Privacy policy

This privacy policy explains how Vinted Resells Ltd collects, uses and protects your personal data when you use our online store, buy from us, join our free community or course, or contact us. It also explains your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

Vinted Resells Ltd is the controller of your personal data, which means we decide how and why it is used. We are a company registered in England and Wales, company number 16344052, VAT number GB516424310. Our registered office is 66 Paul Street, London, EC2A 4NA, United Kingdom. For any privacy question or request, email support@vintedresells.com.

2. The personal data we collect

Identity and contact data: your name, email address, billing and delivery addresses, any phone number you give us, and your account details if you create a customer account.
Order data: what you bought, when, the price, your delivery, return and refund history and, for digital content, the record that you asked us to start supplying it straight away, with the exact wording shown under the pay button and the date and time.
Digital delivery data: when we sent your download or access links and, where our delivery tool records it, whether they were opened or downloaded.
Payment data: the payment method you used and whether your payment succeeded, failed or was refunded. Your card details are handled by our payment providers, and we never see or store your full card number.
Support data: your emails and messages to us and our replies, photos you send us about a faulty or damaged item, and details of any sourcing call you book with us.
Support promise data: links to your listings or marketplace profile and the notes you send us when you claim under the 90 day support promise, which is not a refund.
Community and course data: your details and activity if you join our free community or free beginner course, including whether you have completed the course.
Marketing data: your choices about receiving marketing emails and texts from us.
Technical and usage data: your IP address, device and browser type, approximate location based on your IP address, the pages you view, how you reached our store and cookie identifiers.

We do not ask for sensitive information, such as details about your health, and we ask you not to send it to us. You do not have to give us your personal data, but to place an order you need to give your name, email address and payment details at checkout, and for physical items your delivery address. Without them, we cannot complete or deliver your order.

3. How we collect your data

We collect data directly from you when you place an order, create an account, fill in a form, sign up for our emails or texts, join our free community or course, book a sourcing call or contact us.

We collect technical and usage data automatically through cookies and similar technologies, in line with your cookie choices.

We also receive limited data from others: payment confirmations and fraud risk information from our payment providers, and delivery updates from carriers.

4. How we use your data and our lawful basis

We only use your personal data where the law allows it. Each use, and the lawful basis we rely on, is set out below.

To take your order, supply digital products, ship physical items, hold any sourcing call, handle cancellations, returns and refunds, and send order and delivery emails. Lawful basis: contract.
To provide customer support and paid support, and to give support under the 90 day support promise, which is not a refund. Lawful basis: contract, and our legitimate interests in answering enquiries properly.
To give you access to our free community and free beginner course, and to check whether you have completed the course. Lawful basis: our legitimate interests in providing them.
To prevent fraud, keep our store secure, deal with payment disputes and protect our legal rights. Lawful basis: our legitimate interests in running a safe and lawful business.
To improve our store and products. Lawful basis: our legitimate interests, and your consent where this relies on non-essential cookies.
To keep a record of your request to start supplying digital content before your 14 day cancellation period ends, so that we can show when your right to cancel ended. Lawful basis: contract, and our legitimate interests in being able to show what you asked for. This request is made under consumer law, not consent under data protection law.
To deliver and resend digital products, check duplicate orders under our Refund policy and protect our content from sharing that breaks our licence. Lawful basis: contract, and our legitimate interests in protecting our content.
To keep accounting, tax and VAT records and meet our other legal duties. Lawful basis: legal obligation.
To send you marketing emails and texts. Lawful basis: your consent or, for existing customers, our legitimate interests under the soft opt-in explained in section 10.
To set cookies that are not strictly necessary. Lawful basis: your consent.

Where we rely on legitimate interests, we only do so when your rights and interests do not override them, and you can ask us about this balance at any time. You can object, as explained in section 8.

5. Who we share your data with

We share personal data only where we need to, with:

Netlify, which hosts our online store and keeps our order records;
payment service providers, which take and confirm payments: Whop, which takes the payment as merchant of record, keeps your card or wallet details for one-tap offers after checkout, collects VAT on the sale and uses your data as an independent controller under its own privacy policy, Commas (formerly FanBasis), which takes the payment as merchant of record and uses your data as an independent controller under its own privacy policy, and Vertium Scale and its platform TagadaPay, where your card details go straight from the checkout to their secure vault;
Resend, which sends our order and delivery emails, and Zapier, which runs our follow-up emails;
Loox, which hosts the photos in our customer reviews;
fraud prevention and payment dispute services, which help us screen orders and handle disputes;
email, text message and customer support providers, which help us send order, delivery and marketing messages and manage support, including the AI provider behind our website chat assistant;
digital delivery providers, which deliver your download and access links;
delivery carriers, which receive your name, address and contact details to deliver physical items;
the platforms that host our free community and course, and the tools we use to book and hold sourcing calls, when you use them;
professional advisers, such as accountants and lawyers; and
courts, regulators and other authorities, such as HMRC, where the law requires it.

Some of these organisations act as our processors and may only use your data on our instructions. Others, such as payment providers, delivery carriers, professional advisers and the platforms that host our community and course, use it as independent controllers under their own privacy policies. If a payment is disputed, we may share the relevant order and support records with the bank or payment provider. If we sell or restructure our business, your data may pass to the new owner, who must use it as set out in this policy. We do not sell your personal data.

