Legal Pack

Privacy Policy

How AYLENSALE LTD collects, uses, and protects personal data under UK GDPR and the Data Protection Act 2018. (EEA market — display draft for Phase 3; solicitor review pending.)

Doc v2026.10.1Pack 2026.10.1EUUpdated 9 Oct 2026
← All documentsSwitch market

Privacy Policy

AYLENSALE LTD ("we") is the data controller for personal data processed through AYLENSALE. This Privacy Policy explains how we handle personal data under UK GDPR and the Data Protection Act 2018.

1. Data we collect

  • Identity and contact data: name, email, phone, business details
  • Account and verification data: login credentials, KYC/AML information where required
  • Transaction data: bids, deposits, refunds, auction outcomes, payment references
  • Technical data: IP address, device, cookies, logs, fraud signals
  • Communications: support messages, notifications preferences
  • Delivery partner data: vehicle and service details, job history, earnings and fees, and the tax details required for HMRC reporting (legal name, date of birth, National Insurance number or Unique Taxpayer Reference, and address)

2. How we use data

We process data to provide the marketplace, verify identity, manage deposits and refunds, prevent fraud, comply with law, improve services, and communicate with you. Lawful bases include contract, legal obligation, legitimate interests, and consent where required.

3. Sharing

We share data with payment providers (including Stripe, which processes delivery payments and driver payouts through Stripe Connect), identity verification partners, cloud hosting providers, professional advisers, and authorities where legally required. We share the names and contact details needed for a delivery between the buyer and the chosen driver. Under the UK digital platform reporting rules we report delivery partners' identity and tax details and their earnings to HMRC each year; HMRC may share this with other tax authorities. We do not sell personal data.

The service providers (processors) we use to run AYLENSALE are:

  • Google (Firebase and Google Cloud): user accounts and sign-in, database, file and photo storage.
  • Vercel: website hosting and server logs.
  • Stripe Payments UK Ltd: card payments, deposits, refunds and driver payouts. Stripe also processes data for fraud prevention as an independent controller.
  • Resend: sending account, order and notification emails.
  • Twilio: SMS and WhatsApp messages, where you choose to receive them (WhatsApp messages are delivered through WhatsApp/Meta).
  • Telegram: notifications, where you connect your Telegram account.
  • Typesense: search index of public listings (listing data only).
  • Groq: processing the messages you type into the AI buying assistant, to generate replies.
  • AfterShip: tracking parcels using the tracking numbers on your order.
  • Google Analytics and Google Ads: website statistics and ad conversion measurement, only if you allow analytics or marketing cookies (see our Cookie Policy).

3A. Marketing messages

Service messages about your account, orders, bids, deposits and deliveries are not marketing. Alerts you set up yourself (such as stock alerts, watchlist and outbid alerts) can be switched off in your account notification settings. If we send marketing emails or messages, we do so only where you have agreed to receive them or, for existing customers, about our similar goods where the law allows and you have not objected; each marketing email will include an unsubscribe link, and you can opt out at any time by contacting us.

4. International transfers

Some of the providers above process data outside the UK, including in the United States and the EU. Where data is transferred outside the UK, we use appropriate safeguards such as UK adequacy regulations (including the UK-US data bridge where the provider is certified) or the UK IDTA/addendum.

5. Retention

We retain data as long as needed for the purposes above, including legal, tax, and dispute records, then delete or anonymise it.

6. Your rights

You may request access, rectification, erasure, restriction, portability, and object to certain processing. You may withdraw consent where processing is consent-based and complain to the ICO (ico.org.uk).

7. Security

We apply administrative, technical, and organisational measures appropriate to risk. No system is completely secure.

8. Automated decision-making

We may use automated scoring for fraud and trust risk. You may request human review where required by law.

9. Children

AYLENSALE is not intended for under-18s. We do not knowingly collect children's data.

10. Contact

Data protection enquiries: privacy@aylensale.com · Data Protection Officer contact available on request · AYLENSALE LTD (Company No. 16874751) · Registered office: 2a Blenheim Walk, Corby, England, NN18 9HA

EEA market notice (Phase 3 draft)

This document is shown to users in the European Union market. It supplements the UK legal pack and will be replaced with market-specific counsel-approved text before EU go-live. Consumer rights under applicable EEA law may apply in addition to these terms.

Privacy Policy · AYLENSALE