Privacy Policy

Last updated: 4 October 2026

This Privacy Policy explains how Preloved Bazaar collects, uses, shares and protects your personal data when you use our marketplace at prelovedbazaar.co.uk, our Preloved Bazaar app for iOS and Android, and any related services (together, the “Platform”). It applies to everyone who uses the Platform — whether you are buying, selling, or both, and whether you use the website or the app.

Please read it alongside our Terms of Use and our Cookie Policy, which together form your agreement with us. Words such as “Buyer”, “Seller” and “Listing” have the same meaning as in our Terms of Use.

1. Who we are — the data controller

For the personal data described in this policy, the data controller is Preloved Bazaar Shop Limited, a company registered in England and Wales (company number 15102071) (“Preloved Bazaar”, “we”, “us” or “our”). The data controller is the organisation that decides why and how your personal data is used.

Trading name: Preloved Bazaar
Operated by: Preloved Bazaar Shop Limited, a company registered in England and Wales, company number 15102071, with its registered office in West Yorkshire, United Kingdom (full details on the Companies House register / available on request)
Contact for privacy matters: hello@prelovedbazaar.co.uk

We handle your personal data in line with UK data protection law — the UK GDPR and the Data Protection Act 2018. The Information Commissioner’s Office (ICO) is the UK’s data-protection regulator, and you can raise a concern with them (see section 9).

2. The personal data we collect

We collect personal data that you give us, that is created as you use the Platform, and (in limited cases) that we receive from others. The main categories are:

2.1 Account and profile data

your name and the email address you register with;
a username or display name, and any profile photo, bio or shop details you choose to add;
your login credentials (your password is stored only in a securely hashed form — we never see it in plain text);
because every account on Preloved Bazaar can both buy and sell, your account holds both your buyer and your seller information.

2.2 Listing data

the photographs, descriptions, condition details, sizes, prices and postage terms you add when you list an item;
any messages and offers exchanged about a listing.

AI listing suggestions. To help you list faster, when you add the main photo of an item we send that photo to Google (via the Google Gemini API) so it can suggest a category, colour, title and description for your listing. These are suggestions only — you can change or ignore any of them, and nothing is published until you save the listing. Google processes the image to generate the suggestions; on our paid API tier Google does not use your image to train its models and does not retain it beyond what is needed to provide the response. See Google’s API terms at ai.google.dev/gemini-api/terms and Google’s privacy policy at policies.google.com/privacy.

2.3 Order, transaction and delivery data

the items you buy or sell, order references, prices, the Buyer Protection fee, and order status;
the delivery address needed to fulfil an order, and the tracking number a Seller enters when they dispatch an item;
refund, cancellation and dispute records relating to your orders.

2.4 Messages and disputes

the content of messages you send through the Platform’s messaging tools;
information you give us when you raise or respond to a problem with an order, including any photographs or other evidence you provide.

2.5 Payment and payout data

Payments and seller payouts are handled by our payment provider, Stripe (see section 4). We do not store your full card number. We hold limited transaction records (such as the order amount, currency, a payment reference and whether a payment succeeded, failed or was refunded) so we can run the Platform, administer escrow, and meet our record-keeping duties.

2.6 Technical and usage data

When you visit the Platform we automatically collect limited technical data such as your device and browser type, IP address, and how you interact with the site. Some of this is collected through cookies and similar technologies — see our Cookie Policy and section 5 below. If you use our app, this also includes app usage analytics (see section 5).

2.7 Reviews, ratings and reports

when an order is completed, the Buyer and the Seller can each give the other a star rating (1 to 5 stars) and an optional written review, and the person who was reviewed can post one reply;
reviews and replies are public. They appear on the reviewed member’s shop page with the reviewer’s display name and profile photo, and anyone visiting the Platform can read them, whether or not they are signed in. Our team may hide a review or reply that breaks our rules;
your star rating (your average and the number of ratings) is shown on your shop page and with your listings;
any member can report a review, a reply, a listing, a shop or another member to us. A report records who made it, the reason they chose, any message they added and, for a review or reply, a copy of the reported text as it was at the time. Reports are private to our team. We use them to moderate the Platform and keep our members safe.

