Bunnings New Zealand privacy policy

The Privacy Act 2020 defines Personal Information as information about an identifiable individual.

Personal Information includes the facial images and related biometric templates (Biometric Information) that are collected by Bunnings using facial recognition technology (FRT) in our stores. The collection and use of this Biometric Information is governed by the Biometric Processing Privacy Code 2025.

Any time we use the term Personal Information or Biometric Information in this policy, we are referring to the above definitions of these terms. 

The types of Personal Information that we collect about you depends on which products and services you use, how you transact or interact with us and our relationship with you. These may include:

Identity and Contact Information - This is information we need to confirm your identity such as your name, contact details, date of birth, age and proof of identity documents.

Transaction and Interaction Information - This includes information about how you transact and interact with us such as purchases, orders and your product and service preferences. It also may include membership numbers, membership or subscription identifiers such as for loyalty schemes and team member discount card details, and any survey response or feedback you provide to us.

Financial Information - This includes information like your payment history, credit history, income details, bank and cheque account details, credit card details and gift card details.

On-site Information - This is information we collect when you visit Bunnings’ premises. For example, images from cameras in our stores (including in car parks, pick-up areas and store entrances) and vehicle number plate details. See the “Use of Facial Recognition Technology” section below for details on how we manage your Personal and Biometric Information.

Online Activity - This includes information about how you interact with our websites, apps, ads, social media profiles and electronic communications including what you click on. It may also include software versions, device identifiers (like IP address), device location, dates, times, file metadata, referring website/app, data entered, and user activity such as links clicked, app installations, app launches, adding items to a basket, adding items to a wish list and making purchases. This may be done via the use of cookies, tags and pixels.  If this online activity information is combined with your Personal Information, we will treat it as Personal Information under this Privacy Policy, even if it is not Personal Information on its own. 

Profile Information - This includes information about you including age, gender, occupation, general location and your preferences, interests and opinions.

Employment Information - If you apply for employment with us, this may include details such as employment history and education.

Sometimes you may provide Personal Information about other individuals to us. In those cases, it’s your responsibility to tell them you’re giving us their Personal Information and that we may use and share that information as set out in this Privacy Policy.

We collect your Personal Information in a number of ways.

You provide it to us
You might provide us with your Personal Information in circumstances such as:

• When you visit Bunnings premises, including via security or other cameras.
• When you purchase or order any product or service from us.
• When you contact us directly, such as to make an inquiry or a complaint, to provide feedback, seek a refund, or attend an event.
• If you are a supplier or service provider, in connection with the supply of products and services by your business.
• When you set up an account, including a Bunnings account.
• When you subscribe to any of our mailing lists or participate in any Bunnings competition.
• When you use a loyalty or membership program or a team member discount.
• If you undertake any of our induction, safety or compliance processes.
• If you submit an employment application to us.

We collect it ourselves
We may collect Personal Information ourselves, such as:

• When you use our websites, apps or via social media platforms, or when you visit our stores.
• Gaining insights through reviews, reporting and analysis.
• Through the use of digital technologies like cookies, tags and pixels. These may also come from third-party services (e.g. Facebook) for the purpose of collecting data to enable website or app security, continuity, preference recall, performance measurement, personalised advertising and analytics.

Any Personal Information and Biometric Information collected in our stores using FRT is collected directly from you.

We collect it from other sources

We might collect your Personal Information from other sources such as:

• Third parties, including where you:
  • Hire equipment from our stores when we act as an agent for a third party; or
  • Request a quotation for a service from a third party.
• Publicly available sources, including from New Zealand Government agencies (such as the New Zealand Companies Office), internet searches and social media platforms.
• Any person authorised to act on your behalf or provide your Personal Information to us.
• Credit reporting bodies and other credit providers.
• Payment processors.
• Anyone sharing information with us for loss prevention and/or law enforcement purposes.
• Anyone you nominate in submitting an employment application.
• Our parent company Wesfarmers Limited and its subsidiaries (such as Wesfarmers, Kmart, Target, Priceline, and Officeworks) (Related Companies) and from unrelated third parties. This includes information about your transactions or interactions with our Related Companies, such as when you browse their websites or apps. It also includes information we infer or derive through data analysis. We may also collect de identified data from Related Companies, and share de-identified data with them, for data analysis purposes.

