a full name, a telephone number, an address, and, if the person so chooses, a company name and company number. The person accepts the terms that apply to that registration. We record whether the registration has been accepted, and the member of Staff and the time of that acceptance.

A Registered Online Bidder may place a bid only where the registration has been accepted for that auction. We do not collect a date of birth. We do not collect a government identity document, or a copy of such a document.

Each bid forms part of the Auction Record. With the bid we hold the amount, the time, the internet protocol address, and the browser and related technical particulars of the device used to place the bid. Those particulars are held for the Auction Record and for the purpose of detecting misuse.

The contact particulars of a Registered Online Bidder are available to the Agency and to the Office conducting that auction. They are not sold. They are not disclosed to any other agency.

Before an auction registration, a person may submit an expression of interest to an Office, comprising name, email address, telephone number, and address, together with the time at which any applicable terms were accepted. Acceptance of that interest does not of itself register the person for an auction.

A person registered in the room is recorded by name, telephone number, email address, and paddle number. Those particulars may be entered by Staff, or by the person through a registration link issued by the Office. We do not collect an identity document for that registration.

6. Forms required by the Agency

Where the Agency requires its own form to be completed before a Registered Online Bidder may bid, the bidder completes that form in BIDSMARTS. The form is the Agency's form. The fields are the fields the Agency has placed on it. Completion may include a typed name, a signature, the internet protocol address, the browser particulars, and the time of completion.

We send the completed form to the persons the Agency nominates. We delete the completed file and the signature image within 7 days after that email is delivered, or, where the email is not delivered, within 7 days after a member of Staff confirms that the file has been downloaded. We do not delete the file while delivery has failed and no such confirmation has been given. The fact that the form was completed remains part of the Auction Record.

We do not undertake customer due diligence on behalf of the Agency. The Agency remains responsible for any enquiry or document it requires of a bidder.

7. Phone Viewers

The Office records the Phone Viewer's name and email address and issues a code for one auction. The Phone Viewer submits that email address and that code. On admission, the Phone Viewer may watch that auction and its bid history. A Phone Viewer cannot place a bid.

We hold the code issued by the Office for the purpose of admitting the Phone Viewer. The code ceases to operate when the Office revokes it, or when the auction is no longer scheduled, live, or paused. Where an incorrect code is submitted eight times, the code is locked for 15 minutes. The browser session used after admission is set to expire after 7 days. We record the internet protocol address used for the admission as part of the security record of the auction.

The name and email address remain part of the Auction Record. We do not delete them when the auction ends.

8. YouTube

Google user data. When an Agency connects a YouTube channel, the Google user data we access is the credential Google issues for that channel, the Google account identifier, the channel identifier, the channel title, the channel thumbnail, and the broadcast particulars we create, namely the title, the description, the schedule, and whether the broadcast is live. We use the credential and those broadcast particulars to create, schedule, start, and end live broadcasts of the Agency's own auctions. We show the channel title and thumbnail to Staff so the Agency can see which channel is connected. Our personnel do not read the credential except for security, to remedy a fault the Agency has asked us to examine, or where the law requires it.

We do not use Google user data for advertising. We do not sell it. We do not use it to decide credit or lending, and we do not use it to train a general artificial intelligence or machine-learning model.

We share it with Google as required to run those broadcasts, with the Agency and its authorised Staff, and with a service provider engaged to host the software or to transmit email, solely for that purpose and under a duty to protect it. We may disclose it to a court, a law-enforcement authority, or another public authority where the law permits that disclosure. A YouTube credential does not pass to a buyer of the business.

Security procedures are in place to protect the confidentiality of that information in transit and while we hold it. The credential is encrypted while we hold it.

We keep the credential only while the channel remains connected. When the Agency disconnects the channel, or asks us to delete the credential, we delete it. The channel title and thumbnail are removed within 30 days after access ends. That deletion does not remove an Auction Record. A person may ask for access to, or correction of, personal information we hold about them by writing to [email protected].

The Agency may connect a YouTube channel so that an Office can broadcast its auctions to that channel. Connection is optional. An Agency that does not connect a channel is not affected by this section.

When the Agency connects a channel, Google requires the Agency to sign in and to approve access. We then receive a credential for that channel. The access requested is the permission Google describes as authority to see, edit, and permanently delete YouTube videos, ratings, comments, and captions. We request that permission because creating and running a live broadcast requires write access to the channel.

We access and store the credential Google issues for that channel, and the broadcast particulars we create for the Agency's auctions, namely the title, the description, the schedule, and whether the broadcast is live. We use that information solely to create, schedule, start, and end live broadcasts for the Agency's own auctions.

