Privacy Policies For Home Services Platforms In NZ

Yes, if your home services platform collects personal information in New Zealand, you should have a privacy policy before you start taking bookings.

That sounds simple, but home services platforms often collect more sensitive information than a standard ecommerce site. You may handle home addresses, photos of rooms or damage, lockbox codes, alarm instructions, pet notes, contractor profiles and customer messages.

A good privacy policy helps your customers and workers understand what happens to that information. It also helps your team make consistent decisions about collection, access, storage and deletion under the Privacy Act 2020.

Do Home Services Platforms Need A Privacy Policy?

Yes, most home services platforms in NZ need a privacy policy because they collect personal information from customers, contractors or workers.

The Privacy Act 2020 applies to agencies that collect, use, store or disclose personal information. There isn't a minimum turnover threshold for the Privacy Act to apply. If your platform operates in New Zealand, or carries on business here, you need to think about your Privacy Act obligations.

For a home services marketplace or booking platform, personal information can include:

• Customer names, phone numbers, email addresses, payment details and payment processing information
• Home addresses and access instructions
• Photos or videos of a property, job site, damage or completed work
• Job notes, cleaning preferences, pet details and safety warnings
• Messages between customers and service providers
• Contractor names, profile photos, NZBNs, licence details, availability and ratings
• Identity checks, police vetting details or insurance information, if you collect them

Your privacy policy should be easy to find before someone signs up or makes a booking. It should also match how your platform actually works. If your policy says you don't share customer phone numbers with contractors, but your booking flow sends those numbers automatically, that's a problem.

Your privacy promises can also matter under the Fair Trading Act 1986. If you make a misleading statement about how you use or protect customer data, it can create consumer law risk as well as privacy risk.

What Customer And Property Data Should Your Policy Cover?

Your policy should cover every category of customer and property data you collect, especially information that gives someone access to a home.

Home services platforms are different from many other online businesses because the service happens inside or around someone's property. That means your data map should go beyond names and email addresses.

Think carefully about information like:

• Property access details: lockbox codes, smart lock instructions, alarm codes, gate codes and building entry instructions.
• Location data: the customer's home address, suburb, booking location and any map pin or geolocation data.
• Photos and videos: before-and-after photos, room photos, damage evidence, maintenance images or contractor completion photos.
• Household details: notes about children, elderly residents, pets, parking, hazards, allergies or accessibility needs.
• Job notes: cleaning priorities, repair details, customer preferences, complaints and follow-up tasks.
• Customer communications: chat messages, SMS notifications, call logs and emails sent through your platform.

Some of this information may not look sensitive at first glance, but it can become very sensitive when linked to a home address. For example, a note saying key under mat, dog is friendly, customer away until Friday creates a real security risk if the wrong person sees it.

A practical privacy policy doesn't need to be full of legal language. It needs to explain, clearly, what you collect, why you need it and who may see it. Your internal processes then need to back that up.

How Does The Privacy Act 2020 Apply To Your Platform?

The Privacy Act 2020 applies by setting rules for how you collect, use, disclose, store and give access to personal information.

The Act has 13 Information Privacy Principles. You don't need to list all 13 in your customer-facing policy, but your privacy practices should reflect them.

For a home services platform, the most practical rules are:

• Collect only what you need: don't collect access codes, photos or identity documents unless you have a clear business reason.
• Be open about collection: tell customers and workers what you're collecting, why, who will see it and whether it's optional.
• Use information for the purpose you collected it for: if you collect a customer's address to complete a booking, don't use it for unrelated marketing without a proper basis.
• Keep information secure: use sensible controls like limited access, strong passwords, multi-factor authentication, audit logs and an information security policy for admin users.
• Allow access and correction: if someone asks to access or correct their personal information, you generally need to respond within 20 working days.
• Manage overseas disclosures: if information goes to overseas software providers or support teams, you need to consider Information Privacy Principle 12.

You also need to have at least one privacy officer. This doesn't have to be a full-time role. It can be someone in your business who understands your platform, keeps privacy processes moving and deals with privacy requests.

If you send marketing emails or texts, remember the Unsolicited Electronic Messages Act 2007 may also apply. Commercial electronic messages generally need consent, clear sender details and a working unsubscribe function. Unsubscribe requests must be actioned within 5 working days.

What Should A Home Services Platform Privacy Policy Include?

Your privacy policy should explain the full data journey, from sign-up and booking through to job completion, support, marketing and deletion.

Templates can be a useful starting point, but they often miss platform-specific issues. A marketplace that shares access notes with contractors needs a different policy from a simple brochure website. Your document works best when it's tailored to your booking flow, software stack and contractor model.

Privacy Policy Outline

Here is a practical fill-in outline you can use when planning your policy. A lawyer should tailor it before you put it on your platform.

