GB Goods Privacy Policy

1. About this policy

The marketplace owner must confirm the controller identity, actual processing activities, and applicable legal requirements.

Controller identity and address: [Owner to provide the responsible legal entity name and address.]

2. Information that may be processed

Depending on how the marketplace is operated, information may include:

• Personal details, such as name and date of birth where requested.
• Contact details, including email address and telephone number.
• Residential, delivery, billing, or business addresses and related business details.
• Account information, credentials and security data, preferences, support communications, and account activity.
• Seller application information, store details, product listings, and application-review records.
• Identity-verification information or documents, if the approved application process requests them.
• Transaction, device, log, cookie, and analytics information, if those activities are used.

Owner review required: Confirm which categories are actually collected, whether special-category or criminal-offence data is ever processed, and whether identity documents are collected and how they are protected.

3. Purposes and lawful bases

Information may be used to consider seller applications, verify information, create and secure accounts, operate seller services, support orders and customer service, prevent fraud and misuse, maintain records, and meet applicable legal obligations.

Owner/legal review required: Map each actual purpose to its applicable lawful basis and any additional conditions required by relevant data-protection law. No lawful basis is asserted or assigned in this policy.

• Application review and seller onboarding: [Confirm purpose and lawful basis.]
• Account operation and seller services: [Confirm purpose and lawful basis.]
• Fraud prevention and account security: [Confirm purpose and lawful basis.]
• Legal and regulatory obligations: [Identify applicable obligations and lawful basis.]
• Marketing or optional analytics: [Confirm whether used and lawful basis/consent approach.]

4. Application review, fraud prevention, and operations

Application and account information may be reviewed to assess applications, verify seller-provided details, protect accounts, investigate suspected fraud or policy violations, and operate marketplace services. The owner must confirm which checks are used, whether any decisions are automated, and the safeguards and review process that apply.

5. Service providers and other recipients

Information may be shared only as needed with service providers supporting marketplace functions, with relevant sellers or customers to complete marketplace interactions, with professional advisers, or with authorities where required or permitted by law.

Owner review required: Identify each actual recipient or recipient category, the purpose for sharing, the applicable safeguards, and any disclosures to sellers, customers, payment providers, hosting providers, identity-check services, or analytics providers. No specific provider is identified or endorsed by this policy.

6. Data retention and deletion

Information should be kept only for an approved period tied to its purpose and applicable obligations, and then securely deleted or anonymised where appropriate.

• Unsuccessful seller applications: [Owner to approve retention period.]
• Identity-verification information: [Owner to approve retention period and deletion method.]
• Seller account and transaction records: [Owner to approve retention period.]
• Support, security, and audit records: [Owner to approve retention period.]
• Backups and archived records: [Owner to approve deletion schedule.]

No retention period is specified.

7. Security and incident handling

The owner should document the technical and organisational measures actually used to protect personal information, access to accounts, and any sensitive verification material. The owner must also establish how suspected personal-data incidents are assessed, contained, recorded, and communicated where required.

Owner review required: Confirm implemented security controls, responsible incident contacts, response procedures, and notification obligations. This policy does not certify any security control or make a notification-time commitment.

8. Privacy rights and requests

Depending on applicable law and the circumstances, individuals may have rights concerning access, correction, deletion, restriction, objection, portability, or consent withdrawal, and may be able to complain to a supervisory authority.

Requests should be sent to [Owner to provide an approved privacy contact.] The owner must confirm the applicable rights, identity-check process, response procedure, and any jurisdiction-specific requirements before this section is approved.

9. International data transfers

Information may be processed in other countries if the marketplace or its service providers operate there. Owner/legal review required: Identify actual transfer locations and confirm whether transfers occur, the applicable transfer mechanism, and any required safeguards and disclosures.

10. Cookies and analytics

The marketplace owner must confirm which cookies, local storage, and analytics technologies are used, why they are used, how consent or preferences are managed, and how a user can change those choices. No non-essential analytics use or cookie consent approach is confirmed here.

11. Changes to this notice

The approved policy should describe how material changes will be communicated and when an updated version applies. The owner must review the change process and versioning before publication.

12. Privacy contact

Privacy contact: [Owner to provide an approved privacy email address or other contact route.] No privacy email address is specified here.

Responsible entity and postal address: [Owner to provide details.]

Document status

Version GBG-PRIVACY-POLICY-0.1. Effective date: to be confirmed.