Privacy Policy

The Pallet Exchange Ltd ("TPX", "we", "us", "our") is registered in England and Wales (Company No. 17361549). We operate the platform available at thepalletexchange.uk and via The Pallet Exchange mobile application (together, "the Platform").

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who we are

Data controller:The Pallet Exchange Ltd — Registered in England and Wales, Company No. 17361549
Email: privacy@thepalletexchange.uk

If you have any questions about this policy or how we handle your data, contact us at the address above.

2. What data we collect

Account and identity dataWhen you apply to join or create an account, we collect your name, business name, Companies House registration number, business address, email address, and phone number. We use this to verify that you are a legitimate UK business before granting access.

Verification dataTo verify your business, we may collect and review your company documentation and bank account details. These are used solely for verification purposes.

Trading dataWe collect data about the listings you post, the bids you place, and the trades you complete. This includes lot specifications, bid amounts, trade values, delivery details, and communications between parties on a confirmed trade.

Payment dataPayments on the Platform are processed by GoCardless Ltd. We do not store your full bank account details. We receive transaction confirmations, amounts, and references from GoCardless to manage trade settlement. GoCardless is the data controller for payment processing — please refer to their privacy policy at gocardless.com/legal/privacy.

Trust Rating and review dataAfter each completed trade, ratings and written feedback you submit about counterparties are stored and displayed on their profile within the Platform.

Usage and device dataWe collect information about how you use the Platform including pages visited, features used, timestamps, device type, operating system, and IP address. This helps us improve the Platform and diagnose issues.

CommunicationsIf you contact us for support, we retain records of that correspondence.

3. How we use your data

We use your data to:

• Verify your identity and business before granting access to the Platform
• Operate the auction and trading platform, including processing bids, confirming deals, and managing trade timelines
• Facilitate secure payment collection and settlement via GoCardless
• Send you notifications about your listings, bids, trades, and settlements
• Display your Trust Rating and trading history to other verified members
• Respond to your support queries
• Detect and prevent fraud, abuse, or breaches of our Terms of Service
• Comply with our legal obligations

Legal bases (UK GDPR)

• Performance of a contract: operating your account, processing trades, facilitating payments
• Legitimate interests: platform security, fraud prevention, service improvement
• Legal obligation: complying with financial, tax, and regulatory requirements
• Consent: marketing communications (where separately obtained)

4. Who we share your data with

Other members — limited, payment-triggered onlyYour business name, contact name and delivery address are revealed to a counterparty only after the buyer has paid for a confirmed deal. Your phone number and email address are never shared with other members — all communication stays within the Platform's in-app messaging. Nothing is visible to other members browsing the Platform.

GoCardlessWe share payment-related data with GoCardless Ltd to collect buyer payments and settle sellers. GoCardless is regulated by the Financial Conduct Authority (FCA).

Service providersWe use trusted third-party providers for hosting, push notifications, error monitoring, and email delivery. These providers process data only on our instruction and are bound by data processing agreements.

Legal and regulatory bodiesWe may disclose data where required by law, court order, or to protect the rights, property, or safety of TPX, our members, or others.

We do not sell your data. We do not share it for advertising purposes.

5. International transfers

We aim to keep your data within the UK and EEA. Where any service provider processes data outside these areas, we ensure appropriate safeguards are in place (such as UK adequacy decisions or standard contractual clauses).

6. How long we keep your data

• Account data: for the duration of your membership plus 7 years after closure (for legal and tax compliance)
• Trade data: 7 years from the date of the trade (UK tax law requirement)
• Payment data: 7 years (financial record-keeping requirement)
• Verification data: for the duration of your membership plus 2 years
• Support correspondence: 3 years

7. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data where we no longer have a lawful basis to hold it
• Restriction — ask us to pause processing your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@thepalletexchange.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Security

We take reasonable technical and organisational measures to protect your data, including encrypted data transmission, access controls, and regular security reviews. No method of transmission over the internet is 100% secure — if you believe your account has been compromised, contact us immediately at hello@thepalletexchange.uk.

9. Cookies

Our website uses essential cookies to operate correctly (session management, security). We do not use advertising or tracking cookies.

10. Children

The Platform is intended for use by verified UK businesses only. It is not directed at individuals under the age of 18. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy from time to time. Where changes are material, we will notify you by email or in-app notification. The "last updated" date at the top of this page will always reflect the current version.