Our websites and apps may contain links to other websites and apps which are operated by other parties. If you access any third-party website or app through our website or apps, that third-party may collect Personal Information about you. We are not responsible for the content of, or the privacy practices used by those third-party websites or apps. We recommend you review their privacy policies before providing your Personal Information.

If you choose not to provide us with your Personal Information when requested, we may not be able to provide all our products and services to you. For example, we will not be able to conduct deliveries without address details.

If you do not want your Personal Information and Biometric Information to be collected by FRT used in our stores, please do not enter our stores.

We collect, store, use and share Personal Information in a number of ways, including to provide and improve our products and services, personalise our services and operate our business more effectively. Some further examples are set out below.

Please see the “Use of Facial Recognition Technology” section below for details on how we collect, use, protect, and allow access to or correction of your Personal and Biometric Information when used for FRT purposes.

Transactions, Accounts and Promotions

We use your Personal Information to handle transactions you make with us, including:

• Processing payments for products and services.
• Providing advice regarding our products and services.
• Delivering our products and services.
• Providing refunds and exchanges.
• Undertaking product recalls.
• Conducting competitions and events.
• Assessing any application that you make to us for a credit account.
• Conducting surveys, reviews and other market research activities and analytics.
• For purposes relating to membership programs and loyalty schemes, and in some circumstances for the businesses of our Related Companies.

Communication

We use your Personal Information to communicate with you, including to inform you about our products and services and to receive, consider and respond to any feedback and complaints you provide.

Improvement of our services and customer experience

We may use your Personal Information to maintain, improve and develop our products and services including to:

• Monitor our sales of products and services and for quality control purposes, such as customer surveys, analysis and feedback.
• Understand your product or service preferences and identify preferred store locations such as your closest store when using our websites or apps.
• Monitor and analyse how our websites or apps are used, including web-based referral channels, data entered and user activity such as links clicked.
• Monitor customer traffic in our stores and identify high traffic or frequently visited areas.

We may use information inferred about you through data analysis to help improve our products and service offerings.

Marketing, Advertising and Personalisation

Subject to applicable laws, we may use Personal Information to understand your preferences, personalise the advertising and content shown to you, and provide direct marketing and personalised communications.

We may also use Personal Information obtained from our Related Companies to help personalise the appearance of our website and apps and the direct marketing electronic communications we send to you.

We do not use any Personal or Biometric Information collected for or via the use of FRT for marketing, advertising or personalisation purposes.

Electronic marketing communications

If you provide your contact information to us, we will give you the opportunity to opt-in to receive direct electronic marketing communications from us. If you opt-in, you can opt out at any time by using the unsubscribe or opt out details included in those communications. If you would like to unsubscribe from all Bunnings communications you can email us at PrivacyNZ@bunnings.co.nz. For targeted online advertising, you can manage your preferences through digital platforms such as Google or Facebook.

Analysis and reporting

We may use Personal Information to understand your preferences and interests and to generate insights including:

• To carry out data processing, analysis and matching, market research or trend analysis (including with information obtained from our Related Companies) to better understand your needs, behaviour and preferences, and to offer products or provide services that may be of greater interest to you, including through direct marketing.
• To personalise your experience, improve the products and services you receive, and to tell you about products and services that may be of interest to you (including with information obtained from our Related Companies).

Safety, Security and fraud detection

We may use your Personal Information to help prevent and detect fraud and protect the health, safety and security of our customers, team members and others including to:

• Verify your identity.
• Assist us, our service providers, Related Companies, and other third parties who we share information with for loss prevention or law enforcement purposes including investigating and preventing any suspected or actual unlawful conduct, fraud or other misconduct.

