Privacy Policy

1. Who We Are

Collekt ("we", "our", "us") is an online marketplace for buying and selling trading cards, operated in the United Kingdom. Our website is accessible at collekt.co.uk.

If you have any questions about this Privacy Policy or how we handle your data, please visit our Contact Us page.

2. What Information We Collect

We collect the following categories of personal data:

• Account information: name, email address, and any profile details you provide when registering.
• Vendor information: business name, business type, VAT status, website, and social media links if you apply to become a seller.
• Order & transaction data: items purchased, prices, order status, and shipping address.
• Payment data: payment is processed by Stripe. We do not store your full card details. We receive only a tokenised reference and basic transaction metadata.
• Usage data: pages visited, search queries, clicks, and device/browser information collected via standard server logs and analytics.
• Communications: any messages you send us via contact forms or email.

3. How We Use Your Information

We use your personal data for the following purposes:

• To create and manage your account.
• To process orders and facilitate payments between buyers and sellers.
• To send order confirmations, shipping updates, and service notifications.
• To review and approve vendor applications.
• To prevent fraud and ensure the security of our platform.
• To improve our website and understand how users interact with it.
• To comply with our legal obligations.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

• Contract performance: processing is necessary to fulfil orders and provide the marketplace service.
• Legitimate interests: improving our platform, preventing fraud, and keeping users informed about service changes.
• Legal obligation: complying with applicable laws, including tax and financial regulations.
• Consent: where you have explicitly opted in (e.g. marketing emails). You may withdraw consent at any time.

5. Sharing Your Information

We do not sell your personal data. We may share it with:

• Stripe: to process payments securely. Stripe's privacy policy is available at stripe.com/gb/privacy.
• Shipping providers: your name and delivery address are shared with the relevant courier to fulfil your order.
• Vendors: sellers receive your shipping name and address solely for order fulfilment purposes.
• Service providers: we use third-party infrastructure and analytics tools that process data on our behalf and are bound by data processing agreements.
• Law enforcement / regulators: where required by law or to protect the rights and safety of users.

6. Cookies

We use cookies and similar technologies to keep you logged in, remember your cart, and understand how our site is used. Essential cookies are required for the site to function. Analytics cookies help us improve the experience. You can manage cookies through your browser settings.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Order and transaction records are retained for at least 6 years to meet our legal and tax obligations. You may request deletion of your account at any time (see Section 9), subject to any overriding legal requirements.

8. International Transfers

Our services may involve transferring your data outside the UK or EEA (for example, to cloud infrastructure providers). Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR, such as standard contractual clauses or adequacy decisions.

9. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal obligations.
• Restrict processing of your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please visit our Contact Us page. We will respond within 30 days.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is handled entirely by Stripe, which is PCI DSS certified. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

Collekt is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by posting a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please visit our Contact Us page. We will respond within 30 days.