Privacy Policy

Version 2026-09-09

This policy explains how DiecastBids collects, uses, discloses and protects personal information, and how you can access, correct or complain about it. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

[not yet configured] (ABN [not yet configured]), trading as DiecastBids, of [not yet configured], is responsible for the personal information described here. Our Privacy Officer can be reached at [not yet configured].

2. Dealing with us anonymously

You can browse the catalogue and completed sales without an account or giving us your name. To bid, sell or buy you need an account, because we cannot run an auction, take a payment or deliver a parcel to someone we cannot identify. You choose your own username, and other collectors see only that handle — never your legal name, email address or address.

3. What we collect, and why

We collect only what we reasonably need to run the marketplace. We do not collect sensitive information as the Privacy Act defines it — no health, biometric, racial, political, religious or sexual-orientation information — and we do not ask for government identifiers such as a tax file number or driver licence number.

Account information

Your username, email address, and either a password (stored only as a cryptographic hash, so we never hold the password itself) or, if you sign in with Google, the account identifier Google returns. We also derive a collector score and status tier from your activity. We need this to create and secure your account and to let collectors see who they are trading with.

Bidding and listing information

Every bid you place — amount and time — the auctions you create, the items in your watchlist and garage, the sellers you follow, and the photographs and descriptions you upload. Bidding is public within an auction: your username and bid amount are visible to other participants. Please do not include personal information in listing photographs or descriptions.

Order and delivery information

The delivery address you enter at checkout, together with shipping cost, tracking reference and the timestamps that drive dispatch and delivery. We disclose your full address to the seller only while they need it to send the parcel and deal with returns; from 30 days after delivery it is reduced to a partial address that no longer identifies your street.

Payment information

Card details are entered directly with Stripe and never reach our servers. We store the references Stripe gives us — a customer reference, a payment-method reference, and for sellers a connected-account reference and payout status — together with amounts and fees. Sellers complete identity verification with Stripe directly; we see the outcome, not the underlying documents.

Dispute information

Your description of the problem and any photographs you submit as evidence, together with the outcome and the notes made while it was assessed.

Technical and security information

Your IP address, browser details, session and anti-forgery tokens, and records of security events such as failed sign-ins and rate-limit triggers. We use IP address for three specific purposes: enforcing rate limits, running the anti-bot check on sign-in, registration and bidding, and detecting coordinated bidding between accounts. We do not use it to build a marketing profile of you.

Information from others

If you sign in with Google, Google gives us your email address and an account identifier. Stripe tells us the result of a payment and, for sellers, whether verification succeeded. We do not buy personal information from data brokers or list providers.

4. How we use it

We use personal information for the purposes it was collected for: operating your account, running auctions, taking payment, arranging delivery, resolving disputes, keeping the marketplace secure, meeting our tax and record-keeping obligations, and answering you when you contact us. We will use or disclose it for another purpose only where you would reasonably expect it and the purpose is related to the original one, where you consent, or where the Privacy Act otherwise permits or requires it.

Marketing

We send transactional messages you cannot opt out of while you hold an account — outbid alerts, order and payment notices, disputes, and changes to these policies — because they are the service itself. We will only send you marketing about the marketplace where you have consented or would reasonably expect it, every marketing message identifies us and carries a working unsubscribe, and we act on an unsubscribe promptly. We do not sell or rent your contact details to anyone.

5. Automated decisions

Some decisions on this site are made or substantially assisted by a computer program. Where that could significantly affect you, this is what it does:

To contest an automated outcome, email [not yet configured] with the order or account it concerns.

6. Who we disclose it to

We do not sell your personal information, and we do not disclose it for anyone else’s marketing. We disclose it to the other party to a trade — as described in section 3 — and to the following service providers. Your account, listing, bid and order data is stored in Australia; the other providers below are located overseas:

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, principally through our contracts with them. We remain accountable to you for how they handle it: under the Privacy Act, an act by one of these providers that would breach the APPs is treated as a breach by us.

We will also disclose personal information where we are required or authorised by law to — for example to a court, the police, or a regulator such as the ACCC, the OAIC or the ATO.

7. How long we keep it

We destroy or de-identify personal information once we no longer need it for any purpose permitted by the Privacy Act and no law requires us to keep it.

• Account information — while your account is open, then destroyed or de-identified within 30 days of closure, except where a longer period applies below.
• Transaction records — orders, payments, fees and invoices are kept for at least five years, as required for tax and record-keeping purposes, even after an account closes.
• Full delivery addresses — visible to the seller until 30 days after delivery, then reduced.
• Dispute evidence — two years after the dispute closes, so a reopened or escalated matter can still be assessed.
• Security logs — up to 12 months.
• Sessions — deleted when you sign out or the session expires.

8. Keeping it secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Traffic is encrypted in transit, passwords are stored only as hashes, session cookies are HttpOnly so page scripts cannot read them, state-changing requests carry an anti-forgery token, and access to production data is limited to people who need it.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

9. Accessing and correcting your information

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of it you can see and change yourself from your account.

For anything else, email [not yet configured] from the address on your account. We do not charge for making a request, we respond within 30 days, and if we refuse access or a correction we will tell you why in writing and how to complain.

Occasionally we cannot act on part of a request — for example, deleting a completed transaction record would breach a legal retention obligation, and correcting the bid history of a closed auction would falsify the record other bidders relied on. Where that happens we will say so, and we can attach a statement noting that you consider the information inaccurate.

10. Complaints

If you think we have mishandled your personal information, tell us first at [not yet configured]. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5218, Sydney NSW 2001.

11. Children

This marketplace is for binding transactions and is not intended for children. You must be at least 18 to hold an account. If we become aware that we hold personal information about a child, we will delete it.

12. If you are outside Australia

This policy applies to everyone who uses the site. If you are in a place with additional privacy rights, we will honour them where they apply to us; contact us at the address above.

13. Cookies

Cookies and similar technologies are covered separately in our Cookie Policy, including how to change your choices.

14. Changes to this policy

We will post any change here and update the version at the top. Where a change materially affects your rights we will notify registered users before it takes effect.

Version 2026-09-09. We will post any change on this page and update the version date. Where a change materially affects your rights, we will tell registered users before it takes effect.