Privacy Policy
1. Introduction
This Privacy Policy explains how vBuy Ltd (“vBuy”, “we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use the vBuy marketplace platform (“Platform”) at vbuy.io.
We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Data Controller: vBuy Ltd
Contact: privacy@vbuy.io
Last updated: 20 July 2026
2. Data We Collect
2.1 Information You Provide
| Data Category | Examples | When Collected |
|---|---|---|
| Account details | Name, email address, phone number, password | Registration |
| Delivery address | Shipping address(es) | Checkout |
| Payment information | Card details (processed by Stripe — we never see your full card number) | Checkout |
| Communications | Messages to Sellers, refund requests, dispute evidence | Platform use |
2.2 Information We Generate
| Data Category | Examples | Purpose |
|---|---|---|
| v£ wallet data | v£ balance, transaction history, pending rewards | Reward system operation |
| Order history | Products purchased, order totals, Seller details | Order management |
| Internal identifiers | Unique user ID (UUID) | Account identification |
2.3 Information Collected Automatically
| Data Category | Examples | Purpose |
|---|---|---|
| Device & browser data | IP address, browser type, operating system, screen resolution | Security, analytics |
| Usage data | Pages visited, products viewed, time on site | Platform improvement |
| Cookies | Session cookies, preference cookies, analytics cookies | See Section 9 |
3. How We Use Your Data
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Creating and managing your account | Performance of contract (Art. 6(1)(b)) |
| Processing orders and payments | Performance of contract (Art. 6(1)(b)) |
| Operating the v£ reward system | Performance of contract (Art. 6(1)(b)) |
| Communicating order updates and refund status | Performance of contract (Art. 6(1)(b)) |
| Sending marketing emails (only with your opt-in) | Consent (Art. 6(1)(a)) |
| Fraud prevention and platform security | Legitimate interest (Art. 6(1)(f)) |
| Improving the Platform and user experience | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
4. Who We Share Your Data With
We share your personal data only where necessary and with appropriate safeguards:
4.1 Third-Party Sellers
When you place an order, the relevant Seller(s) receive your name, delivery address, and order details to fulfil your purchase. Sellers are independent data controllers for the data they receive. Sellers do not receive your payment details, email address, or v£ wallet information.
4.2 Payment Processors
Stripe processes all card payments. Your payment card details are sent directly to Stripe and are never stored on our servers. Stripe’s privacy policy applies to their processing of your data.
4.3 Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| Google Cloud Platform | Hosting & infrastructure | All Platform data (encrypted at rest) |
| Resend / SendGrid | Transactional email delivery | Email address, name, order references |
4.4 Legal & Regulatory
We may disclose your data to law enforcement, regulators, or courts when required by law or to protect the rights, property, or safety of vBuy, our users, or the public.
5. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Duration of account + 2 years after deletion | Dispute resolution, legal claims |
| Order & transaction data | 7 years from order date | HMRC tax record requirements |
| v£ wallet transactions | 7 years | Financial record keeping |
| Marketing preferences | Until consent is withdrawn | Consent-based |
| Server logs | 90 days | Security monitoring |
6. Your Rights
Under the UK GDPR, you have the following rights:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure — request deletion of your data (subject to legal retention requirements).
- Right to restrict processing — request that we limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at privacy@vbuy.io. We will respond within 30 days.
7. International Transfers
Your data is stored on servers within the United Kingdom and European Economic Area (Google Cloud Platform, europe-west2 region, London). Where any data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS/SSL) and at rest.
- Payment card data handled exclusively by PCI DSS-compliant processors (Stripe).
- Access controls limiting employee access to personal data on a need-to-know basis.
- Regular security reviews and monitoring.
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
9. Cookies
9.1 What Are Cookies?
Cookies are small text files placed on your device when you visit the Platform. They help us provide a better experience and understand how you use the site.
9.2 Cookies We Use
| Cookie Type | Purpose | Duration | Lawful Basis |
|---|---|---|---|
| Essential | Session management, login state, shopping cart, CSRF protection | Session / up to 2 weeks | Strictly necessary — no consent required |
| Functional | Remember your preferences (e.g. currency display, recently viewed) | Up to 1 year | Legitimate interest |
| Analytics | Understand how visitors use the Platform (page views, popular products) | Up to 2 years | Consent |
9.3 Third-Party Cookies
Our payment processor (Stripe) may set cookies for fraud detection. These are governed by Stripe’s own cookie policy.
9.4 Managing Cookies
You can control cookies through your browser settings. Most browsers allow you to:
- View and delete individual cookies.
- Block cookies from specific or all websites.
- Set preferences for first-party and third-party cookies.
Please note that disabling essential cookies may prevent you from using core features of the Platform, such as your shopping cart and checkout.
10. Children’s Data
The Platform is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If we discover that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@vbuy.io.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Platform. The “Last updated” date at the top of this policy indicates when it was last revised.
12. Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
13. Contact Us
For any privacy-related queries:
- Email: privacy@vbuy.io
- Website: vbuy.io/contact