Version 1.0 · Last updated: 5 July 2026 · Data controller: Charmaine Swinburn trading as EquiCloset · 19 Western St, Manchester, Abbey Hey, M18 8GG · [email protected]
Also available: South Africa Privacy Notice (POPIA)
1. Who We Are
EquiCloset is operated by Charmaine Swinburn trading as EquiCloset (“we”, “us”, “our”). We are the data controller for personal data collected through the Platform in the United Kingdom. We are registered with the Information Commissioner’s Office (ICO).
Contact for data protection matters: [email protected]
2. What Data We Collect
| Category | Examples | When collected |
|---|---|---|
| Account data | Name, email address, username, password (hashed) | Registration |
| Profile data | Profile photo, bio, location (county/region), seller settings | Profile setup |
| Listing data | Item title, description, photos, price, category | When you list an item |
| Transaction data | Order details, item price, delivery charge, payment status, escrow status | When you buy or sell |
| Payment data (buyers) | Payment method type, last 4 digits, billing address (held by Stripe — we do not store full card details) | At checkout |
| Bank account data (sellers) | Account holder name, bank name, sort code, account number — stored by EquiCloset to send payout by bank transfer | When you add payout details |
| Communications | Messages sent between buyers and sellers via the Platform | When you use in-app messaging |
| Device & usage data | IP address, browser type, pages visited, session duration | Automatically on each visit |
| Identity verification data | Government ID (held by Stripe for buyer identity verification where required) | When required |
3. How We Use Your Data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing escrow | Performance of a contract (Art. 6(1)(b)) |
| Facilitating transactions between buyers and sellers | Performance of a contract (Art. 6(1)(b)) |
| Handling disputes and buyer protection claims | Performance of a contract / Legitimate interests (Art. 6(1)(b)(f)) |
| Preventing fraud and complying with legal obligations | Legal obligation / Legitimate interests (Art. 6(1)(c)(f)) |
| Sending transactional emails (order confirmations, shipping updates) | Performance of a contract (Art. 6(1)(b)) |
| Sending service announcements and important notices | Legitimate interests (Art. 6(1)(f)) |
| Improving the Platform | Legitimate interests (Art. 6(1)(f)) |
We do not use your personal data for marketing to third parties, and we do not sell your data.
4. Who We Share Data With
| Recipient | Purpose | Location |
|---|---|---|
| Stripe | Payment processing, escrow, seller KYC | UK / EEA / USA (Standard Contractual Clauses) |
| Cloudflare | Content delivery and media storage (R2) | EEA |
| Render | Cloud hosting (servers and database) | EEA |
| Courier providers | Parcel delivery (tracking number only) | UK |
| Law enforcement / regulators | When required by law or court order | UK |
We share only the minimum data necessary for each purpose. All third-party processors are bound by data processing agreements.
5. Cookies
We use only essential cookies needed to operate the Platform (session management, CSRF protection). We do not use advertising or analytics cookies. See our Cookie Policy for details.
6. How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Account data | For the duration of your account, plus 2 years after closure |
| Transaction and financial records | 7 years (HMRC requirements) |
| Messages | 2 years from the date of the message |
| Device & usage logs | 90 days |
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure — ask us to delete your data (subject to legal retention obligations)
- Right to restrict processing — ask us to limit how we use your data in certain circumstances
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right not to be subject to solely automated decisions — we do not make automated decisions with legal or significant effects on you
To exercise any of these rights, email [email protected]. We will respond within one calendar month.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including: encrypted data storage and transmission (TLS); access controls and authentication; regular security reviews. In the event of a data breach that poses a risk to your rights, we will notify the ICO within 72 hours and affected users without undue delay.
9. International Transfers
Some of our third-party processors (including Stripe) may transfer data outside the UK. Where they do, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO.
10. Complaints
If you are unhappy with how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
11. Changes to This Notice
We may update this Privacy Notice from time to time. We will notify you of material changes by email or via a Platform notice. The latest version is always available on this page.
