Your privacy at Loota

This notice explains what personal information we collect when you sell an item to us or use our site, why we use it, who we share it with, and the rights you have. We keep it in plain English.

Draft for review — to be finalised before launch. Anything in [brackets] is a placeholder to confirm.

1. Who we are

Your information is controlled by Loota, a trading name of TwinPine Digital ("Loota", "we", "us"), a sole trader based in England. We are the "data controller" for the personal information described here. You can contact us any time about your data by email at [email protected].

2. What we collect

Depending on how you use Loota, we collect:

· Contact details — your name, email address and postcode, so we can quote, correspond with you and arrange postage.

· Device & item details — the model, specification and condition of the item you want to sell, and its IMEI or serial number where relevant.

· Bank details — the account name, sort code and account number you give us, used only to pay you for an accepted item. These are stored encrypted.

· Submission photos — any photos you upload of your item, used to assess and verify it. To name the model we may read any label in the photo and check the photo against an outside image search (Google Lens, through a search provider) for a few minutes; the photo is not kept by them and carries nothing about you.

· Account & order data — if you create an account or buy from our shop, your login and order history (handled through our shop provider).

· Technical data — basic information your browser sends (such as your IP address) needed to serve the site securely.

3. Why we use it, and our lawful basis

We only use your information for clear purposes, each with a lawful basis under UK GDPR:

· To provide the trade-in service — quoting, arranging postage, inspecting your item and paying you. Lawful basis: performance of a contract with you.

· To run our shop and account features — processing orders and managing your account. Lawful basis: contract.

· To keep the service secure, prevent fraud and improve it — including checking an item's IMEI or serial number against stolen/blacklist databases. Lawful basis: our legitimate interests in operating a safe, honest service.

· To meet legal duties around stolen goods — retaining and, where required, reporting an item reported lost, stolen or blacklisted, and cooperating with the police and Royal Mail. Lawful basis: legal obligation and legitimate interests.

4. Who we share it with

We don't sell your data. We share it only with the providers we need to run the service:

· an IMEI / stolen-goods check provider, to verify an item isn't lost, stolen or blacklisted;

· Royal Mail (and any courier we use), to arrange prepaid postage and returns;

· our payment and bank-transfer arrangements, to pay you and (for shop purchases) to take payment;

· our email and hosting providers, who process data on our behalf under contract.

We may also disclose information where the law requires it — for example to the police in relation to stolen goods.

5. How long we keep it

We keep personal information only as long as we need it. In particular:

· Bank details and submission photos are deleted after your case is settled — our system automatically purges them once a case is closed (a 90-day default from settlement).

· Basic transaction records (such as what we bought and paid) are kept longer where we need them for accounting, tax and to handle any dispute.

6. Where your data is held

Your data is stored on secure servers within the UK or European Economic Area. If any provider we use processes data outside the UK/EEA, we make sure appropriate safeguards are in place as required by UK data protection law.

7. Your rights

Under UK data protection law you have the right to access the personal data we hold about you, to ask us to correct it if it's wrong, to ask us to delete it, and to object to or restrict certain uses. To exercise any of these, email [email protected] and we'll respond within the time the law allows (normally one month).

8. Cookies

We use only the cookies and local storage needed to make the site work and to keep you signed in — we don't use advertising or third-party tracking cookies. If that changes, we'll update this notice and ask for your consent where required.

9. Complaints

If you're unhappy with how we've handled your data, please tell us first at [email protected] so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

10. Changes to this notice

We may update this policy from time to time. The current version is shown at the top of this page. Material changes will be highlighted on the site.

See also our Terms & Conditions. Loota — a trading name of TwinPine Digital · UK · Version v1-2026-07-01.