3. The lawful bases we rely on

Under the UK GDPR we must have a “lawful basis” for using your personal data. We rely on the following:

Performance of a contract — to set up and run your account, list items, process orders, hold and release funds, handle disputes and refunds, and provide customer support. Without this data we cannot provide the Platform to you.
Compliance with a legal obligation — to meet duties placed on us by law, in particular tax record-keeping requirements, anti-money-laundering and fraud-prevention obligations, and our duties under online-safety law, on the basis of which we retain certain records.
Legitimate interests — to keep the Platform secure, prevent and investigate fraud and prohibited activity (including checking that sign-ups are made by people, not bots, and moderating reported content), debug and improve our service (including measuring how our app is used — see section 5), and protect our users and our business. Where we rely on legitimate interests, we balance our interests against your rights and only proceed where your interests do not override ours.
Consent — for non-essential cookies and similar technologies on our website, and for any optional marketing communications. You can withdraw consent at any time (see sections 5 and 9). Withdrawing consent does not affect anything we did lawfully before you withdrew it.

4. Payments, and Stripe as an independent controller

All payments and seller payouts on the Platform are processed by Stripe. When you pay, or when a Seller receives a payout, your information is handled by Stripe under Stripe’s own privacy policy, which you can read at https://stripe.com/privacy.

For its payment processing, fraud prevention and identity-verification activities, Stripe acts as an independent data controller in its own right — it decides how it uses the data it collects to provide regulated payment services, verify identities (KYC) and prevent fraud, and it is responsible to you directly for that use. This means that, in addition to this policy, Stripe’s privacy policy governs what Stripe does with your payment and verification data.

Key points about payment data:

We do not store your full card number or other full card details — these are handled by Stripe.
Sellers receive payouts through a Stripe Connect Express account, and complete Stripe’s identity and bank-account checks directly with Stripe.
We receive limited transaction information back from Stripe (such as a payment reference and whether a payment succeeded, failed or was refunded) so we can operate orders, escrow and refunds.

5. Cookies and similar technologies

On our website, we use cookies and similar technologies to make the website work, to keep it secure, and — only with your consent — for analytics or marketing. Strictly necessary cookies do not require consent; non-essential cookies are only set after you agree.

Full details, including the types of cookies we use and how to change your preferences at any time, are in our separate Cookie Policy. Where we rely on consent for cookies, we do so in line with the Privacy and Electronic Communications Regulations (PECR).

Analytics in our app. Our iOS and Android app uses Google Analytics for Firebase, a service provided by Google, to help us understand how the app is used so we can improve it. It records which screens are viewed and actions such as viewing an item, signing up or signing in, and completing a purchase, together with technical information such as your device model, operating system, app version and general location (which Google works out from your IP address). It uses device and app-installation identifiers, not your name or email address. On Android it can also read your device’s advertising ID, which you can reset or delete in your Android settings. On iPhone and iPad we do not collect the advertising identifier, and the app does not track you across other companies’ apps or websites.

App analytics is switched on by default. You can turn it off at any time: sign in to the app, open the Profile tab, tap Profile and switch off Share usage analytics under Privacy. Once it is off, the app stops sending analytics. You can read how Google handles this data at firebase.google.com/support/privacy.

6. Who we share your data with

We do not sell your personal data. We share it only where it is necessary for the purposes in this policy, with the following categories of recipient:

Anyone visiting the Platform — your public profile. Some information is public so that members can trust each other, and anyone can see it, whether or not they are signed in: your shop name and profile photo, your bio and shop location if you add them, your listings, when you joined and roughly when you were last active, your followers and the shops you follow, your star rating, and the reviews and replies you write and receive (see section 2.7).
Other Buyers and Sellers — as needed for an order. When you buy, the Seller receives the delivery address and order details needed to send your item. When you sell, the Buyer sees the information needed to complete the order. Messaging exchanges are shared with the other party to the conversation. Apart from your public profile, we do not share more than the transaction requires.
Stripe — our payment provider, to process payments, hold and transfer funds, run seller payouts, and carry out identity and fraud checks (see section 4).
Our hosting and infrastructure provider — which stores and serves the Platform on our behalf.
Our email/communications provider — used to send transactional emails (such as order, dispatch, dispute and refund notifications).
Google (Gemini API) — when you use our optional AI listing-suggestion feature, the item photo you upload is sent to Google to generate suggested listing details (see section 2.2). Google processes the image to return the suggestions; on our paid tier it does not use the image to train its models.
Google (Maps Platform) — when you type an address at checkout or while setting up to sell, what you type is sent to Google Places to suggest matching addresses (on the website your browser sends it to Google directly; in the app it goes through our servers). When you save an address in your account or shop settings, we also send it to Google’s Address Validation service to check that it is a real, deliverable address.
Google (Google Analytics for Firebase) — receives usage analytics from our app, unless you switch analytics off (see section 5).
Cloudflare (Turnstile) — on the website, a Cloudflare Turnstile check runs when you open our sign-in and registration page, and we use its result to confirm that a person, not a bot, is creating an account with an email address. In the app it runs only when you create an account with your email address, not when you sign up with Google or Apple. To do this, Cloudflare processes technical information about your device and browser, including your IP address. See Cloudflare’s Turnstile privacy policy.
Google and Apple (sign-in) — if you choose to sign in with Google or Apple, they confirm your identity to us and share your name and email address (Apple may give us a private relay address instead).
Push notification services — if you allow notifications in our app, we send them through Expo’s push service, which passes them to Apple (iOS) or Google (Android) for delivery. They receive your device’s push token and the notification text.
postcodes.io — if Google’s address check is unavailable, we check a UK postcode (only the postcode) against this free public postcode service instead.
Law enforcement, regulators and other authorities — where we are legally required or permitted to disclose information, including to comply with our duties under the Online Safety Act 2023 and to report or respond to illegal content or activity, and to protect our users, the public or our rights.
Professional advisers and, in future, a successor business — for example our advisers, or a buyer of the business if we ever sell or reorganise it, subject to appropriate confidentiality and data-protection safeguards.

