Retale Privacy Policy
Version 1.2 — Effective 14 October 2026
This policy explains what personal information Retale Marketplace Limited (“Retale”, “we”, “us”) collects when you use Retale, what we do with it, who we share it with, how long we keep it, and your rights. We’ve tried to make it specific to what Retale actually does, rather than a template.
1. Who we are
Retale Marketplace Limited (company number 17415308, 47 Peplins Way, Kings Norton, Birmingham, B30 3NJ) is the controller of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact us about privacy at admin@retalebooks.co.uk.
2. What we collect
Information you give us
- Account: your email address, username, password (stored only in a scrambled, one-way form), and confirmation that you’re 18 or over and accepted our Terms.
- Profile (optional): photo, bio, general location (such as a town), favourite genres, books you recommend and what you’re reading.
- Address and phone: your delivery address, and the address you post from if you sell. A phone number, because couriers need one for labels and some send collection codes by text.
- Selling and tax details: your seller status; for Business and Charity Sellers, legal name, company or charity number, registered address, VAT number and the name and email of an authorised person; and, when tax reporting applies, your legal name, date of birth, National Insurance number or other tax number, and country of tax residence.
- Listings: the Books you list, their condition, notes, price and photos.
- Buying and selling: orders, offers, book requests, saved books and your basket.
- Messages you send to other members through Retale, and anything you send us.
- Problems and returns: what you report, the photos you add, and how it was resolved.
- Reviews of other members, and reports you make about Content.
- Bookshelf: Books you add, rate or mark as read, reading or want to read, with your ratings, moods, pace, notes, reviews and dates. If you upload a Goodreads or StoryGraph export, we read it to fill your bookshelf, don’t keep the file, and keep an identifier for each Book so a later upload doesn’t add Books twice.
- Settings: delivery options, holiday mode and whether you want personalised recommendations.
Information we create or receive
- Location: when you give a postcode (your own, or one you search near), we look up its approximate map position. We use it to show distances between members for collection. Other members only ever see a distance rounded to about 1 km, never your address.
- Payments and payouts from Stripe: whether a payment succeeded, refunds, chargebacks, whether your payout account is verified and able to receive money, and anything Stripe needs from you. We never see full card or bank details.
- Delivery from Sendcloud and the couriers: label details, tracking numbers and tracking updates.
- From other members: messages, reviews and reports about you.
- Technical information: our servers log requests, including IP addresses, to keep Retale working and secure.
You don’t have to give us optional profile or bookshelf information. Some information is needed to use Retale: without an email address you can’t have an Account, without an address you can’t receive a Book by post, and without the details Stripe and HMRC require, a Seller can’t be paid.
Barcode scanning uses your camera inside your browser: the picture isn’t sent to us, only the ISBN it reads. Photos you upload are resized in your browser first, which in almost all browsers also removes hidden details, such as where the photo was taken.
3. What we use it for, and our lawful basis
The law says we must have a lawful basis for each use. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your Account, show your profile and Listings, and let you buy, sell, make offers and message other members | Contract: it’s needed to provide Retale to you |
| Take payments, hold and send Sellers’ earnings, make refunds | Contract |
| Buy postage labels and track parcels | Contract |
| Buyer Protection, problems, returns and disputes | Contract, and our legitimate interest in resolving disputes fairly |
| Send emails about your Account, orders, messages and book requests | Contract |
| Your bookshelf, and showing your reading ratings if you choose to | Contract |
| Personalised recommendations on the home page (section 9) | Legitimate interests: showing you Books you’re likely to want. You can turn them off |
| Preventing fraud and abuse, keeping Retale secure, and acting on reports | Legitimate interests, and our legal duties under the Online Safety Act 2023 |
| Reporting Sellers to HMRC, and keeping tax and accounting records | Legal obligation |
| Responding to the police, courts and regulators | Legal obligation, or legitimate interests where disclosure is allowed but not required |
| Improving Retale, for example working out which features are used | Legitimate interests |
| Dealing with legal claims | Legitimate interests |
Where we rely on legitimate interests, we’ve weighed them against your rights, and you can object (section 10). We don’t use your information for anything incompatible with these purposes without telling you first.