Legal

We use Personal Information to meet our legal and regulatory requirements and engage in other legal processes, including:

• To manage and resolve disputes.
• To exercise and defend our legal rights.
• To comply with, or otherwise act in accordance with, laws which apply to us.

Corporate/Other Services

We may also use your Personal Information:

• To evaluate, facilitate and manage mergers and sales of our businesses.
• For any purpose disclosed to you at the time Personal Information is collected.
• In the case of Personal Information relating to our suppliers or service providers, to manage the provision of products and services to us.

We may share your Personal Information with third parties who assist us in carrying on our business including:

• To provide products and services to you including repairs and customer recalls (such as through product manufacturers, suppliers, couriers and installers).
• To assist you to hire equipment from us where we act as an agent for that third party.
• Marketing, advertising, promotions and event management.
• Data monitoring, analysis and matching, monitoring trends in customer preferences or transactions and operating and maintaining our websites, online services and apps.
• Displaying advertising or content (including personalised advertising) on or from third-party platforms based on your Personal Information or preferences (e.g., Facebook).
• Investigating and preventing any suspected or actual unlawful conduct, fraud or other misconduct.
• Enforcing our agreements or legal rights.

We may also share your Personal Information with other parties, including:

• Credit reporting agencies and credit providers, to help assess applications for credit accounts or for data analysis purposes.
• Law enforcement agencies, government agencies or other third parties, where required or permitted by law.
• Service providers that support our business operations, including financial institutions, security services providers, hosting and cloud services providers, customer relationship management and marketing technology providers, technical support providers, market research or feedback collection companies, payment processers and collectors, mailing houses and card manufacturers and their service providers.
• Professional advisers such as lawyers, auditors and accountants.
• Other persons disclosed to you at the time the Personal Information is collected.

We take steps to ensure that these parties only use the Personal Information we share with them to do work for us, not for their own purposes, and that they handle it in line with applicable privacy laws.

We handle our team members’ and contractors’ Personal Information in accordance with this Privacy Policy and as otherwise notified to team members and contractors. 

In the case of our team members and contractors, we may use Personal Information for purposes related to their employment or engagement with Bunnings.

If you apply for employment with us, we may collect Personal Information such as your employment history, background checks (eg police and reference checks), educational qualifications and similar information. We may also share your Personal Information with third parties who assist us with recruitment and employment processes.

We use FRT in our stores solely to help protect the health, safety, and security of customers and team members and to reduce organised retail crime and high-value theft, by proactively reducing the incidence of serious harm caused by repeat offenders.

This section explains how we collect, use, disclose and protect Personal Information and Biometric Information collected through the use of FRT in our stores.

All Personal Information and Biometric Information collected through FRT is held in New Zealand by Bunnings - registered address Level 26 PWC Tower, 15 Customs Street West, Auckland, New Zealand.

Further information about our use of FRT, including our assessment of proportionality, is available here: Facial Recognition Technology webpage.

What Personal Information and Biometric Information do we collect using FRT?

We collect facial images of everyone entering our stores.

The FRT system converts those facial images into a digital code called a biometric template. This biometric template is compared against a watchlist containing images of offenders who have previously engaged in serious harm in our stores including violent, threatening, aggressive or intimidating behaviour, use of weapons, physical or verbal assault, racial or sexual harassment, high-value theft or organised retail crime.

If your facial image does not match an image on the watchlist, your facial image and associated biometric template are automatically and permanently deleted from the FRT system within ten seconds.

If the FRT system identifies a potential match with an image on the watchlist, trained and authorised team members are immediately alerted. Any potential match must be independently verified by authorised team members before any action is taken.

If the match is not verified by the authorised team members, no action will be taken.

If we reasonably believe you have engaged in offending behaviour in our stores, we may also collect facial images of you from our instore CCTV systems. These images together with the related biometric templates, your name (if known) and any applicable trespass notice or security system reference ID may be added to our FRT watchlist.

How long is Personal Information and Biometric Information kept in the FRT system?

