Privacy Policy for Birmingham Reserve And Buy (https://birmingham.reserveandbuy.co.uk)
1. Introduction and Who We Are (Data Controller)
This Privacy Policy sets out how Reserve And Buy (“the Platform,” “we,” “us,” or “our”), as the Data Controller, collects, uses, stores, and shares the personal data of our users (Sellers and Buyers, “you,” or “data subjects”) in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Controller Contact Details:
* Data Controller: Linda Lum trading as Reserve And Buy.
* Website: https://birmingham.reserveandbuy.co.uk
* Email for Privacy Queries/Data Requests: privacy@birmingham.reserveandbuy.co.uk
Digital Platform Reporting to Tax Authorities (HMRC Exemption) As of the date of this Policy, the Platform is operated exclusively by an individual carrying on business as a Sole Trader resident in the United Kingdom. Accordingly, this Platform is currently excluded from the statutory requirement to register with, and routinely report Seller transaction data to, His Majesty’s Revenue and Customs (HMRC) under The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023. Further detail is provided in our Terms and Conditions.
2. What Data We Collect and Our Lawful Basis for Processing
We will only collect and process your personal data where we have a lawful basis to do so under Article 6 or Article 9 of the UK GDPR. Below sets out what personal data we collect, the purpose for collection, and the legal basis we rely upon.
| Data Type Collected | Purpose of Processing | Lawful Basis (UK GDPR Art. 6) |
|---|---|---|
|
Name, Username, Email Address
|
To create and manage your account, verify your identity, and provide customer support. |
Contract: Necessary for the performance of the contract (Terms & Conditions). |
|
Mobile Number (Seller Only)
|
To provide timely SMS and WhatsApp notification when a buyer reserves an item, facilitating immediate transaction progress. Note: This number is not shared with the buyer. |
Legitimate Interests: Our legitimate interest in providing reliable and efficient transaction alerts to sellers. |
|
IP Address, Location, Browser Type
|
Site improvement, security monitoring, and fraud prevention |
Legitimate Interests: Our legitimate interests in ensuring site security and detecting/preventing fraudulent activity. |
|
Payment Card Details (Processed by Stripe)
|
To process the Buyer’s Reservation Service Fee. We do not store full card numbers.
|
Contract: Necessary for the performance of the contract (Terms & Conditions). |
|
Inter-User Messages |
Stored to mediate potential disputes and provide customer service related to transactions. |
Legitimate Interests: Our legitimate interest in maintaining records for dispute resolution and providing a functional communication service. |
|
Order History and Transaction Value (£) |
For accounting, tax compliance (6-year retention), and fulfilling our legal duties. |
Legal Obligation: Necessary for compliance with UK accounting and tax law. |
|
Product Photos/Pick-up Location |
To publish your listing on the public marketplace. |
Contract: Necessary for the performance of the contract (enabling the sale). |
|
Self-Reported Sales Confirmation (The “Sold” Flag). |
To provide Sellers with historical sales metrics and for Platform volume analysis. |
Legitimate Interests (Our interest in providing sellers with performance tracking and maintaining a functional marketplace history). |
3. Cookies, Analytics, and Consent
We use cookies and similar technologies for necessary site function and non-essential purposes like site analytics.
* Necessary Cookies: We use cookies to save your login session and cart contents. The lawful basis for these is Legitimate Interests (to provide the requested service).
* Google Analytics: We use Google Analytics to gain valuable insight into how our site is being used. IP addresses are collected as personal data for this purpose.
* Consent Mechanism (MANDATORY): We use a cookie management platform/banner to ensure that non-essential cookies, including Google Analytics tracking cookies and login “Remember Me” cookies, are not deployed until you have given explicit, active, and unambiguous consent (opt-in). You have the right to withdraw this consent at any time via our cookie settings tool.