1. Who You Are: name your company, trading name, NZBN if relevant and how people can contact you.
2. What You Collect: list customer, property, booking, payment, worker, contractor, device and communication data.
3. How You Collect It: explain sign-up forms, booking forms, app uploads, messages, cookies, support calls and third-party tools.
4. Why You Collect It: connect each category to a purpose, such as matching jobs, sending reminders, verifying contractors or handling complaints.
5. Who You Share It With: cover contractors, customers, payment providers, software vendors, insurers, background check providers and regulators where required.
6. Property Access Information: explain how access codes, keys, alarm instructions and safety notes are handled and when they're removed.
7. Photos And Job Notes: explain when images can be uploaded, who can view them and whether they may be used for training, quality control or marketing.
8. Overseas Storage Or Support: identify whether your tools or support teams may process data outside New Zealand.
9. Marketing And Analytics: explain emails, SMS, retargeting, cookies and how users can opt out.
10. Access, Correction And Complaints: set out how people can contact your privacy officer and how you'll respond.
11. Retention And Deletion: set out your data retention rules, including how long you keep different data types and when you delete or de-identify them.
12. Policy Updates: explain how you'll notify users about material changes.

Your policy should be consistent with your customer terms, contractor agreements and internal privacy procedures. If those documents say different things, your team may struggle to know which rule to follow.

How Should You Handle Photos, Access Details And Messages?

You should handle photos, access details and messages with stricter controls than ordinary account information because they can affect personal safety, property security and trust in your platform.

Start with data minimisation. Ask yourself whether you really need each field in your booking form. If a customer can book a lawn mowing job without giving internal house access details, don't ask for them by default.

Then build clear rules for higher-risk data.

Access Codes And Entry Instructions

Limit who can view lockbox codes, alarm instructions and key locations. Ideally, only the assigned service provider and a small number of support staff should have access.

You might set your system so an access code is visible only from 2 hours before the booking until 2 hours after the booking. For cancelled jobs, you might hide it immediately. If you need to keep a record for quality or safety reasons, consider masking the code rather than storing it in plain text.

Photos And Videos

Be clear about what photos are allowed. For example, contractors may upload photos of a repaired pipe, cleaned oven or damaged wall, but they shouldn't photograph private documents, children, medical items or unrelated rooms.

If you want to use before-and-after photos for marketing, get separate permission. A general booking consent usually won't be enough for using someone's home images in ads or social media.

Platform Messages

If you monitor or store customer-contractor messages, say so in your privacy policy. You may need message records for safety, support, quality control or payment issues, but your users shouldn't be surprised that your platform can access them.

For example, Ava runs a Wellington home maintenance platform with 40 contractors. Her platform used to keep all lockbox codes forever in job notes. After reviewing her privacy processes, she changes the system so access notes are hidden 24 hours after job completion and deleted after 30 days unless a support ticket is open. She also limits admin access to 3 operations staff. That simple change reduces risk without slowing down bookings.

What If You Use Contractors, Apps Or Overseas Providers?

You still have privacy obligations if contractors, apps or overseas providers help you deliver the service.

Many home services platforms rely on a mix of independent contractors, customer support tools, payment processors, SMS tools, booking software and cloud hosting. Your customers won't always care which provider caused a privacy issue. They will usually come back to your platform first.

Make sure your contractor agreements and supplier contracts support your privacy policy. They should cover:

• what personal information the contractor or supplier can access
• what they can and can't use it for
• security requirements, including device security and password protection
• rules for storing or copying customer details outside the platform
• what to do if information is lost, accessed by the wrong person or sent to the wrong customer
• returning or deleting information when a contractor stops using the platform

If you engage workers as independent contractors, remember that privacy documents don't decide employment status. Your engagement model, control, payment structure and working arrangements matter. From 2026, changes to the Employment Relations Act 2000 include a contractor gateway test, which can be relevant when you structure contractor relationships. Get tailored advice if your platform depends heavily on contractor labour.

Overseas software also needs attention. Information Privacy Principle 12 deals with disclosures of personal information outside New Zealand. If your booking app, CRM, SMS provider or analytics tool stores or accesses data overseas, check whether the recipient has comparable privacy protections or whether another permitted route applies.

You should also have a privacy breach response process. A privacy breach is notifiable to the Privacy Commissioner and affected people if it has caused, or is likely to cause, serious harm. Notification should happen as soon as practicable after you become aware of the breach.

For example, if a contractor accidentally receives 25 customers' addresses and access notes for jobs they weren't assigned to, you should act quickly. Restrict access, ask for deletion, preserve records, assess the risk of harm and decide whether notification is required. A written process helps your team move calmly when time matters.

Key Takeaways

• A home services platform in NZ should have a privacy policy before collecting customer, worker, contractor or property access information.
• Home services data can be sensitive, especially addresses, lockbox codes, alarm instructions, photos, job notes and customer messages.
• The Privacy Act 2020 requires clear collection practices, secure storage, access and correction processes, and careful handling of overseas disclosures.
• Your privacy policy should match your customer terms, contractor agreements, supplier contracts and actual platform workflows.
• You should have internal rules for high-risk data, including who can see it, how long it's kept and what happens after a job is completed.
• If something goes wrong, keep records, contain the issue quickly and assess whether you need to notify the Privacy Commissioner and affected people.

If you'd like help with your privacy policy, contractor data practices, platform terms and privacy breach processes, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.