Privacy policy

Scope and information we collect

This policy applies to personal information collected through Red Pages, including information from visitors, providers, advertisers, people who contact us, and people who submit reports or complaints.

• We may collect information you submit directly, such as email address, account details, listing or agency profile content, support messages, and complaint reports.
• For agency accounts, we may also collect related business information such as legal business name, NZBN or other registration details, business contact details, and other details reasonably needed to assess or manage an agency account.
• We may collect technical and usage information, such as IP address, browser type, device data, requested pages, timestamps, and referring URLs.
• We may use cookies or session data for age-gate state, login state, security, fraud prevention, and site functionality.

Where provider verification is required, Red Pages collects age and identity verification information either through a specialist third-party verification provider or through a manual Red Pages verification process.

Provider verification

Red Pages requires independent providers to complete an age and identity verification process before a listing can be made public. Providers may complete either an automated verification flow carried out for Red Pages by Didit, or a manual verification process arranged directly with Red Pages.

In the automated flow, Didit collects and processes identity document details, document images, selfie or liveness checks, facial matching data, and related verification information in order to assess whether the provider is 18 or older and eligible to publish on the platform, and to resolve verification cases that require review before a decision can be made.

Red Pages configures the automated flow so that Red Pages receives only limited verification result data reasonably needed to operate the platform, such as verification status, age or 18+ outcome, Didit's reference ID, the verification timestamp, and related workflow or result metadata.

Full automated verification records remain with Didit. Red Pages does not routinely access those full records for automatically approved verifications. However, where an automated verification is flagged for review or cannot be completed automatically, authorised Red Pages personnel may access the verification record in Didit to decide whether the provider can be onboarded. Red Pages may also access or request verification records where reasonably necessary to investigate complaints or concerns that a provider may have been under 18, to determine whether false or another person's identity documents were used in that context, to comply with legal obligations, or to respond to lawful requests from law enforcement or other authorities.

Didit's verification privacy notice is available here: didit.me/terms/verification-privacy-notice/.

In the alternative manual flow, Red Pages arranges a video call so the provider's identity can be checked live without uploading identity documents or photos. As part of that process, Red Pages may collect and retain a limited manual verification record such as the verification method, the verification reference, the verification date and time, the verifier, the document type, issuing country, document number, year of birth, the outcome, and related audit notes. Red Pages does not keep a copy of the identity document or face image after the manual process.

Public and private information

Some information submitted to Red Pages is intended to be public, such as listing text, listing photos, public contact methods, approximate location details, pricing information, agency profile details, and other content chosen for publication. Information published in public listings or agency profiles may be copied, shared, or retained by others outside Red Pages' control.

Other information is not intended to be public, such as account access credentials, provider identity verification data, complaint correspondence, internal moderation records, private support communications, and non-public agency account or business details.

How we use and share information

Red Pages may use personal information to provide and operate the site, create and manage accounts, listings, and agency profiles, moderate content, investigate complaints, communicate with users, improve site security and performance, and comply with legal obligations.

Red Pages may use agency-related business information to assess agency enquiries, create and manage agency accounts, verify authority to publish listings or manage agency profiles, communicate with agency contacts, and meet moderation, safety, and compliance needs.

Red Pages may share personal information with service providers who help us operate the site, with professional advisers, and with law enforcement, regulators, courts, or other authorities where required or reasonably necessary to address unlawful activity, exploitation, fraud, or safety concerns. This may include sharing provider account and verification-related information with Didit for age and identity verification, under-18 prevention, and related compliance purposes.

Red Pages does not sell personal information.

Retention

Red Pages keeps information only for as long as reasonably necessary for the purposes for which it was collected, including operating the service, dealing with disputes, enforcing policies, preventing abuse, and meeting legal obligations.

Red Pages may retain some information for longer where reasonably necessary for complaints, fraud prevention, safety investigations, legal claims, or compliance obligations.

Red Pages keeps only limited verification metadata in its own systems, such as verification method, verification reference, status, verification timestamp, related workflow metadata, and the identity of any authorised Red Pages admin who completed a manual approval.

Full identity verification records used for the automated Red Pages verification process are held by Didit and are retained there for up to 7 years where reasonably necessary for verification onboarding and review, under-18 complaint investigation, legal compliance, or lawful requests.

For manual verification, Red Pages may retain a limited manual verification record for up to 7 years where reasonably necessary for verification onboarding, under-18 complaint investigation, legal compliance, or lawful requests.

Security

Red Pages uses reasonable administrative, technical, and organisational measures to protect personal information. No system is completely secure, and Red Pages cannot guarantee absolute security.

Access, correction, and complaints

You may request access to personal information Red Pages holds about you, request correction of inaccurate information, or contact Red Pages with privacy complaints or concerns.

Deletion and restrictions

Where applicable, you may request deletion of personal information that is no longer required. Red Pages may decline or delay deletion where retention is necessary for legal, safety, fraud-prevention, or dispute-resolution reasons.

Cross-border service providers

Red Pages may use service providers or infrastructure located outside New Zealand. Where that occurs, information may be processed in other countries under the safeguards and arrangements Red Pages puts in place with those providers.

This includes Didit for automated provider verification. Providers should review Didit's own verification privacy notice for more detail about how Didit handles verification information and cross-border processing.

Cookies and similar technologies

Red Pages may use cookies or similar technologies for age-gate state, login state, security, fraud prevention, and site functionality.

Red Pages does not use third-party advertising pixels or third-party tracking tools for analytics.

Changes to this policy

Red Pages may update this Privacy policy from time to time. The updated version will take effect when published on the site unless a later date is stated.