Privacy & cookie notice

[DRAFT – needs solicitor review] [COMPANY NAME LTD] is the controller of your personal data. ICO registration number: [NUMBER]. Contact: [EMAIL].

What we collect

• Account details: email, username, password (stored only as a salted hash), town, bio and photo.
• Listings, messages, offers, orders, reviews and reports.
• Delivery addresses for orders (shared with the seller of that order only).
• Seller identity and tax details required by HMRC's digital platform reporting rules (collected by our payment partner and/or us): name, address, date of birth, National Insurance number, bank details.
• Technical data: IP address (for security and rate limiting), session cookies.

Why (lawful bases)

• To provide the marketplace (contract).
• To meet legal obligations, including HMRC reporting, record keeping and online safety (legal obligation).
• To keep the service safe and prevent fraud (legitimate interests).

Who we share it with

Stripe (payments and identity checks), Cloudflare (hosting), Shippo and the carrier chosen for the parcel – Evri, Royal Mail or DPD (names, delivery and return addresses, and an optional phone number/email for delivery updates, used only to create the label and deliver the parcel), [email provider], HMRC where the law requires. [Data processing agreements to be put in place.]

How long we keep it

[Draft] Account data while your account is open; order and seller-reporting records for at least 5–6 years to meet tax law.

Cookies

We only use strictly necessary cookies: a session cookie that keeps you logged in, a security (CSRF) cookie, and a short-lived cookie for on-screen messages. We do not use advertising or analytics cookies. [If analytics are added, a consent banner will be needed.]

Your rights

You can ask for a copy of your data, correction or deletion, and you can complain to the ICO (ico.org.uk).

Last updated: [DATE] · Version 0.1 (draft)