Privacy Notice

Version 1 · In force from 7 November 2026

This Privacy Notice describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service.

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Notice:

Account means a unique account created for You to access our Service or parts of our Service.
Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Notice) refers to Aquilative Technologies Limited T/A Aquilative Marketplace, 124 City Road, Islington, London, EC1V 2NX. For the purposes of the UK GDPR, the Company is the Data Controller.
Cookies are small files that are placed on Your computer, mobile device or any other device by a website.
Country refers to: United Kingdom.
Device means any device that can access the Service such as a computer, a mobile phone or a digital tablet.
Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual.
Service refers to the Website.
Service Provider means an organisation that provides services to the Company. Most process Personal Data only on Our behalf (as Data Processors); some, such as Stripe, are also responsible for some of it themselves (as separate Data Controllers) – each is described below.
UK GDPR refers to the United Kingdom General Data Protection Regulation, as amended, together with the Data Protection Act 2018 and other UK data protection law.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
Vendor means an independent maker or business that sells Goods on the Service. The Vendor is the seller of the Goods You buy from them.
Website refers to Aquilative Marketplace, accessible from https://dev.aquilativemarketplace.com, including a Vendor's own store address that is part of it.
You means the individual accessing or using the Service. Under the UK GDPR, You can be referred to as the Data Subject or as the User.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. It may include:

Email address
First name and last name
Delivery address and postcode
Your Order history and any messages You send a Vendor through the Service
If You are a Vendor: Your store's details; Your seller details (legal name – for a partnership, each partner's name – trading name, type of business, company and VAT numbers, business address, email address and any phone number), which We show to customers before they pay, because the law requires it; once Your sales near the reporting threshold, the information the digital platform reporting rules require (for a sole trader: date of birth, home address and National Insurance number or Unique Taxpayer Reference; for a partnership or company: its tax reference and address), which We keep private and report to HMRC; Your home address, privately, if You show a business-address service instead; Your team's names and email addresses; and the information Stripe needs to pay You (collected by Stripe directly)

We do not collect or store Your payment card details: You give them to Our payment processor, Stripe.

Usage Data

Usage Data is collected automatically when using the Service. It may include information such as Your Device's Internet Protocol address (IP address), browser type, the pages of our Service that You visit, the time and date of Your visit, and which link or website brought You to Us (only if You accept optional cookies).

Cookies

We use the cookies described in Our Cookies Policy. Essential cookies keep You signed in and remember Your basket. The optional one, which remembers how You found Us, is only used if You accept it, and You can change Your choice at any time on that page.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

To provide and maintain our Service, including to keep it secure and to monitor its use.
To manage Your Account as a customer or Vendor.
For the performance of a contract: to take Your payment, pass Your Order to the Vendor who sends it, send Your invoice and any credit note, and handle returns and refunds.
To contact You by email about Your Orders, Your Account or the Service, including security notices.
To manage Your requests, including messages to a Vendor sent with Contact the Store.
To pay Vendors and keep the records the law requires.
To meet Our tax reporting duties: reporting Vendors' sales to HMRC each year under the digital platform reporting rules.
To deal with reports about items made with Report This Item, including passing them to the Vendor concerned and, where the law requires, to an authority.
For business transfers: to evaluate or conduct a merger, sale or other transfer of some or all of Our assets.
To improve the Service: for example, counting which links bring visitors to Us (without identifying You unless You accept optional cookies).

We do not sell Your Personal Data, and We do not use it for advertising.

Sharing Your Personal Data

We may share Your Personal Data in the following situations:

With the Vendor of Your Order: Your name and delivery address (not Your email address), so they can send Your Goods, and the messages You send them. The Vendor is the seller and is separately responsible, as a data controller, for using them to send Your Order, deal with You about it and keep the records the law requires; they must keep them secure and must not use them for marketing.
With Service Providers, who process it on Our behalf, listed below.
For business transfers, in connection with any merger, sale of Company assets, financing, or acquisition.
With Affiliates, who will honour this Privacy Notice.
With Your consent, for any other purpose You agree to.
With HMRC: Vendors' reporting information and sales totals, once a year, as the digital platform reporting rules require.
Where the law requires, for example in response to valid requests by public authorities.