We do not read viewers, subscribers, comments, or messages.

We do not read, edit, or delete videos, ratings, comments, or captions except as required to create and run the auction broadcasts the Agency starts in BIDSMARTS.

We do not post to the channel except those auction broadcasts.

We do not sell this information, disclose it to another agency, or use it for advertising. Our personnel do not read the credential except for security, to remedy a fault the Agency has asked us to examine, or where the law requires it.

We keep the credential only while the channel remains connected. When the Agency disconnects the channel in BIDSMARTS, or asks us to delete the credential, we delete it. The channel title and thumbnail we have stored are removed within 30 days after access ends. YouTube information we store is otherwise deleted or refreshed in accordance with YouTube's rules. The public address of a broadcast that has been run remains with the Auction Record.

The Agency may disconnect the channel in BIDSMARTS at any time. Separately, the Agency may withdraw access at the Google security settings page. Deletion of information held by us does not delete the corresponding broadcast or other data held by YouTube. To delete data held by YouTube, the Agency must use YouTube or a service that YouTube authorises for that purpose.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See also the Google Privacy Policy and the YouTube Terms of Service.

9. Connected Services

Where the Agency or an Office connects a Connected Service, we receive the particulars that service supplies for the purpose of booking and conducting the Agency's auctions. Where that service holds listings, those particulars may include the property address and, where the listing contains them, the listing agent's name, telephone number, email address, and photograph. We receive those particulars from the Connected Service. We do not collect them from the listing agent.

Where Staff enter a vendor's name or email address on a property, we hold those particulars with the property.

We hold the credential for a Connected Service only while that service remains connected. When the Agency or the Office disconnects it, we delete that credential and we cease further collection from that service. Listings and Auction Records already held remain with the Agency. They are not deleted by reason only of the disconnection. A listing imported from a Connected Service that the Agency has not used for an auction may be omitted from the Agency's default list of properties. The terms of the Connected Service govern that service.

10. Publication on the Agency's website

The Agency may publish, on a website it controls, the auctions of an Office. That publication shows the property and auction information the Agency has chosen to make public. It does not create an account for a visitor.

11. Disclosure

We disclose personal information to these persons only:

• the Agency, and Staff authorised as set out above, for the Office to which the information relates;
• the persons the Agency nominates to receive a completed form;
• Google, where a YouTube channel is connected, and only as section 8 describes;
• a service provider engaged to host the software, or to transmit email, solely for that purpose and under a duty to protect the information;
• a court, a law-enforcement authority, or another public authority, where disclosure is permitted by law.

We do not sell personal information. We do not disclose it to advertisers. We do not disclose it to any other agency.

BidSmarts uses Cloudflare Turnstile to check that sign-in and registration requests come from people. It runs in the background and is covered by Cloudflare's Turnstile Privacy Addendum.

If the business of Bidsmarts Limited is sold or transferred, the Auction Records and other records described in this policy may pass to the successor. A YouTube credential does not pass with that sale. An Agency that wishes to continue broadcasting connects its channel again.

12. Retention

We retain each Auction Record, including bids and the contact particulars of persons who registered or to whom a watch code was issued, as the Agency's record of that auction. We do not destroy those records upon the conclusion of the auction.

A YouTube credential is retained only while the channel remains connected, and is then deleted as section 8 provides. A Connected Service credential is retained only while that service remains connected, and is then deleted as section 9 provides. Listings already received remain with the Agency.

A completed form file and its signature image are deleted on the period stated in section 6. The record of completion is retained with the Auction Record.

A sign-in session is retained for 7 days. A record created solely to diagnose a fault is retained for up to 90 days.

13. Holding and protection

We protect personal information with safeguards appropriate to its sensitivity, both in transit and while we hold it. We require any service provider to whom we give information, for the purpose of operating BIDSMARTS, to protect it.

Where information is held outside New Zealand, we take steps to ensure that the holding remains subject to protections appropriate to the sensitivity of the information and to the purpose for which it is held.

14. Access, correction, and complaints

A person may request access to personal information we hold about that person, and may request correction of it, by writing to [email protected]. We may need to consult the Agency where the information forms part of an Auction Record.

A person who considers that their privacy has been interfered with may write to us at that address, or may contact the Office of the Privacy Commissioner, telephone 0800 803 909, privacy.org.nz.

15. Changes

We may amend this policy. The date at the head of the page is the date the amended version takes effect. Where a change affects the manner in which we use information received from Google, we will not apply that change to a connected channel until the Agency has been notified and has agreed to the amended policy.