Gumtree
Effective: 12 October 2026
Previous Privacy Policy can be found here. For existing users of the site, this Privacy Policy remains in effect until 12 November 2026. During this time the previous version continues to apply.
-
About This Policy
Gumtree AU Pty Ltd (ABN 33 616 996 840) and its wholly owned subsidiary Carsguide Autotrader Media Solutions Pty Ltd (ABN 37 150 757 574) ('Gumtree', 'we', 'us', 'our') collect your personal information for the primary purpose of providing you with our classifieds marketplace services, known as Gumtree, Carsguide and Autotrader, and our related mobile applications (Services).
Gumtree AU Pty Ltd also provides advertising, lead and reporting services to car dealers and other businesses under its business names, which include Autotrader Group. Whatever name those services are provided under, Gumtree AU Pty Ltd is the entity responsible for any personal information about you that those services involve.
We may also use your information for secondary purposes including personalising your experience, improving our platform, commercialising your listing data to third parties, sharing your listing across all of our marketplace services, and promoting Gumtree and third-party products and services where permitted.
This Privacy Policy explains how we collect, use, disclose, sub-license and manage your personal information.
This Privacy Policy explains how we handle personal information in accordance with:
• the Privacy Act 1988 (Cth) ('Privacy Act');
• the 13 Australian Privacy Principles ('APPs'); and
• the Privacy and Other Legislation Amendment Act 2024 (Cth).
By agreeing to this policy when creating an account to use our Services, or by otherwise using our Services without creating an account, you agree to the collection, use, disclosure and retention of your personal information as described in this Policy.
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and in any form.
We may update this Policy from time to time to reflect changes in our practices or in applicable law. Where a change is material, we will notify you via email or a prominent notice on our website. Continued use of our Services after that date constitutes acceptance of the updated Policy. Where we propose to use your personal information for a purpose that is materially different from the purpose for which it was collected, we will seek your consent in advance.
-
What Personal Information We Collect
The personal information we collect depends on how you interact with us and the Services you use. This may include:
Account and identity information:
• name, email address, phone number, username and password;
• postal address and location data, including when you use our shipping feature “Gumtree Shipping”;
• date of birth and gender (where voluntarily provided);
academic or employment history if you choose to submit your resume to advertisers on our site for consideration or applying for employment with us;
• identity verification documents (where required for specific services), including through our third party provider, Adyen; and
• profile photograph, if voluntarily provided.
Transaction and listings information:
• advertisement content including item descriptions, pricing, images and videos;
• payment and financial information (such as credit card or bank account details) where you pay for features or are required to pay feed to us;
• enquiry and messaging records between buyers and sellers. We may also record our calls with you (if we have your consent to do so);
• saved searches, alerts and favourites.
• details you provide when making an enquiry about a related product or service, such as vehicle finance, insurance, or a Fast Car Offer (for example, your contact details, suburb or postcode, and any additional information you choose to include, such as whether you have a vehicle to trade in).
Technical and usage information:
• IP address, browser type and operating system;
• device identifiers (including advertising identifiers on mobile devices);
• pages viewed, links clicked, referral URLs and session duration;
• location information (where you permit this);
• cookie identifiers and web beacon data.
Information from third parties:
• where you register or sign in via a social network (such as Google or Facebook), limited account information from that network;
• publicly available information and data from credit reporting bodies where permitted by law;
• information shared with us by our related companies (such as Carsguide Autotrader Media Solutions Pty Ltd) for the purposes described in this Policy.
Sensitive information: We do not ordinarily collect sensitive information (such as health, racial or ethnic origin, or political opinions) as defined in the Privacy Act. If we need to do so for a specific purpose, we will obtain your express consent unless otherwise required or authorised by law.
Recruitment and applicant information: If you use our Jobs services, we and the relevant Employer may collect information contained in your application, such as your name, contact details, work history, qualifications and any resume or supporting documents you provide. We handle this information in accordance with this Policy and the Australian Privacy Principles. The employee-records exemption does not apply to this information, as we are not your employer.
Unsolicited personal information: Sometimes we receive personal information we did not ask for. Where this happens, we will decide within a reasonable period whether we could have collected that information under this Policy and the Australian Privacy Principles. If we could not have, and we are not required by law to retain it, we will destroy or de-identify it as soon as practicable.
Anonymity: Where it is lawful and practicable, you may interact with us using a pseudonym or without identifying yourself. However, certain Services (such as posting an advertisement or making an enquiry) require you to be identified.