4. What other people can see
- Anyone can see your username, profile photo, bio, general location, when you joined, whether your email is verified, your favourite genres and recommended Books, your Books for sale, how many Books you’ve sold and bought, reviews of you (with the reviewer’s username), and any reading ratings you’ve chosen to show.
- On a Listing offering collection, other members see roughly how far away it is (rounded to about 1 km), never your address.
- When you buy a Book to be posted, the Seller sees your name and delivery address, because they’re on the label. The Buyer sees the Seller’s posting address on the parcel.
- Business and Charity Sellers’ legal name, geographic address and email are shown to Buyers, as consumer law requires.
- The members you message see what you send them.
5. Who we share it with
We use these companies to run Retale. They only use your information to provide their service to us, or, where marked, also under their own privacy policies:
| Who | What for | What they get |
|---|---|---|
| Stripe | Payments, refunds, Seller payout accounts and identity checks. Stripe is also a controller for its own checks, such as fraud screening and verifying Sellers | Payment and order details; for Sellers, the details needed to set up and verify a payout account |
| Sendcloud | Postage labels and tracking | Names, addresses and phone numbers of the sender and recipient, and parcel details |
| Couriers (Royal Mail, Evri and InPost) | Delivering parcels, under their own privacy policies | What’s on the label, and the recipient’s phone number where the courier texts collection codes |
| Resend | Sending our emails | Your email address and the email |
| Cloudflare | Storing and serving photos | Photos you upload |
| Vercel | Hosting the website you use | Your IP address and browser details when you visit, and what you send through the site on its way to our servers |
| Railway | Hosting our servers and database | Everything we hold is stored there |
| postcodes.io | Turning a postcode into an approximate map position | Only the postcode |
| Open Library and Google Books | Book details and covers | Only ISBNs and search words, sent from our servers without your details |
| HMRC | Digital platform reporting (section 13 of the Terms) | For Sellers over the reporting thresholds: tax details and sales totals |
| Professional advisers | Legal, accounting and insurance advice | What’s needed for the advice |
| Police, courts and regulators | Where the law requires or allows it | What’s requested and lawful to share |
If Retale is sold or merged, your information may pass to the new owner, who must keep protecting it as this policy describes. We never sell your information or share it for advertising.
6. Information sent outside the UK
Some of these providers, including Stripe, Resend, Cloudflare, Vercel and Railway, store or process information in the United States or elsewhere outside the UK. When that happens, we rely on the UK government’s adequacy regulations (including the UK–US data bridge, for providers certified to it), or on the ICO’s International Data Transfer Agreement or Addendum, so your information keeps the same level of protection.
7. How long we keep it
We keep personal information only as long as we need it. The periods below are applied automatically: when one ends, the information is deleted, or anonymised so it no longer identifies you.
| Information | How long we keep it | Why |
|---|---|---|
| Account details (email, username, password), profile, address, phone and location | While your Account is open. Deleted when you close it. | To run your Account and send or receive Books |
| Which version of our Terms you agreed to, and when | While your Account is open, and 7 years after it’s closed | To show what you agreed to, if there’s ever a dispute |
| Bookshelf, reading lists, ratings and reviews of Books, saved Books and basket | While your Account is open. Deleted when you close it. | To show your shelf and recommend Books |
| Orders and payments (what was bought, prices, fees, postage, refunds and payouts) | The delivery name, address and phone on an order, and its collection code: 7 years after the order finished (6 years after the end of the financial year it was in). The amounts themselves are kept, no longer linked to you once your Account is closed. | Tax and accounting law |
| Seller tax details collected for HMRC reporting, and the copy of each year’s report we sent you | While your Account is open, and 7 years after it’s closed | HMRC record-keeping rules |
| Buyer Protection claims, returns and disputes, with their photos | 7 years after the claim is resolved | To deal with any legal claim, which can be brought for up to 6 years |
| Messages between members | 2 years after the last message in the conversation, or longer if an order it’s about had a dispute in the last 6 years. If you close your Account, the other person keeps the conversation until then. | To help settle any problem with an order |
| Listings and their photos | When a Book sells, its back, spine and extra photos are deleted once the order is complete; the front photo 120 days later. A Listing taken down without selling: its photos are deleted straight away, its notes 12 months later. | To deal with any problem or card chargeback on the sale |
| Offers | 2 years after the offer was answered or expired (the price of a sale is kept with its order) | To deal with any question about a sale |
| Reviews you’ve written about other members | Kept when you close your Account, shown as from a “Deleted user” | Removing them would unfairly change other members’ ratings |
| Book requests | 12 months after they ended | To show your past requests |
| Reports about Content, and what we did about them | 2 years after we close the report | To keep Retale safe and handle appeals |
| Suspensions and the reasons for them | As long as there’s a reason to keep someone off Retale. We review them, and remove any no longer needed. | To keep Retale safe |
| Sign-in sessions and password-reset links | Until they expire (sessions after 30 days) or you sign out | To keep your Account secure |
| Server logs, which can include IP addresses | Up to 90 days | To fix problems and spot abuse |
Card and bank details are held by Stripe, and postage labels and tracking by Sendcloud, under their own policies. We may keep information longer than shown above where the law requires it or it’s needed for a legal claim.
