How we handle your data

When you create an account or place an offer/listing, we collect:

• Identity: business name, your name, email address, business address, phone (optional), VAT number (if VAT-registered).
• Account: account type (buyer / seller / both), business type, password hash (we never see your plain-text password), referral source.
• Listings & offers: product titles, descriptions, photos, prices, location, any documents you upload to support a listing.
• Transactions: orders, invoices, offer history, voucher use, payout records.
• Payment routing: for sellers, we store your Stripe Connect account ID only — full bank details live with Stripe, not with us.
• Technical: IP address, browser, basic page-view analytics, anti-fraud signals (device fingerprint, login times).
• Communications: emails you send us, support tickets, opt-in records for marketing.

We do not collect special-category data (race, religion, biometrics, health, etc.) and do not knowingly store payment card numbers — those go directly to Stripe via their hosted checkout.

This is the part most marketplaces get wrong. We don't.

• Before a payment clears — sellers see only the buyer's account label (e.g. “Verified buyer in Manchester”); buyers see only the seller's listing title and city. No emails, no phone numbers, no addresses.
• The moment payment clears — the buyer's shipping address, name and email are released to the seller (so they can despatch); the seller's name, business address and contact email are released to the buyer (so they can chase the order). Both are still bound by our terms not to use the data for unsolicited marketing outside of the order.
• Quick Offers — when you submit a Quick Offer, your business contact details are visible to the StockMarketplace admin team only. We do not pass them on to other sellers; we may use them ourselves to make a direct buy-out offer.
• Disputes & refunds — if a transaction is disputed or refunded, we may share both parties' details with each other and with Stripe to resolve the case.

By creating an account on StockMarketplace.co.uk you agree that The Wholesale Buyer Ltd may contact you by email and (where you've provided it) phone or SMS about:

• Activity on the platform you're directly involved in (offers, invoices, payouts, dispute updates) — these are transactional and you cannot opt out while you have an active account.
• Product updates, new features, marketplace digests and curated stock alerts that match your declared interests — these are marketing and you can opt out at any time via the unsubscribe link in every email or by emailing info@stockmarketplace.co.uk.
• Offers and content from StockMarketplace.co.uk and sister websites operated by The Wholesale Buyer Ltd (such as wholesale buy-out services, end-of-line stock buy-outs, surplus stock newsletters and trade-only events). Same opt-out applies — one click in any email, you're out.

We do not sell, rent or pass your data to unrelated third-party advertisers. Your contact details stay within The Wholesale Buyer Ltd group of services.

To run the marketplace we use a small number of trusted processors. Each holds data on our behalf under a written contract that meets UK GDPR Article 28 standards:

We may also disclose information when legally required to (court order, fraud prevention, or to protect the rights and safety of users).

• Contract (UK GDPR Art. 6(1)(b)) — listing, buying, selling, paying, generating invoices, releasing payouts.
• Legitimate interest (Art. 6(1)(f)) — anti-fraud, abuse detection, basic site analytics, transactional emails, and B2B marketing to existing trade-account holders (PECR “soft opt-in” to similar services).
• Consent (Art. 6(1)(a)) — non-essential cookies, marketing to non-customers, and where you've actively opted in to specific newsletters.
• Legal obligation (Art. 6(1)(c)) — keeping records of sales, VAT and customer due-diligence as required by HMRC and money-laundering regulations.

• Active account data: for as long as your account is open + 12 months after closure (in case you reopen).
• Sales & invoice records: at least 6 years after the transaction (HMRC VAT-record-keeping requirement).
• Marketing opt-out lists: indefinitely (so we don't accidentally re-add you).
• Anti-fraud logs: up to 24 months.
• Server logs: 90 days.

We use a small number of cookies and similar technologies:

• Essential — login session token, basket/offer state. No consent needed; you can't use the site without them.
• Functional — your category filter preferences, dismissed banners. Stored in your browser's localStorage.
• Analytics & performance — basic page-view tracking and error logging. Where third-party tools are used, the relevant consent banner controls them.

You can clear cookies at any time from your browser settings. Doing so will log you out and reset your filter preferences.

You have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectify — correct anything that's wrong, directly from your account or by emailing us.
• Erase — close your account and have personal data deleted, except where we're legally required to keep it (e.g. VAT records).
• Restrict — pause processing while we look into a concern.
• Object — to direct marketing (one click in any email), or to legitimate-interest processing.
• Portability — receive your data in a structured machine-readable format.
• Withdraw consent — at any time, where we've relied on consent.

To exercise any of these rights, email info@stockmarketplace.co.uk. We'll respond within 30 days. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk — though we'd appreciate a chance to put things right first.

Most of our processing happens in the UK and EU. Where data is transferred outside the UK (for example, Stripe's US infrastructure or Cloudflare's global CDN), we rely on Stripe and Cloudflare's own UK-approved Standard Contractual Clauses and supplementary safeguards. We never transfer customer data to a country with no equivalent protection.

StockMarketplace.co.uk is a B2B trade marketplace and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a minor has registered, please email info@stockmarketplace.co.uk and we will close the account.

Data controller: The Wholesale Buyer Ltd
Operating site: StockMarketplace.co.uk
Email: info@stockmarketplace.co.uk

For account, listing or order help: use the same email or the Contact form.