6. International transfers

Some of the providers we use are based outside the UK, including in the United States, so your data may be transferred to and stored in other countries. When this happens, it is protected in one of these ways: UK regulations that approve transfers to that country, which for the United States cover companies certified under the UK-US data bridge, or a contract approved under UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. If you order from outside the UK, your data comes to us in the UK. You can ask us which safeguard applies and for a copy of it.

7. How long we keep your data

Order, payment and accounting records, including the record of your request to start supply and your digital delivery data: 6 years from the end of the financial year they relate to, to meet tax and accounting rules, or for as long as your paid support access lasts, if that is longer.
Support records: your emails, photos and listing links, kept while we are helping you and then for up to 6 years in case of a dispute or legal claim.
Customer account data: while your account is open. Order records linked to it are kept as set out above.
Marketing data: until you opt out or withdraw your consent. We then keep a minimal record so that we do not contact you again.
Community and course data: while you are a member, and for up to 12 months after you leave or stop using them, unless you ask us to delete it sooner.
Cookie and analytics data: for the period set for each cookie or tool. You can delete cookies in your browser at any time.

When we no longer need data, we delete or anonymise it. We may keep data for longer if we need it to deal with a legal claim or meet a legal requirement.

8. Your rights

Your right to object: you can object at any time to direct marketing, and we will stop. You can also object to any use based on our legitimate interests, and we will stop unless we have compelling grounds that override your interests or need the data for a legal claim.

You also have these rights over your personal data:

Access: ask for a copy of the personal data we hold about you.
Rectification: ask us to correct data that is wrong or incomplete.
Erasure: ask us to delete your data, for example when we no longer need it.
Restriction: ask us to limit how we use your data, for example while we check that it is accurate.
Portability: ask for data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation, where we use it under a contract or your consent and by automated means.
Withdrawal of consent: withdraw your consent at any time where we rely on it. This does not affect what we did before you withdrew it.
Rights relating to automated decisions: where a decision with legal or similarly significant effects is made about you solely by automated means, ask for a person to look at it, give your point of view and challenge the decision.

Some of these rights apply only in certain circumstances. To use any of them, email support@vintedresells.com. We may ask you to confirm your identity first. We respond without undue delay and within one month of receiving your request. If we ask for information to confirm your identity, the month starts when we receive it. If your request is complex or you make several requests, we may extend this by up to two further months and will tell you why. We do not usually charge a fee, and if we cannot meet a request, we will explain why. If you live outside the UK, your local law may give you further rights.

9. Complaints

You have the right to complain to us if you think we have not handled your personal data properly. Email support@vintedresells.com with your name, the email address you used with us and what went wrong. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.

You also have the right to complain to the Information Commission, the UK data protection regulator, known as the ICO, at ico.org.uk or on 0303 123 1113.

10. Email and text marketing

We only send marketing emails and texts if you have opted in, for example by ticking a box at checkout or signing up through a form on our store, or if you are an existing customer and the soft opt-in applies. Under the soft opt-in, we may contact you about our own similar products after you buy from us, as long as we gave you a simple way to opt out when we collected your details and we give you one in every message after that.

Every marketing email has an unsubscribe link and every marketing text has opt-out instructions. You can also email us to opt out. Opting out costs nothing, apart from any standard charge your network makes for sending a text, and we act on it promptly. You will still receive service messages, such as order confirmations, delivery emails and replies to your support requests, because these are not marketing.

11. Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. We and our providers also use similar technologies, such as pixels, tags and local storage. We use them in these categories:

Strictly necessary: make our store work, for example by remembering your cart, your offer and your checkout details, keeping checkout secure and preventing fraud. These do not need your consent.
Preferences: remember choices you make, such as your store and country.
Advertising measurement: if you accept them, the TikTok and Meta pixels tell us which adverts brought visits and purchases. They never load on the page where you enter your card details.

When you first visit our store, a cookie banner asks for your choice. We only set cookies that are not strictly necessary if you agree. You can change your choice at any time using the cookie settings on our store, or by deleting our cookies in your browser so that the banner asks you again. You can also block cookies in your browser, but parts of our store, such as the cart and checkout, may then stop working. You can ask us for the full list of cookies on our store, who sets them, what they do and how long they last.

12. Automated checks

Our payment providers use automated checks to help detect fraud, for example by looking at payment details, device information and order patterns. These checks can lead to a payment being declined or an order being flagged for a closer look. We do not ourselves make decisions about you that have legal or similarly significant effects based solely on automated processing. If you think an automated check has wrongly affected your order, email us and a person will look at it.

13. Links to other sites and platforms

Our store, products and emails link to or name third parties, including the suppliers in our lists, selling platforms and the platform that hosts our community. We do not control them and are not responsible for their privacy practices, so please read their policies before you share your data with them.

14. Our store is for adults

Our store is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you think someone under 18 has given us their data, email us and we will delete it unless the law requires us to keep it.

15. Keeping your data secure

We use appropriate technical and organisational measures to protect your personal data, including encrypted connections for our store and checkout and limiting access to people who need it. Providers that process data for us must protect it and use it only to provide their service to us. No online service is completely secure, so please protect your devices and email account, because your digital products are sent there. If there is a personal data breach, we will report it to the ICO and tell you where the law requires.

16. Changes to this policy

We may update this policy from time to time, for example when our services or the law change. The date at the top shows when it was last updated. If we make a significant change, we will take reasonable steps to tell you, such as a notice on our store or an email if we hold your address.

17. Contact us

For anything about your privacy or this policy, email support@vintedresells.com, or write to Vinted Resells Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom. We aim to reply within 2 working days.