Privacy Policy

1. Who We Are

Pokebay Ltd ("Pokebay", "we", "us", "our") is the data controller responsible for your personal data. We are registered in England and Wales.

Our Data Protection Officer can be contacted via our contact form

2. Data We Collect

2.1 Information You Provide

• –Account data: name, email address, username, password (hashed)
• –Profile data: display name, location (town/city), profile photo, bio
• –Seller data: postcode, shipping address, bank account details (processed by Stripe)
• –Listing data: card descriptions, photos, pricing
• –Communications: messages sent through our platform, support requests
• –Identity verification: government-issued ID for seller verification (processed by our KYC partner)

2.2 Information Collected Automatically

• –IP address and approximate location
• –Browser type, device type, and operating system
• –Pages visited, time spent, and click patterns
• –Transaction history and search queries
• –Cookies and similar tracking technologies (see Section 8)

2.3 Information from Third Parties

• –Payment data from Stripe (we receive tokenised references, not full card numbers)
• –Delivery and tracking data from Royal Mail
• –Authentication data if you sign in via Google OAuth

3. How We Use Your Data

4. Legal Basis for Processing

Under UK GDPR, we process your data on the following legal bases:

• –Contract performance: processing necessary to complete your purchases and manage your account
• –Legitimate interests: fraud prevention, platform security, analytics to improve our service
• –Legal obligation: compliance with financial regulations, tax law, and law enforcement requests
• –Consent: marketing emails and non-essential cookies (you can withdraw consent at any time)

5. Sharing Your Data

We share personal data only where necessary:

• –Between buyers and sellers: shipping name and address are shared with the seller to fulfil your order
• –Payment processors: Stripe processes payment data under its own privacy policy
• –Royal Mail: name, address, and parcel details for label generation and tracking
• –Identity verification: our KYC provider verifies seller identity documents
• –Hosting & performance: Vercel hosts the site and, if you accept analytics cookies, records anonymous page-speed timings via Speed Insights — no cookies, and nothing that identifies you
• –Legal authorities: where required by court order, regulation, or law enforcement request
• –Business transfers: in the event of a merger or acquisition, data may transfer to the new entity

We do not sell your personal data to third parties for marketing purposes.

6. Data Retention

7. Your Rights

Under UK GDPR you have the right to:

• –Access: request a copy of the personal data we hold about you
• –Rectification: ask us to correct inaccurate or incomplete data
• –Erasure: request deletion of your data ("right to be forgotten"), subject to legal retention obligations
• –Restriction: ask us to restrict processing of your data in certain circumstances
• –Portability: receive your data in a structured, machine-readable format
• –Objection: object to processing based on legitimate interests or for direct marketing
• –Withdraw consent: at any time, for processing based on consent (this does not affect past processing)

To exercise any of these rights, use our contact form. We will respond within 30 days. We may need to verify your identity before processing your request.

8. Cookies

We use cookies and similar technologies on Pokebay. Essential cookies are required for the platform to function. Analytics and marketing cookies are only used with your consent. Please see our Cookie Policy for full details.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), hashed passwords, access controls, and regular security reviews.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.

10. International Transfers

Some of our service providers (including Stripe, Vercel, Anthropic and OpenAI) may process data outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, such as UK adequacy decisions or UK International Data Transfer Agreements (IDTAs).

11. Children's Privacy

Pokebay is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data without parental consent, please contact us and we will delete it promptly.

Users aged 13–15 may use Pokebay only with verifiable parental or guardian consent.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email and/or a prominent notice on our platform before changes take effect.

13. Contact & Complaints

For privacy queries or to exercise your rights, please use our contact form.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):