Privacy Policy

Who we are

Composite Xchange Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 17531295, registered office 31 West St, Swadlincote, DE11 9DN.

Questions about privacy or data protection: hello@compositexchange.com.

This policy is written for UK data protection law — the UK GDPR and the Data Protection Act 2018.

What we collect

Composite Xchange is a business-to-business marketplace, so most of what we hold is about companies. Some of it is still personal data, because it identifies the people who work for them.

When you register

• Your name and work email address
• Your company name and UK company registration number
• A display name or reference for your listings

When you sell

• Identity and business verification details collected by Stripe, our payment provider — typically the legal entity details, registered address, date of birth of a director or beneficial owner, and bank account details. We do not hold your bank details or identity documents. Stripe collects and holds these directly.
• Collection address, where you offer collection

When you buy

• Delivery address
• Payment details, collected and processed by Stripe. We never see or store your card number.

When you use the marketplace

• Listings, messages and reviews you post
• Transaction records: what was bought, from whom, when, and for how much
• Technical data such as IP address, browser type and pages visited

When you contact us

• Whatever you put in the enquiry or contact form, and any correspondence that follows

Why we use it, and our lawful basis

What for	Lawful basis
Creating and running your account	Performance of a contract
Processing orders, payments and payouts	Performance of a contract
Showing listings and messages to other users	Performance of a contract
Verifying sellers and preventing fraud	Legitimate interests — keeping the marketplace trustworthy; and legal obligation where anti-money-laundering rules apply to our payment provider
Checking that listings and shipping charges comply with our terms	Legitimate interests — protecting users and our revenue
Responding to enquiries	Legitimate interests — answering people who contact us
Compiling diverted-weight figures for sellers	Legitimate interests — providing a service sellers have asked for
Marketing emails to businesses	Legitimate interests, where permitted by PECR; consent where the recipient is a sole trader or partnership
Keeping accounting and tax records	Legal obligation

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can ask us for details of that assessment, and you can object — see Your rights.

What other users can see

Anonymity is a deliberate feature of this marketplace, so it is worth being precise about it.

• Listings show a reference, not your company name.
• Where material is shipped, your address is never published.
• Where you offer collection, your address is shared with the buyer after payment, because collection cannot happen otherwise.
• Once a transaction begins, buyer and seller exchange the details needed to complete it, including delivery address and a contact name.
• Reviews are public and show the reviewer.

Who we share it with

We do not sell personal data. We share it with:

• Sharetribe — the marketplace software that runs the platform, as our processor.
• Stripe — our payment provider. Stripe is a separate controller for the identity and payment data it collects, and has its own privacy policy.
• Microsoft — our email provider.
• Netlify — hosting for this website and the enquiry forms.
• Our accountant, for bookkeeping and tax.
• Other users, as described above.
• Law enforcement or regulators, where we are legally required to.

If the business is sold or restructured, personal data may transfer to the new owner, who would be bound by this policy.

Where it is held

Some of our suppliers process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

What	How long
Account details	While your account is open, then 12 months
Transaction and payment records	7 years, for tax and accounting
Messages and listings	3 years after the transaction, or after the listing closes
Enquiry and contact form submissions	2 years
Marketing contacts	Until you opt out, then a suppression record indefinitely so we don't contact you again

Security

Accounts are protected by passwords you control. Payment and identity data is handled by Stripe, a regulated payment institution, and does not pass through our systems. Access to the Console that runs the marketplace is limited to those who need it.

No system is completely secure. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you where required.

Cookies

This website uses only cookies that are strictly necessary for it to work. We do not currently run analytics or advertising cookies on it.

The marketplace itself uses cookies necessary for signing in and keeping your session. If we add analytics or any non-essential cookie, we will ask for your consent first and update this policy.

Your rights

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct it if it is wrong or incomplete
• Delete it, where we no longer need it and no legal duty requires us to keep it
• Restrict how we use it while a question about it is resolved
• Port it to another provider in a machine-readable format
• Object to processing based on legitimate interests

You can object to direct marketing at any time and we will stop, without exception.

To exercise any of these, email hello@compositexchange.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Some rights are limited. We cannot delete transaction records we are legally required to keep, and we cannot remove a seller's identity data from Stripe's records while regulatory obligations apply to it.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right.

You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We will publish any changes here with a new version number and date. Where a change materially affects you, we will tell registered users by email.

Contact

Composite Xchange Ltd
31 West St, Swadlincote, DE11 9DN, United Kingdom
hello@compositexchange.com