Privacy policy

Who we are

Farmstall is run by Baywide Group Limited (GST 124-273-188), Te Puke, New Zealand. If you have a question about this policy, email privacy@baywidechickens.co.nz.

This policy covers farmstall.co.nz, the seller pages and order forms it serves (including forms embedded on sellers' own websites), and the texts and emails sent through it.

Your data is yours

If you sell through Farmstall, your farm's information is yours: your customers, orders, counts and flock records. You can download all of it, any time, from Settings.

We only use combined, anonymous numbers from across farms, for example lay rates to improve our egg forecasts. Nothing in them can be traced back to your farm or your customers.

We never sell your data, and we never market to your customers.

Two kinds of people use Farmstall

Sellers are the egg producers who set up an account. Buyers are their customers, who order and pay through a seller's page.

Under the Privacy Act 2020, each seller is the agency responsible for their buyers' information. We process that information on the seller's behalf and on their instructions. If you are a buyer and want to see, correct or delete what a seller holds about you, ask the seller first; we will help them do it.

What we collect about sellers

• Your name, farm name, email, mobile number, address and region
• GST number and bank account number (the account your buyers pay into — shown to them on the pay page)
• What you sell, your prices, delivery areas and pickup days
• The names and emails of team members you add
• If you set up card payments: the identity details Stripe asks for (name, date of birth, bank account), which go to Stripe for its checks, and your Stripe connected account id
• If you connect them: your Google account email, your Xero organisation id

We also keep the usual technical records: when you logged in, from what sort of device, and what you did in your account, so we can support you and keep the service safe.

What we collect about buyers

• Name, mobile number and, for deliveries, address
• What was ordered, when, for how much, and how it was paid
• Texts sent to and received from the buyer through the system

Buyers do not create accounts and do not give us passwords. Card details go straight to Stripe and never touch our servers. We arrange card payments through Stripe on the seller's behalf, so the buyer's card statement shows the seller's name; we see the amount, the last four digits and the card brand, and we see dispute details if a buyer disputes a payment.

Bank transactions through Akahu

To work out who has paid, a seller can connect their bank account through Akahu, an accredited NZ open-banking provider. The seller gives that consent at their own bank; we never see bank logins.

With that consent we read the transactions on the connected account once a day. We use them for one thing: matching payments to orders and invoices.

Retention: we keep full transaction lines for 90 days. After that we keep only the reference, the amount and which order it matched. Everything else from the line is deleted.

A seller can disconnect the bank at any time from Settings or at Akahu. Disconnecting stops the daily read immediately.

Pay-by-bank payments made by buyers also go through Akahu. The buyer approves the payment at their own bank; we receive a confirmation and the reference, not the buyer's bank details.

What we use information for

• Running the service: showing orders, sending the texts and emails a seller's settings ask for, matching payments, building statements
• Billing sellers our per-egg fee
• Support
• Keeping the service secure and finding faults
• If a seller is a Baywide Chickens customer, confirming that so the discount applies

We do not sell personal information. We do not use buyers' details to market anything to them. We do not send marketing to sellers' customers.

Who we share it with

• Akahu (bank connection and pay-by-bank)
• Stripe (card payments, which we arrange through Stripe Connect for each seller, identity checks for sellers who set up cards, disputes, and our monthly billing)
• httpSMS, which sends texts from the seller's own phone
• Google (sign-in and, if the seller turns it on, contacts and calendar)
• Xero (if the seller connects it)
• Our hosting providers (below)

Each of these sees only what it needs to do its job. We share information with anyone else only if the law requires it.

Google sign-in and Google data

Sellers and their team sign in with Google. We receive your name, email address and profile picture, and use them only to sign you in and show who did what in your farm's account.

If a seller turns on contacts or calendar, we read and write only the contacts and calendar events the feature needs (for example, adding a new buyer to your contacts, or a pickup to your calendar), and only in your own Google account.

We don't use Google data for advertising, we don't sell it, and we don't let people read it except to fix a problem you've asked us to look at, for security, or where the law requires. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time from Settings, or from your Google Account's security page.

Where it is stored

Our database and files are hosted in the Australia region (Sydney). Some providers above process data elsewhere under their own policies. By using Farmstall you agree to your information, and your buyers' information, being held in Australia. We consider these providers offer protections comparable to the Privacy Act.

How long we keep it

• Orders, invoices and payments: for as long as the seller's account is open, then 7 years as tax records require
• Bank transaction lines: 90 days, then reference, amount and match only
• Texts and emails: 12 months
• A closed seller account: deleted within 60 days, except what tax law makes us keep

A seller can export their customer list and order history at any time.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct it. Sellers can do most of this from their own account. Email privacy@baywidechickens.co.nz for anything else and we will answer within 20 working days.

If you are not happy with how we have handled your information you can complain to the Office of the Privacy Commissioner, privacy.org.nz.

Security

Connections are encrypted. Access to the database is limited to the people who run the service. Bank and card credentials are never stored by us. If we discover a privacy breach that is likely to cause serious harm we will tell the affected sellers and the Privacy Commissioner as the Act requires.

Changes

If this policy changes in a way that matters we will email sellers before it takes effect. The date at the top is the current version.