Privacy Policy

Who this notice is from, and what it covers

Wool Online Limited ("Wool Online", "we", "us") is based in Blenheim, New Zealand, and operates the Wool Online wool trading platform. This notice covers the Wool Online application served at app.woolonline.co.nz and the pages published with it, including this one.

Information we hold about you

Wool Online accounts are set up by us, not by self-registration, so most of what we hold about you started with the account details you or your organisation gave us. In the application, the information falls into these categories:

• Account identity. Your username, your buyer or account code, your name, the organisation you trade for, and the access type your account has (for example buyer, merchant or administrator). These are held in the Wool Online trading database.
• Contact details. The email address held on your account, which is where a password reset is sent, and anything else you tell us when you contact us for support.
• Trading activity. The bids you place, the standing auto-bid maximum prices you set, the tender offers you make, and the resulting purchases — all recorded against your account, because that is what a bid is: an offer identified as coming from you.
• Your own working notes. The lots you star to watch, and the private notes you type against a lot. These are stored against your account and shown back to you in the application; they are not shown to other buyers.
• Technical records. The application and the web proxy in front of it keep request logs — which page or endpoint was requested, the response, how long it took, and the network details a web server ordinarily records, such as your IP address and browser user agent — plus error records when something fails.
• Mailing list details, if you subscribe. The Wool Online market-update email list collects your first name, surname, email address and town or region.

Signing in, cookies and sessions

When you sign in, the application sets a single cookie on your browser. It holds a signed token that identifies your account — your username, account code, name, organisation and access type — and it is what keeps you signed in as you move between pages.

• The cookie cannot be read by scripts running in the page, and it is only sent back to Wool Online.
• It expires at the end of the session lifetime configured for the deployment (12 hours by default), and logging out clears it immediately.
• It is a strictly functional sign-in cookie. The application sets no advertising, analytics or cross-site tracking cookies.
• Switching between the new application and the legacy Wool Online application uses a single-use handover ticket so you don't have to type your password again. The ticket identifies your account for that one exchange.

How we use your information

• To confirm who you are when you sign in, and to keep you signed in.
• To run sales: to record your bids, auto-bid maxima and tender offers, and to show you your own position in a sale.
• To show you your watchlist and your notes on lots.
• To complete a purchase, which means passing your bid and your identity as the buyer to the Seller of that wool.
• To answer your questions and reset your password when you ask us to.
• To keep the platform running: to see that it is up, to find out why something failed, and to investigate misuse of an account.
• To send market-update emails, if you have subscribed to them.

Who sees it, and who we share it with

• Wool Online staff. Our own people can see account details and trading activity in order to run sales and support you.
• The Seller (wool broker) whose lots you bid on. A bid is an offer to that Seller, who has to accept it and who invoices you afterwards, so your identity as the bidding buyer and the price you offered are visible to them. Our Terms & Conditions describe that relationship.
• New Relic. We send technical performance measurements from the running application to New Relic (a monitoring service, on its United States data centre) so we can tell whether the platform is healthy. What is sent is aggregate measurement — request timings, memory and connection health, counts of successful and rejected bids — not your bid prices, your notes or your identity.
• NZ Wool Testing Authority. Grab-sample photographs of a lot are fetched by our server and passed on to your browser, so opening a lot photograph does not identify you to NZWTA.
• Public content delivery networks. Some front-end files (the htmx library and the site's typefaces) are loaded by your browser directly from public CDNs, which therefore see your IP address and browser details as part of serving those files. They receive no account or trading information.

Password resets and support

If you use the "Forgot your password?" link, all you give us is your username. The Wool Online trading system sends the reset to the email address already held on that account — you cannot supply a new address on that form. The page shows the same message whether or not an account exists, so it can't be used to find out who has an account.

How we protect it

• Traffic to and from the application is served over HTTPS.
• Your sign-in cookie is a signed token, is not readable by page scripts, and expires.
• This application never stores your password: sign-in is checked by the Wool Online trading system, and the application only holds the resulting session token.
• What can be submitted is validated and limited on the server, not just in the browser, and actions such as bidding are refused for account types that are not allowed to perform them.

How long we keep it

Records of completed sales are business records and are kept as part of the trading history of the platform.

Seeing, correcting and asking about your information

You can ask us what we hold about you and ask us to correct anything that is wrong. Some details — your name, organisation and account code — are part of your trading account, so a correction goes through us rather than being edited in the application.

To ask about anything in this notice, email admin@woolonline.co.nz. If you subscribe to market-update emails, you can unsubscribe at any time.

Changes to this notice

When this notice changes, the updated version will be published on this page. The date at the top of the page always tells you which version you are reading.