Noel Leeming merchandise executive general manager Jason Bell confirmed it had an agreement to supply new phones to Home Direct.
Vaauli's faulty phone was accidentally included in a dispatch of new phones, Bell said.
"It was human error ... we're going to do a more in-depth investigation on Monday and we'll change systems to ensure it never happens again."
Faulty phones were returned to the manufacturer for repairs, and wiped only if they were to be sold again as refurbished phones.
The phone was at a Home Direct warehouse, and would be retrieved by a Noel Leeming manager tomorrow morning, he said.
Home Direct general manager Jodi Comrie said the firm sold only new products.
"We'll certainly be taking this up with the supplier."
Vaalui, 40, was called by Bell after he was contacted by the Herald on Sunday.
He offered her a $100 voucher, and apologised but she did not accept either, Vaalui said.
"My privacy has been breached. The only thing on my mind is getting that phone back and wiping all my details off."
Telecommunications Users' Association chief executive Paul Brislen said people should delete private information from phones before repair work.
"You just can't rely on other people. You have to look after your own privacy."
Be smartphone safe
• Put a PIN number on your smartphone.
• Use the settings tab to delay its activation so you don't have to unlock every few minutes.
• Install a "find my phone" app available for Apple and Android smartphones. Some apps also include the ability to remotely wipe your phone.
• Disable one-tap access to email and Facebook applications.
• Use a password locker service to keep multiple passwords safe, rather than store them on a phone.