1.1 This Privacy Policy explains how Clepto ("Clepto," "we," "us," or "our") collects, uses, stores, and shares personal data when you visit or use clepto.co.uk (the "Platform"), including when you register an account, list an item for sale, make a purchase, or otherwise interact with our marketplace.
1.2 For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Clepto is the data controller of the personal data described in this policy.
1.3 This policy should be read alongside our Terms & Conditions and Cookie Policy, which together govern your use of the Platform.
We collect the following categories of personal data:
Account data — name, email address, password (stored encrypted), username, profile photo, and account preferences provided when you register.
Listing and transaction data — item descriptions, photographs, prices, sale and purchase history, messages exchanged between Buyers and Sellers, and delivery/shipping addresses.
Payment-related data — limited billing information such as transaction references and payment status. We do not directly collect or store full card numbers or bank account details — these are handled by our third-party payment providers (see Section 5).
Technical and usage data — IP address, browser type and version, device identifiers, operating system, referring URL, pages viewed, time spent on pages, and general navigation patterns, collected automatically via cookies and similar technologies.
Location data — approximate location inferred from your IP address or delivery address, used for shipping estimates and fraud prevention.
Communications data — records of correspondence if you contact our support team, including complaint or dispute details.
Marketing preferences — your choices regarding newsletters, push notifications, and promotional communications.
We only rely on consent where required (for example, non-essential cookies and marketing emails), and you may withdraw consent at any time as described in Section 8.
4.1 We use Google Analytics and Firebase (both operated by Google LLC / Google Ireland Limited) to understand how visitors use the Platform. These tools collect data such as pages visited, session duration, device type, approximate location, and interaction events (for example, viewing a listing or completing checkout).
4.2 This data is pseudonymised and used in aggregate to help us improve site performance, identify technical issues, and understand which features are most used. Google Analytics and Firebase may set cookies or use device identifiers to distinguish unique users across sessions.
4.3 Data processed through these tools is subject to Google's own privacy practices, available at Google's Privacy Policy and How Google uses data when you use our partners' sites or apps.
4.4 You can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on, or by declining analytics cookies via our cookie consent banner.
5.1 We display advertisements through Google AdSense and may work with other third-party advertising networks. These networks use cookies and similar technologies to serve ads that may be based on your visits to this and other websites, and to measure ad performance.
5.2 Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and other sites on the internet.
5.3 We do not control the content of advertisements served by these networks and are not responsible for the privacy practices of third-party advertisers.
5.4 You may opt out of personalised advertising by visiting Google Ads Settings, or by using the opt-out tools available at www.aboutads.info for participating vendors generally.
6.1 When you make or receive a payment through the Platform, your payment details are collected and processed directly by our third-party payment provider(s), not by Clepto. We only receive limited data necessary to confirm that a transaction has taken place (such as a transaction ID, amount, and status).
6.2 Our payment providers act as independent data controllers for the payment data they process, and their own privacy policies govern how that data is handled. We encourage you to review the privacy policy of the relevant payment provider used at checkout.
6.3 As set out in our Terms & Conditions, Clepto is not responsible for money transferred between Users or for disputes relating to payments, refunds, or chargebacks, which are matters between the Buyer, the Seller, and the relevant payment provider.
We may share personal data with:
Other Users — a Seller's public profile, listings, and (once a sale is agreed) limited contact and delivery information are shared with the relevant Buyer, and vice versa, strictly to facilitate the transaction.
Payment providers — to process transactions, as described in Section 6.
Analytics and advertising providers — Google (Analytics, Firebase, AdSense) and other ad partners, as described in Sections 4 and 5.
IT, hosting, and technical service providers — companies that host our servers, provide customer support tools, or help secure the Platform, acting on our instructions as data processors.
Professional advisors and regulators — where necessary for legal, accounting, or compliance purposes.
Law enforcement or courts — where required by law, to prevent fraud, or to protect the rights and safety of Clepto or our Users.
We do not sell your personal data to third parties for their own independent marketing purposes.
Under UK GDPR, you have the right to:
be informed about how your personal data is used (this policy);
access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your data ("right to be forgotten"), subject to certain exceptions (for example, records we must keep for tax purposes);
restrict or object to certain processing, including direct marketing;
receive your data in a portable format; and
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or via ico.org.uk, if you believe we have not handled your data properly.
To exercise any of these rights, contact us using the details in Section 12. We will respond within one month, as required by law.
9.1 We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including:
account and transaction data, for the duration of your account plus a period afterward to meet tax, accounting, and dispute-resolution obligations (typically up to 6 years, in line with UK statutory record-keeping requirements);
analytics data, in line with the retention settings configured in Google Analytics and Firebase (data is periodically aggregated or deleted); and
marketing preference data, until you withdraw consent or close your account.
9.2 When data is no longer needed, we securely delete or anonymise it.
10.1 Some of our third-party providers, including Google, may process data on servers located outside the UK, including in the United States or the European Economic Area.
10.2 Where this occurs, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Addendum, EU Standard Contractual Clauses, or reliance on an adequacy decision, to ensure your data receives a level of protection equivalent to that under UK GDPR.
11.1 We use cookies and similar technologies for essential site functionality, analytics (Google Analytics, Firebase), and advertising (Google AdSense and partners).
11.2 Where cookies are not strictly necessary for the Platform to function, we will ask for your consent before setting them, in compliance with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR. You can manage your preferences at any time through our cookie settings tool or your browser.
11.3 Further detail on the specific cookies used, their purpose, and their duration is available in our separate Cookie Policy.
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the third-party services we use. We will post the revised version on this page with an updated "Last updated" date, and where changes are material, we will take reasonable steps to notify you.
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us via the contact details provided on the Platform at clepto.co.uk.