8. Closing your Account
You can close your Account yourself at the bottom of your account page, or ask us to by emailing admin@retalebooks.co.uk. Closing it deletes, straight away, what the table above says is deleted when you close your Account; the rest is kept only for the periods shown. You can’t close an Account while an order or return is in progress, or while money is on its way to you.
9. Recommendations and automated decisions
If you’re signed in, we use your bookshelf and purchases to choose which Books to show you first on the home page (for example, “Because you loved” a Book you rated highly). This only affects which Books you see first. It doesn’t affect prices, fees, Buyer Protection or anything else about your Account. You can turn it off on your bookshelf page, and you’ll then see the same home page as everyone else.
Some decisions are made automatically by following fixed rules: an order is cancelled and refunded if it isn’t posted in time, a Seller who cancels two orders within 30 days is suspended while we look into it, and Stripe may decline a payment it judges to be fraudulent. A person at Retale reviews every suspension, and you can ask for any automated decision about you to be looked at by a person, and challenge it, by emailing admin@retalebooks.co.uk.
10. Your rights
You have the right to:
- get a copy of the personal information we hold about you;
- have inaccurate information corrected;
- have your information deleted, where we don’t need to keep it;
- restrict how we use it, or object to our using it on the basis of legitimate interests;
- receive information you gave us in a portable form; and
- challenge automated decisions (section 9).
To use any of these, email admin@retalebooks.co.uk. It’s free. We may need to confirm who you are first. We reply within one month, or tell you within that month if we need up to two more months because a request is complex. Some rights have legal exceptions; if one applies, we’ll explain.
11. Complaints about how we use your information
Please complain to us first, by emailing admin@retalebooks.co.uk with “Privacy complaint” in the subject. We’ll acknowledge your complaint within 30 days (we aim for 5 working days), look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Emails we send
We send emails about your Account and orders, a daily email if you have unread messages, emails about book requests and reports you’ve made, notice of changes to our Terms, and, if you sell enough to be reported to HMRC, a copy of what we reported. These are part of the service, so they aren’t marketing. We don’t send marketing emails. If we ever want to, we’ll ask for your consent first, and you’ll be able to unsubscribe at any time.
13. Cookies and similar technologies
Retale doesn’t use advertising or analytics cookies. We store a few things in your browser to keep you signed in and remember choices you make. Our Cookie Policy lists them all.
14. Security
We protect your information with measures including encrypted connections, scrambled passwords, signed-in sessions that expire, and limiting who at Retale can see what. No service can be completely secure. If a breach put your rights at risk, we’d tell you and the ICO as the law requires.
15. Children
Retale is only for people aged 18 or over, and isn’t designed for or aimed at children. If we find an Account belongs to someone under 18, we close it. If you think a child is using Retale, please tell us at admin@retalebooks.co.uk.
16. Changes to this policy
We update this policy when what we do changes. If a change significantly affects how we use your information, we’ll tell you before it happens.
17. Contact
Retale Marketplace Limited
Company number: 17415308
47 Peplins Way
Kings Norton
Birmingham
B30 3NJ
United Kingdom
Email: admin@retalebooks.co.uk