Children: Our Services are not directed at children under 18 years of age. We do not knowingly collect personal information from children. When the Children's Online Privacy Code is registered pursuant to the Privacy and Other Legislation Amendment Act 2024 (expected by December 2026), we will update our practices accordingly.
3. How We Collect Personal Information
We collect personal information:
• directly from you when you register an account, post an advertisement, send or respond to enquiries, contact our customer service team, or otherwise use our Services;
• automatically through cookies, web beacons and similar tracking technologies as you interact with our platform (see Section 9 below);
• from related companies and third parties, including social networks, advertising partners and data providers, where you have directed or consented to those parties sharing your information with us; and
• from publicly available sources.
If you provide us with personal information about another person (for example, if you report a user), you must only provide us with their information which they have made publicly available on their profile.
4. How We Use Your Personal Information
We use personal information only for the purpose for which it was collected and for related purposes that you would reasonably expect. Our purposes include:
Providing and improving our Services:
• creating and managing your account;
• facilitating the buying and selling of goods and services on our platform;
• verifying your identity where necessary;
• processing payments and resolving disputes;
• providing customer support;
• developing, testing and improving our platform and features;
• generating internal analytics and business insights;
-
user research and surveys; and
• ensuring the security and integrity of our Services.
• facilitating and responding to enquiries about a listing or a related product or service, such as vehicle finance, insurance, or a Fast Car Offer.
Communications:
• sending transactional messages (such as account notifications and enquiry responses);
• sending promotional and marketing communications where you have consented or where otherwise permitted; and
• responding to your enquiries and complaints.
Advertising and personalisation:
• delivering relevant advertisements on and off our platform, including through interest-based advertising;
• personalising content and search results;
• measuring and analysing advertising effectiveness; and
-
we and our advertising partners may use hashed or encrypted versions of your email address to recognise you across devices and websites and deliver and measure advertising.
Legal and compliance:
• complying with our legal obligations;
-
to meet our identity verification and anti-money laundering obligations, through our third party provider, Adyen;
• preventing, detecting and investigating fraud, illegal activity and security incidents;
• enforcing our Terms of Use and other policies; and
• pursuing or defending legal proceedings.
Training models:
-
Training AI and other machine learning models
-
Training fraud detection and other safety prevention and AML tools
Commercialising listing data: to share, licence or sell listing data — and, where you have consented or it is otherwise permitted, listing data that contains personal information — to third parties for research, analytics, advertising and other commercial purposes, consistent with the licence in our Terms of Use. We may licence or sell listing data and content in the form it is published on the Platform, including to third parties for commercial purposes. Because a public Listing may contain personal information that you have chosen to include, by posting a Listing you agree that its content may be licensed or sold as part of that listing data. Please do not include personal information in a Listing that you would not want shared in this way. We do not otherwise sell your personal information.
Automated decision-making: We use automated systems, including artificial intelligence, to analyse how you interact with our Services and to generate inferences about your preferences, interests, and likely behaviours. This analysis is reasonably necessary to personalise your experience, improve the relevance of search results and advertisements, and develop and enhance our platform. Inferences we generate may include predicted interests, content preferences, and general behavioural patterns. Where we use automated processes to make decisions that significantly affect you (for example, account suspension or fraud detection), and the kinds of personal information used includes your account and identity information, transaction and payment information, device and location information, and your activity on our Services, we will ensure that adequate information about the logic involved is available to you as required under applicable law. You may request human review of any such decision by contacting our Privacy Coordinator or via our online contact form under the topic of 'Legal notices or inquiries'.
Government identifiers: Where we collect a government related identifier (such as a driver's licence, passport or other identity-document number) to verify your identity, we do not adopt it as our own identifier of you. We only use or disclose these identifiers where reasonably necessary to verify your identity, to fulfil our obligations to a government agency, or where required or authorised by law.
5. Direct Marketing
We may send you promotional and marketing communications by email, SMS, push notification or post about our Services and, where you have consented, those of our related companies and selected third parties.
You can withdraw your consent or opt out of marketing communications at any time by:
• clicking the 'unsubscribe' link in any marketing email;
• adjusting your communication preferences in your account settings;
• disabling push notifications in your device settings; or
• contacting us via our online contact form.
We will process your opt-out promptly. Opting out of marketing will not affect transactional communications related to your account or purchases.