If your facial image does not match an image on our FRT watchlist, your facial image and associated biometric template are automatically and permanently deleted from the FRT system within 10 seconds.

If the FRT system identifies a potential match with an image on our FRT watchlist, then regardless of whether or not a match is verified by authorised, trained team members, the Personal Information and Biometric Information collected and generated by the FRT system (including the collected image and related biometric template) will be automatically deleted from the FRT system 72 hours after the collected facial image enters the FRT system. Bunnings retains information relating to FRT system alerts (but not the collected image or the biometric template) for record keeping, review and auditing purposes.

Personal Information and Biometric Information relating to offenders included in the FRT watchlist are retained for:

• High-value theft - up to 6 months.
• Violence or harassment - up to 12 months.
• Weapons-related incidents - up to 24 months.
• Organised retail crime (multiple incidents by the same person) - up to 12 months.
• For any other act(s) of offending that does not fit into the points above, a period of time as reasonably determined by authorised, trained team members, which is in any event no more than 24 months.

On expiry of these time periods the Personal Information and Biometric Information of an offender included in the FRT watchlist is automatically and permanently deleted from the FRT system.

Will Personal Information and Biometric Information collected by FRT be shared with anyone else?

Personal Information and Biometric Information collected through the FRT system (excluding biometric templates) will only be shared with:

• Specially trained and authorised team members who have a legitimate need to access the information.
• Our service providers, including other members of the Bunnings group, solely to support the operation of the FRT system. We take steps to ensure that these parties use the information only to perform their functions for us (and not for any other purposes) and handle it on our behalf in accordance with applicable privacy laws.
• Law enforcement agencies, but only where we are required to do so by law.

Biometric templates cannot be seen or taken out of the FRT system.

Can I request removal of my image from the FRT watchlist?

In certain circumstances, we can remove the information of an offender from the FRT watchlist. If you wish to query your enrolment in the FRT watchlist, or if you have any other questions, please email privacyNZ@bunnings.co.nz

How do I access and update my Personal Information and Biometric Information held in the FRT system?

You have the right to access and request correction of your Personal Information and Biometric Information held in the FRT system. To ensure that any information is disclosed only to you we we will need to verify your identity before providing access to or correction of this information. You may make a request to access and/or correct your Personal Information and Biometric Information held about you in the FRT system by emailing privacyNZ@Bunnings.co.nz

Some of the third parties we share your Personal Information with are located outside of New Zealand.  For example, USA, Singapore, EU countries, Australia, Japan, Vietnam, India and United Kingdom. We require these parties to take appropriate measures to protect your information and ensure the sharing is in accordance with applicable law.

Where we collect your Personal Information and Biometric Information using facial recognition technology in our stores, that information is held in New Zealand by us and we will only share that information as set out in the section titled “Use of Facial Recognition Technology” above.

Your Personal Information may be stored by us in various forms including both electronic and hardcopy sometimes with the assistance of data storage service providers. We have a range of security measures in place to protect the Personal Information under our control from misuse, interference, loss, unauthorised access, modification or disclosure. Some of the measures we use include secure premises and facilities, security testing, access controls, encryption and firewalls.

We will only retain your Personal Information for as long as reasonably necessary for the purposes for which it is collected.

Where we collect your Personal Information and Biometric Information using FRT in our stores, that information will be retained as set out in the section titled “Use of Facial Recognition Technology” above.

You can direct any questions or complaints about this Privacy Policy to the Bunnings’ Privacy Officer. See “How to contact Bunnings” below.

We’d like the chance to resolve any complaints you have in the first instance. However, you have the right to contact or make a complaint to the Office of the Privacy Commissioner at any time at: 

www.privacy.org.nz
Phone: 0800 803 909

You can contact us at:
 
Bunnings’ Privacy Officer
Botanicca 3 - Level 2 East Tower, 570 Swan Street,
BURNLEY VIC 3121
Locked Bag 3004, HAWTHORN VIC 3122,
AUSTRALIA
Email: privacyNZ@bunnings.co.nz