Privacy Policy

Last Updated: [Date]

[Company Name] ("we," "us," or "our") is committed to protecting the privacy and security of our customers' ("you" or "your") personal data in compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This Privacy Policy outlines how we collect, use, share, and protect your information. By engaging in transactions with us, you agree to the practices described in this policy.

1. Information We Collect

When you sell items to us, we may collect and process certain personal data:

Personal Identification Information: Name, contact details (such as phone number, email address, and mailing address), and any identification required for the transaction (e.g., government-issued ID).

Device Information: Details about the item(s) being sold, such as brand, model, serial number, and device history.

Transaction Information: Payment details, transaction records, and other information necessary to process the buyback.

2. Lawful Basis for Processing Personal Data

Under GDPR, we rely on the following lawful bases to process your personal data:

Contractual Obligation: We process your personal data to fulfill our contract with you, which includes verifying your identity, completing transactions, and providing a record of the sale.

Legal Obligation: Certain data is collected to comply with UK laws and regulations, such as verifying identity to prevent fraud.

Legitimate Interest: We may process personal data for our legitimate interests, such as improving our services, enhancing customer support, and maintaining records for security purposes.

3. How We Use Your Information

We use your personal data for the following purposes:

Transaction Processing: To facilitate the purchase of items and provide documentation related to the transaction.

Identity Verification: To confirm the identity of the seller and prevent fraud or unauthorized sales.

Customer Support: To respond to inquiries, resolve disputes, or assist with other requests.

Legal Compliance: To comply with applicable UK laws, such as anti-money laundering and fraud prevention regulations.

4. Data Security

We take the security of your data seriously and employ measures to protect it from unauthorised access, disclosure, alteration, or destruction. These measures include:

Data Encryption: Sensitive data is encrypted both during transmission and while stored.

Access Control: Access to your personal data is limited to authorised personnel who need it for legitimate business purposes.

Secure Storage: Personal information and transaction records are stored securely, and we review our security practices regularly.

5. Data Sharing

Your personal data will not be shared with third parties except in the following circumstances:

Service Providers: We may share data with trusted service providers who assist us in delivering our services, such as payment processors and secure data storage. These providers are bound by confidentiality and data protection obligations.

Legal Requirements: We may disclose personal data in response to legal obligations, such as court orders, legal processes, or lawful requests from public authorities.

Business Transfers: If we undergo a merger, acquisition, or asset sale, your data may be transferred to the new entity under the same privacy commitments.

6. International Data Transfers

If we transfer your data outside the UK or EEA, we ensure it is protected to the same standard as within the UK by implementing one of the following safeguards:

Adequacy Decision: Transferring data to a country that has been deemed to provide adequate protection by the UK Government.

Standard Contractual Clauses: Using standard data protection clauses approved by the UK Information Commissioner’s Office (ICO).

7. Your Rights Under GDPR

You have certain rights under GDPR regarding your personal data. These include:

Access: The right to request access to your personal data.

Rectification: The right to request correction of inaccurate or incomplete data.

Erasure: The right to request deletion of personal data where it is no longer necessary for the purposes for which it was collected, subject to legal obligations.

Restriction of Processing: The right to request that we restrict the processing of your personal data in certain situations.

Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format.

Object: The right to object to processing, particularly in cases where we rely on legitimate interest as the lawful basis.

Withdraw Consent: Where processing is based on consent, the right to withdraw consent at any time.

To exercise these rights, please contact us at [Contact Information]. We may request additional information to verify your identity before processing your request.

8. Retention of Data

We retain personal data only as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. When your data is no longer needed, it will be securely deleted or anonymised.

9. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. Any updates will be posted on our website and will take effect upon posting. We encourage you to review this policy periodically.

10. Contact Us and Complaints

If you have questions, concerns, or complaints regarding this Privacy Policy or our data handling practices, please contact us at:

[Company Name]

[Address]

[Phone Number]

[Email Address]

If you are not satisfied with our response, you have the right to file a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues.