Privacy Policy

1. Who we are

SilentSale Ltd ("SilentSale", "we", "us", "our") is a company registered in England and Wales under company number 16457502, with its registered office at 3rd Floor, 86-90 Paul Street, London EC2A 4NE.

We operate the SilentSale marketplace platform (the "Platform"), accessible via our website and mobile applications.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, SilentSale Ltd is the data controller.

2. Information we collect

We collect the following categories of personal data:

• Account information: Name, email address, phone number, date of birth, profile photo, delivery address.
• Identity verification: When you verify your identity through Stripe Identity, we process identity documents and biometric data (facial imagery) solely for verification purposes.
• Transaction data: Purchase and sale history, payment method details (processed by Stripe — we do not store full card numbers), shipping information, dispute records.
• Communications: Messages sent through our in-app chat system, dispute submissions, support requests, and SilentGuardian assistant conversations.
• Device and usage data: IP address, device type, operating system, browser type, app version, pages visited, features used, timestamps, and device integrity signals used for fraud prevention.
• Push notifications: Device push tokens and notification preferences when you enable alerts on your device.
• Location data: Approximate location derived from IP address. Precise location only when you explicitly use location features (e.g. PIN Pickup meetup locations). Short-lived proximity signals for in-person safety are deleted after 7 days.
• Media: Photos and videos you upload for listings or dispute evidence, including associated metadata.
• Item identifiers: When a seller optionally adds a serial number, IMEI, or bike frame number to a listing, we store it encrypted. Only a partial (masked) version is shown publicly unless the seller chooses to show it in full; IMEI numbers are always masked. It is optional, and helps buyers and sellers match the exact item and resolve disputes.

3. How we use your information

We use your personal data to:

• Provide and operate the Platform, including processing transactions, facilitating communication between buyers and sellers, and arranging delivery.
• Protect the safety and security of our users, including fraud detection and content moderation.
• Process payments through Stripe Connect and manage SilentCover protection.
• Verify your identity when required (e.g. for payouts or dispute resolution).
• Send you transactional notifications (order updates, shipping alerts, dispute outcomes) by email and, where enabled, push notification.
• Store your phone number when you choose to add one, without using it as an OTP approval channel.
• Operate SilentGuardian, our in-app assistant, to help with listings, orders, disputes, and safety guidance.
• Send you marketing communications (only with your explicit consent, and you can unsubscribe at any time).
• Manage the SilentPoints rewards programme.
• Improve the Platform through analytics and usage patterns (anonymised where possible).
• Develop and improve the automated systems and machine-learning models that power the Platform (such as search, recommendations, AI listing assistance, fraud detection, and content moderation), including using listing photos, videos, titles, and descriptions. We minimise the personal data used for these purposes wherever possible.
• Feature public listing content in SilentSale marketing. You can opt out at any time in your privacy settings or by contacting support (see Terms, Section 11A).
• Comply with legal obligations, including tax reporting and law enforcement requests.

4. Legal basis for processing

We process your data on the following legal bases under the UK GDPR:

• Contract (Article 6(1)(b)) — Processing necessary to provide you with the Platform services, process transactions, and manage your account.
• Legitimate interests (Article 6(1)(f)) — Fraud prevention, platform security, chat safety monitoring, fair listing rotation, improving our services, developing and improving the automated and machine-learning systems that power the Platform, and internal analytics. We balance our interests against your rights and freedoms.
• Consent (Article 6(1)(a)) — Marketing communications, non-essential cookies, and optional phone verification. You can withdraw consent at any time.
• Legal obligation (Article 6(1)(c)) — Tax reporting, responding to lawful requests from authorities, and retaining records as required by law.
• Biometric data (Article 9(2)(a)) — Explicit consent when you choose identity verification that uses facial imagery or similar biometric checks. You may decline, but some features (such as payouts) may be unavailable until verification is completed another way.

5. Who we share your data with

We share your data only with the following categories of recipients, and only to the extent necessary:

• Other users: Your public profile (display name, profile photo, badges, listing history) is visible to other Platform users. We never share your email, phone number, or address with other users.
• Stripe: Payment processing, identity verification, and seller payouts. Stripe is an FCA-regulated payment processor.
• Shipping carriers: Name, address, and contact details necessary to deliver items (Royal Mail, Evri, DPD, InPost).
• Cloud providers: Microsoft Azure (hosting, CDN, storage, push notification routing via Azure Notification Hub) and Sentry (error tracking). Data is primarily processed within the UK/EEA.
• Law enforcement: We may disclose data in response to lawful requests, court orders, or where necessary to protect the safety of our users.

We do not sell your personal data to third parties. We do not share your data with advertisers.

6. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

Account data: retained for the duration of your account plus 6 years after account closure (to comply with HMRC and legal obligations).

Transaction records: retained for 6 years from the date of the transaction.

Chat messages: retained under our four-tier schedule — (1) chats linked to an active dispute are held until resolution and may be kept for up to 6 years for legal and audit purposes; (2) transaction-linked chats (orders or offers) are retained for 6 years from the last message; (3) listing enquiries with no completed transaction are retained for 2 years; (4) abandoned chats with no listing, offer, or order are retained for 2 years. Soft-deleted messages may remain accessible to Trust & Safety where legally required.

Dispute evidence (including video): retained for up to 12 months after dispute closure, then deleted unless a longer period is required by law or an open investigation.

Proximity and location pings: precise meetup or proximity signals used for PIN Pickup safety are purged after 7 days.

Device fingerprint and fraud signals: retained for up to 2 years for fraud prevention, then deleted or anonymised.

SilentGuardian conversations: retained for up to 12 months for quality and safety review, then deleted or anonymised.

Push notification tokens: retained while your account is active and notifications are enabled; deleted on logout or account closure.

Marketing consent records: retained for as long as consent is active, plus 2 years after withdrawal.

7. Your rights

Under the UK GDPR, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your data (subject to legal retention requirements).
• Right to restriction — Request that we limit how we use your data.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — Withdraw consent at any time where processing is based on consent.
• Rights related to automated decisions (Article 22) — Where we use automated processing that significantly affects you (such as fraud holds, listing visibility, or account restrictions), you may request human review. Contact privacy@silentsale.co.uk or use the in-app appeal path where shown.

To exercise any of these rights, or to make a complaint about how we handle your data, please contact us at privacy@silentsale.co.uk. We will acknowledge complaints within 30 days and respond to rights requests within one month. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Automated decision-making

We use automated systems to keep the Platform safe and fair. These may include fraud and abuse detection, chat safety filtering, fair listing rotation, dispute deadline handling, and automatic feedback where users do not leave a review within the permitted window.

• Automated decisions may affect listing visibility, transaction holds, account restrictions, or dispute outcomes within the rules shown in our Terms & Conditions.
• SilentGuardian uses automated assistance to answer questions; conversations may be reviewed by humans for safety and quality.
• You are not generally subject to decisions based solely on automated processing without meaningful human involvement where UK GDPR Article 22 requires it. You may request review of significant automated outcomes via privacy@silentsale.co.uk or the in-app appeal route.

9. Cookies

We use cookies and similar technologies to provide, protect, and improve the Platform. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

10. International transfers

Your data is primarily stored and processed within the United Kingdom and European Economic Area.

Where we use third-party service providers that process data outside the UK/EEA (such as Stripe for payment processing and Sentry for error tracking), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the Information Commissioner’s Office (ICO).

11. Children’s privacy

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a child under 18, we will take steps to delete that data promptly.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (TLS), secure payment processing via Stripe, and access controls on our systems.

While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, as required by the UK GDPR. If the breach is likely to result in a high risk to you, we will also tell you directly without undue delay, explaining what happened and what we are doing about it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on the Platform and, where appropriate, by sending you a notification.

We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email

privacy@silentsale.co.uk

Data protection

privacy@silentsale.co.uk (privacy and data-protection enquiries)

Post

SilentSale Ltd, 3rd Floor, 86-90 Paul Street, London EC2A 4NE

ICO

ico.org.uk