4. How and Why We Share Your Data
We do not sell your personal data. We only share it with third parties necessary to operate the service or when legally required.
| Recipient / Third Party | Purpose of Sharing | Data Shared | Controller/Processor Status |
|---|---|---|---|
|
Other Users (Buyer & Seller) |
To facilitate communication exclusively through the internal Order Messaging system to arrange the physical meetup and exchange. |
Content of the message itself is exchanged. Users are strictly prohibited from transmitting private contact information (email, phone number). An exception is made for sharing a physical address only for necessary collection of large/bulky items. Otherwise we recommend meeting in a public space. |
N/A |
|
Stripe |
Payment gateway to process the Reservation Service Fee. |
Card details, name, billing address, purchase total. |
Stripe acts as a Data Processor on our behalf. |
|
WP World Host |
Website and database hosting services. |
All user data stored on our database (UK server). |
WP World Host acts as a Data Processor on our behalf. |
|
Google Analytics |
Website usage monitoring and statistical analysis. |
IP address (anonymised), cookie identifiers, device identifiers. |
Google acts as a Data Processor on our behalf. |
|
WhatsApp |
To send transaction reservation notifications to sellers. |
Mobile Number. |
WhatsApp acts as a Data Processor on our behalf. |
|
Law Enforcement/HMRC |
To comply with legal demands, warrants, or court orders. |
As legally required for disclosure. |
Legal Obligation. |
5. International Data Transfers
The processing of data by our third-party partners may involve transferring your personal data outside the UK and the European Economic Area (EEA), specifically to the United States (US) and potentially elsewhere.
* Safeguards: Where data is transferred internationally (e.g., by Google, Stripe, or WhatsApp), we rely on the appropriate data transfer mechanisms approved under the UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or the UK Extension to the EU-US Data Privacy Framework.
* Risk: We take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy, even when transferred internationally.
6. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
| Data Type | Retention Period | Justification |
|---|---|---|
|
Order/Transaction Data |
Minimum of six (6) years from the financial year end. |
UK statutory requirement for tax and accounting records. |
|
Account Information |
Until you request the account deletion/anonymisation. |
For performance of contract (continued use of the Platform). |
|
Inter-User Messages |
Retained for 12 months after the related order is completed or cancelled. |
Our legitimate interest for dispute resolution and audit trail. |
|
Google Analytics/Non-essential Cookies |
As configured in our settings, currently a maximum of 26 months. |
Analytics purposes only; linked to explicit consent. |
If you request account deletion, we will anonymise your data unless we are legally obliged to retain it for the mandatory six-year period (e.g., transaction records).
7. Your Rights as a Data Subject
Under the UK GDPR, you have the following rights regarding your personal data:
1. The Right to be Informed: To be informed about how your data is processed (which this Policy provides).
2. The Right of Access: To request a copy of the personal data we hold about you (Subject Access Request).
3. The Right to Rectification: To have inaccurate personal data corrected.
4. The Right to Erasure (‘Right to be Forgotten’): To request that we delete or anonymise your data, subject to legal limitations (e.g., our legal obligation to keep tax records).
5. The Right to Restrict Processing: To ask us to suspend processing of your data in certain circumstances.
6. The Right to Data Portability: To request your data be transferred to you or another organisation in a structured, commonly used format.
7. The Right to Object: To object to our processing of your personal data where we rely on the Legal Basis of ‘Legitimate Interests’.
8. Rights in Relation to Automated Decision Making: We do not use fully automated decision-making or profiling that produces legal or significant effects.
To exercise any of these rights, please contact us at the dedicated email address: privacy@birmingham.reserveandbuy.co.uk
8. Raising a Complaint
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a formal complaint with the UK’s supervisory authority:
* The Information Commissioner’s Office (ICO):
* Website: https://ico.org.uk/make-a-complaint/
* Telephone: 0303 123 1113
Proprietor details:
Miss Linda Lum T/A Sole Trader.
9 Park Road,
Moseley,
Birmingham.
B13 8AB.
info@birmingham.reserveandbuy.co.uk