Privacy Policy

1. Data controller

The data controller responsible for your personal data is Swopsee Ltd, a company registered in England and Wales. For privacy-related enquiries: [email protected] (or the contact address published on the Service).

2. What we collect

We may collect and process:

• Account and profile: name, email, password (hashed), profile photo, username, and other details you provide.
• Listings and transactions: item descriptions, photos, prices, swap details, order and delivery information, payment-related data.
• Communications: messages sent through the platform, support correspondence.
• Payment data: billing address, payment method identifiers (processed by our payment provider; we do not store full card numbers).
• Usage and technical data: device information, IP address, log data, analytics (e.g. pages viewed, actions taken) to operate and improve the service.
• Location: if you choose to use location-based features (e.g. nearby items, swap points).

3. Why we use your data and legal basis

We use your data to:

• Provide the Service (create account, list items, conduct swaps/purchases, messaging) — contract.
• Process payments and run protection schemes — contract.
• Send service-related and transactional communications — contract / legitimate interests.
• Improve the Service, security, and user experience (analytics, testing) — legitimate interests.
• Comply with legal obligations (e.g. fraud prevention, tax, law enforcement) — legal obligation.
• Marketing (where you have consented or we are permitted) — consent / legitimate interests.

Where we rely on legitimate interests, we balance them against your rights. You can object to marketing and certain other processing as set out in your rights below.

4. Who we share data with

We may share your data with:

• Payment provider (Stripe): to process payments and manage payment methods. Stripe's privacy policy applies to their processing: stripe.com/gb/privacy.
• Infrastructure and database (e.g. Supabase): to host and operate the Service; they act as processors on our instructions.
• Other users: as necessary to complete transactions (e.g. delivery address to seller, profile to counterparty).
• Analytics and tools: we may use analytics or operational tools that process usage data; we choose providers with appropriate safeguards.
• Legal and authorities: where required by law or to protect our rights and users.

We do not sell your personal data to third parties for their marketing.

5. Retention

We keep your data only as long as necessary for the purposes above: e.g. for the duration of your account and for a reasonable period after closure for legal, tax, and dispute purposes; transaction and payment data as required by law and our policies; support and messaging as needed for operations and disputes. Anonymised or aggregated data may be retained longer. You can request erasure subject to legal and contractual constraints.

6. Your rights (UK / EEA)

Under UK GDPR / data protection law you have the right to:

• Access — request a copy of your personal data.
• Rectification — have inaccurate data corrected.
• Erasure — request deletion in certain circumstances.
• Restriction — limit processing in certain cases.
• Data portability — receive your data in a structured, machine-readable format where applicable.
• Object — object to processing based on legitimate interests (including profiling) or to direct marketing.
• Withdraw consent — where we rely on consent, withdrawal does not affect lawfulness of earlier processing.

To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK: ico.org.uk/make-a-complaint.

7. Cookies and analytics

Our website and app may use cookies and similar technologies for essential operation, security, and analytics. We may use analytics to understand how the Service is used and to improve it. You can control cookies via your browser settings; some features may not work fully if you disable certain cookies. Where we use non-essential cookies or analytics that require consent, we will obtain consent where required by law.

8. International transfers

Your data may be processed in the UK, EEA, or in other countries where our service providers operate. Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place (e.g. UK adequacy decisions, standard contractual clauses, or other approved mechanisms) so that your data remains protected in line with UK data protection standards.

9. Security

We implement technical and organisational measures to protect your data against unauthorised access, loss, or misuse. No system is completely secure; you are responsible for keeping your account credentials safe and for the content you share with other users.

10. Children

The Service is not intended for users under 18. We do not knowingly collect personal data from children; if we become aware of such data we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on the Service and indicate the "Last updated" date. Material changes may be communicated by email or in-app notice. Your continued use after the effective date constitutes acceptance. We encourage you to review this policy periodically.

12. Contact

For privacy enquiries or to exercise your rights:

• Email: [email protected]
• Website: www.swopsee.co.uk

Swopsee Ltd is the data controller. Company details are as stated on the Service or at Companies House.