Privacy Policy

This Privacy Policy explains how COIN Limited, trading as CASHBOX ("CASHBOX", "we", "us"), collects, uses, stores, discloses and protects your personal information. We handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles.

It applies to everyone who uses the CASHBOX platform, both Buyers who fund escrow payments and Sellers who receive them. By using CASHBOX you agree to the handling of your information as described here.

We only collect personal information we need to run the escrow service, process payments and keep it safe. This includes:

• Account details: your name, email address, and the password hash used to sign you in.
• Business and profile details: your display or business name and contact email, used to identify you on payments.
• Verification information: where required to meet our AML/CFT obligations, identity information (such as government photo ID and proof of address), which we hold securely and restrict to authorised review staff only.
• Payment information: the escrow payments you fund or receive, their amounts, references and status, and movements into and out of our client trust account. Funds move by bank-to-bank transfer initiated through a licensed New Zealand open-banking provider. We store the bank account details a Seller nominates for payouts in encrypted form; we do not collect or store your internet-banking login or card details.
• Technical information: limited log data such as IP address and browser type captured at key events (for example, when you accept the Terms) to keep the platform secure.

We use your personal information to:

• create and operate your account and the escrow service;
• create, fund, hold, release and refund escrow payments, and pay out to Sellers;
• verify identity and meet our Anti-Money Laundering and Countering Financing of Terrorism Act 2009 obligations;
• detect, prevent and investigate fraud, abuse and security incidents;
• provide support, send service notifications, and handle complaints and disputes; and
• comply with our legal obligations.

We do not sell your personal information. We do not use it for unrelated marketing without your consent.

We share personal information only where necessary:

• with the other party to a payment, for example a Buyer and the Seller can see the display name and reference associated with the payment between them;
• with service providers who help us operate (such as our hosting, database, email and open-banking payment providers), under confidentiality obligations;
• with regulators, law enforcement or others where the law requires or permits it, including AML/CFT reporting; and
• if our business is sold or reorganised, with the relevant party, subject to this Policy.

We take reasonable steps to keep your information safe, including encryption in transit, encryption of nominated bank account numbers at rest, access controls that restrict sensitive verification documents to authorised review staff, and signed/secured sessions.

We keep personal information only for as long as we need it for the purposes above or as required by law. AML/CFT records, for example, must be kept for at least five years. When information is no longer needed, we delete or de-identify it.

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to request that we correct it if it is wrong. CASHBOX also gives you self-service tools in your account:

• Download my data: export a machine-readable copy of your account, business profile, payments and notifications at any time.
• Delete my account: permanently remove your account and personal profile data. Some records tied to completed payments or AML/CFT obligations may be retained in a minimised form where the law requires, and cannot be deleted while you have funds in escrow or an open dispute.

You can also contact us at support@cashbox.nz to exercise any of these rights. If you are not satisfied with how we handle your information, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

We may update this Privacy Policy from time to time. The version and effective date are shown at the top. If we make material changes we will take reasonable steps to let you know.

Questions about privacy can be sent to support@cashbox.nz.