7. International transfers

Some of our providers — in particular Stripe, Google and Cloudflare, and potentially our hosting or email providers — may process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we (or the provider acting as controller) ensure an appropriate safeguard is in place as required by UK data-protection law — such as transfer to a country with UK “adequacy” status, or the use of the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep your data (retention)

We keep personal data only for as long as we need it for the purposes set out in this policy, and to meet our legal obligations. In particular:

Order, transaction and tax records are kept for as long as required by HMRC record-keeping and tax law — generally six years from the end of the relevant accounting period.
Messages, dispute records and reports are kept for as long as needed to administer disputes, prevent fraud, and protect our users, and to meet our duties under online-safety law.
Account data is kept while your account is open and for a reasonable period afterwards, after which it is deleted or anonymised — except where we must retain certain records to meet a legal obligation (see section 10).

When we no longer need personal data, we delete it securely or irreversibly anonymise it.

9. Your rights

Under UK data-protection law you have the following rights over your personal data. You can exercise any of them by contacting us at hello@prelovedbazaar.co.uk:

Access — to ask for a copy of the personal data we hold about you;
Rectification — to ask us to correct data that is inaccurate or incomplete;
Erasure — to ask us to delete your data in certain circumstances (this is not absolute — we may need to keep some data to meet a legal obligation, such as tax records, or to resolve a live order or dispute);
Restriction — to ask us to limit how we use your data in certain circumstances;
Portability — to ask us to provide certain data you gave us in a structured, commonly used, machine-readable format, or to send it to another provider, where technically feasible;
Objection — to object to processing we carry out on the basis of legitimate interests, and to object to direct marketing at any time;
Withdraw consent — where we rely on your consent (for example for non-essential cookies or marketing), you can withdraw it at any time.

We will respond within the time limits set by law (usually one month). There is normally no charge.

Complaints. If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint or by calling its helpline.

10. Closing your account, and automated decision-making

10.1 Closing your account

You can ask to close your account at any time — see our Terms of Use for how account closure works. When you close your account we delete or anonymise your personal data, except where we are required to keep certain records to meet a legal obligation (for example HMRC tax records), or where we need to retain information to resolve a live order, held funds, or an open dispute.

10.2 Automated decision-making

Some parts of the Platform run automatically — for example, our escrow system releases a Seller’s funds after tracking is added and a holding window passes, automatically cancels an order and refunds the Buyer in full if the Seller has not marked it as shipped within 7 days, and a dispute that a Seller does not answer within the response window is automatically passed to our team, who review the evidence and decide the outcome. These automated steps follow fixed, published rules set out in our Terms of Use.

Some of these steps take effect automatically, without a person reviewing each case — for example, an order that is not marked as shipped within 7 days is cancelled and refunded automatically. A refund following a dispute is different: it is only issued when the Seller agrees or a member of our team decides, never purely by a machine. If you think an automatic step was wrong, contact us at hello@prelovedbazaar.co.uk and a person will review it.

11. Changes to this policy, and how to contact us

We may update this Privacy Policy from time to time — for example to reflect new features, new providers, or changes in the law. When we make a material change we will update the “last updated” date above and, where appropriate, let you know.

For any privacy question or request, or to exercise your rights, contact us at hello@prelovedbazaar.co.uk.