6. Disclosure of Personal Information
We may disclose your personal information to:
Related companies:
We share information with our related bodies corporate (including Carsguide Autotrader Media Solutions Pty Ltd) for the purposes described in this Policy, including to provide joint services, marketing, fraud prevention and business analytics. We will only use your personal information, or share it with related companies or third parties for their direct marketing, where you have consented or we are otherwise permitted to do so under APP 7. You can opt out any time via the unsubscribe facility in any message or by contacting our Privacy Coordinator. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).
Service providers:
We engage third-party service providers who assist us in operating our platform and business, including providers of information technology, payment processing, advertising, analytics, identity verification, fraud prevention, enforcement of our Terms of Use, customer support, and legal and financial advisory services. When you use the Fast Car Offer service, we may share your details with our procurement partners so they can arrange an inspection and finalise the sale of your vehicle. When you enquire about a listing that is provided by a business (a car dealer) your details are shared with that provider. When you indicate interest in a related product or service through an enquiry, such as vehicle finance, insurance, or a Fast Car Offer, we may share your details with the relevant finance, insurance, or other service provider so they can contact you about your enquiry. These third parties will handle your personal information in accordance with their own privacy policies, which we encourage you to review. When we verify your identity, we use our payments and identity verification provider, Adyen. When you use Gumtree Shipping, we share your delivery address with the seller and the delivery / courier partner to fulfil the shipment. The provider is shown on the listing you are enquiring about. These providers are bound by confidentiality obligations and may only use your information to provide services to us.
Platform users:
When you post a public advertisement, certain information (such as your username, general location and listing details) will be visible to other users. When you enquire about an advertisement posted by a business, your contact details will be shared with that business. When you post a rating or review, your review will be visible to other users.
Advertising partners:
We use advertising technology vendors (including Google, Facebook/Meta, and other programmatic advertising platforms) to deliver targeted advertising. These partners may use cookies and similar technologies to collect information about your interactions with our platform. We and our advertising partners may use hashed or encrypted versions of your email address to recognise you across devices and websites and deliver and measure advertising.
Please see Section 9 for further detail and your opt-out choices.
Information we share and sell:
We may share, rent, or sell de-identified information, aggregated user data, and public listing information (including item categories, geographic regions, pricing trends, and historical listing details) to third parties for market research, trend analysis, and other commercial purposes. We do not require you to include personal information in your listing data, and we actively discourage you from doing so. If you do include personal information in your listing data, you consent to our sharing of that personal information with third parts for the commercial purposes above.
Law enforcement and legal processes:
• we may disclose your information to law enforcement or governmental agencies, or authorised third-parties, in response to a verified request regarding a criminal investigation or proactively where we have reasonable grounds to believe that fraudulent activity has taken place, alleged or suspected illegal activity, or any other activity that may expose us, you or any of our users to legal risk;
• parties to legal proceedings pursuant to a subpoena or other legal process; and
• other parties as required or permitted by law.
Business transactions:
If Gumtree is involved in a merger, acquisition, sale of assets or other business transaction, your personal information may be disclosed to the relevant parties. We will take steps to ensure your personal information continues to be protected in accordance with this Policy or an equivalent standard.
Your disclosure to linked third parties:
This privacy policy addresses only the use and disclosure of personal information we collect from you. If you disclose your information to others, or if you are directed to a third party website, their privacy notices and practices will apply.
We can’t guarantee the privacy or security of your information once you provide it to a third party. You should check the privacy and security policies of your trading partner before entering into a transaction and choosing to share your information, even when dealing with buyers or sellers on our site.
Corrections: If you correct personal information that we have previously disclosed to another organisation, and you ask us to notify that organisation of the correction, we will take reasonable steps to do so, unless this is impracticable or unlawful.
7. Overseas Disclosure
Some of our service providers and related companies are located outside Australia, including in the Global processing locations including Australia, Canada, European Union, India, Ireland, Japan, Netherlands, New Zealand, Philippines, Singapore, Sweden, United Kingdom, United States. Where we disclose personal information to overseas recipients, we will take reasonable steps to ensure the recipient handles your information in a manner consistent with the Australian Privacy Principles, including by entering into data processing agreements or relying on other mechanisms recognised under Australian law.
8. How We Protect Your Information
We take the security of your personal information seriously and implement reasonable technical and organisational measures to protect it from misuse, loss, unauthorised access, modification or disclosure. Our safeguards include firewalls and data encryption, physical access controls to data centres and information access authorisation controls, plus staff training on privacy and data security.
Our security framework includes:
Technical Safeguards: We implement a layered defense strategy including network and device security, Multi-Factor Authentication (MFA) for system access, data encryption, security testing, logging and monitoring.
Information Access Control: We restrict access to personal information to authorised personnel on a 'need-to-know' basis.
Physical Security: Personal information is stored in secure, data centres with 24/7 monitoring, biometric access controls, and strict visitor protocols.
Organisational Measures: All staff undergo mandatory annual privacy and security training. We maintain a robust Data Breach Response Plan to comply with the Notifiable Data Breaches (NDB) scheme, ensuring prompt assessment and notification if a breach is likely to result in serious harm.
Retention and Destruction: We regularly review our data holdings. We take reasonable steps to securely destroy or de-identify personal information once it is no longer required for any authorised purpose, unless we are legally required to retain it (e.g., for tax or regulatory record-keeping).
Overseas Disclosures: Where we engage third-party service providers located outside Australia, we take reasonable steps to ensure they comply with equivalent security standards.
No security system is impenetrable. If you believe your account has been compromised, please contact us immediately via Customer Service.
Data breach notification: In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will assess the breach within 30 days and notify the Office of the Australian Information Commissioner and affected individuals as required under Part IIIC of the Privacy Act 1988 (Notifiable Data Breaches scheme). This obligation applies to personal information we hold directly and to personal information we have disclosed to overseas service providers, as we remain accountable for that information under APP 8. We maintain a data breach response plan that defines roles, assessment criteria and notification procedures to ensure we can respond promptly and effectively.
9. Cookies and Tracking Technologies
We use cookies, pixels, web beacons and similar technologies to collect information about how you use our Services. These technologies help us remember your preferences, enable secure login, analyse usage patterns, and deliver targeted advertising.
You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Services. For full details of the cookies we use and how to manage them, please see our Cookie Policy.
We participate in industry self-regulatory schemes for interest-based advertising. You can opt out of targeted advertising through:
• www.youronlinechoices.com.au (for Australian online behavioural advertising);
• the Network Advertising Initiative opt-out tool at optout.networkadvertising.org;
• the Digital Advertising Alliance opt-out at optout.aboutads.info; and
• your device's advertising identifier settings (see your device manufacturer's instructions).
10. Accessing and Correcting Your Information
You have the right to request access to the personal information we hold about you and to ask us to correct information that is inaccurate, out of date, incomplete or misleading. We will respond within a reasonable time (generally 30 days). We will not charge you for making an access request, although in limited circumstances a fee may apply if the request involves significant effort or resources, and we will notify you of any applicable fee in advance. There is no charge for requesting correction of your personal information. To make an access or correction request please contact our Privacy Coordinator (see section 12) or use our contact form on the help pages under the topic of 'Legal Notices and Inquiries'.
Once you make a public posting, you may not be able to change or remove it. If you ask us to, we will close your account and remove your personal information from view as soon as reasonably possible, based on your account activity and as required under applicable national laws
We will honour your right to request access to, or modification or deletion of, your personal information. We may have the right to withhold that access or refuse to modify or erase your personal information under applicable national laws, but we will give you reasons if we do so.
We may decline to give access in circumstances permitted under the Privacy Act, such as where doing so would be unlawful or would unreasonably impact the privacy of another person. Where we refuse access or correction, we will provide you with written reasons.
You can update basic account information at any time by logging into your account settings.
11. Retention and Destruction of Personal Information
We retain your personal information for as long as it is reasonably needed for the purpose for which it was collected and any related purpose permitted under this Policy. The factors we consider in determining retention periods include:
• the nature of the personal information and why it was collected;
• our legal and regulatory obligations (including obligations to retain records for a minimum period);
• the resolution of disputes, fraud prevention and enforcement of our Terms of Use; and
• whether the information is necessary to provide our Services.
When personal information is no longer needed, we will take reasonable steps to de-identify or securely destroy it.
12. Questions and How to Contact Us
For questions about this Privacy Policy or our privacy practices you can contact us via our Privacy Coordinator:
Privacy Coordinator
Gumtree AU Pty Ltd
Address: 1 York Street, Sydney NSW 2000
Email: privacy@gumtreegroup.com.au
How we handle privacy complaints: If you wish to make a privacy complaint, please contact our Privacy Coordinator using the details above. We ask that complaints be made in writing so we can properly investigate them. We will acknowledge your complaint within 5 business days and aim to respond substantively within 30 days. If we need more time to investigate, we will let you know and keep you informed of our progress.
If you're looking for more help or have a question to ask, please contact our help desk
If you are not satisfied with our response to your complaint (after allowing us a reasonable time to respond), you have the right to lodge a complaint with the Office of the Australian Information Commissioner (‘OAIC’) Website