Our Service Providers

Stripe – card payments and Vendor payouts. Stripe processes payments on Our behalf and is also responsible itself for some of the information (for example for fraud prevention and its legal duties). Stripe's privacy policy
ICUK – hosting of the Website and its database in the United Kingdom, and Vendors' store addresses.
Our email provider – sending the emails You receive from Us.
Anthropic – if a Vendor uses the store-description helper, the notes the Vendor writes are sent to Anthropic's Claude to draft text. The helper never sends customer data itself, and Vendors are told not to write customers' details into it. Anthropic's privacy policy
Unsplash – some photographs on the Website are shown from Unsplash, which sees Your IP address when Your browser loads them. Unsplash's privacy policy
Aquilative Dashboard is Our own billing system, not an outside provider – it holds Vendors' subscription invoices and the commission figures on them.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Notice, to comply with Our legal obligations, resolve disputes, and enforce Our agreements. Unless otherwise stated, the periods below are maximum periods ("up to").

Accounts: for as long as Your Account is open. You can close it at any time in My Account. 24 months after it is closed, We remove the personal data in it: Your name, email address, password, photo, two-step sign-in, sign-in records, team memberships and how You found Us.
Accounts not used for 24 months: if You haven't signed in or placed an Order for 22 months, We email You that We'll close Your account when it reaches 24 months unless You sign in, and remind You 7 days before. If You don't sign in, We close it and the 24 months above begin. Vendors' and their teams' accounts are never closed this way.
Orders, invoices, credit notes, refunds, disputes and payouts: 7 years from the date of the Order. Companies must keep accounting records for 6 years from the end of the financial year they relate to, and keeping them 7 years from the order date always covers that for a 12-month financial year. This includes the name, delivery address and amounts on the invoice and any credit note, even after Your account is closed or You ask Us to erase Your data, so that We can produce them again if they're needed. Your email address is removed from Your orders, and Our copies of the emails We sent You are deleted, when the personal data in Your account is removed. After 7 years We remove the personal details from them and keep only the amounts.
Emails We have sent You: 2 years.
Messages You send Us through the contact forms: 12 months.
Vendors' tax reporting information: 7 years from the end of the year it was reported for (the rules require 6).
Reports about items: the report and what We did about it, for 7 years. The email address of whoever made it is removed 2 years after We close the report.
Records of how visitors found Us: 12 months. The optional cookie that remembers it lasts 30 days.
Security records: a sign-in ends when You sign out, or after 30 days at most, and its record is removed a day later. The activity log is kept for 7 years. IP addresses in it, and in the record of a Vendor accepting the Vendor Agreement, are removed after 12 months, unless they're needed for a dispute that is still open.
Vendor Agreement acceptances: which version was accepted and when, with the name and email address of whoever accepted it, until 7 years after their account is closed.

Copies may remain in Our hosting provider's backups until those backups are replaced in the normal backup cycle; if We restore a backup, We repeat any erasure made since it was taken. We may convert Personal Data into anonymous statistics, which may be kept indefinitely.

Transfer of Your Personal Data

Your information is stored in the United Kingdom. Some Service Providers (such as Stripe and Anthropic) may process it outside the UK; where they do, We rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Delete Your Personal Data

You can download a copy of Your Personal Data at any time in My Account (Download My Data), and close Your account there. To ask Us to erase Your Personal Data sooner, or for a copy if You can't sign in, contact Us using our contact form (choose "Privacy or my personal data") or by email at legal+dev@aquilativemarketplace.com. We may ask You to confirm it's You.

We can't close or erase an account while an Order, refund or dispute is still open, or, for a Vendor, while a payout is still to be paid – We'll tell You what is left to settle. When We erase Your Personal Data, Your Order and invoice records stay for the 7 years above – with the name, delivery address and amounts on the invoice and any credit note, because the law requires them – and those are erased when the 7 years end. Your email address, and Our copies of the emails We sent You, are removed straight away.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We use encrypted connections, encrypted storage of saved keys, and two-step sign-in for administrators, but no method of transmission over the Internet or of electronic storage is 100% secure, and We cannot guarantee absolute security.

Legal Basis for Processing

We process Personal Data on these bases:

What We do	Legal basis
Taking Your Order and payment, passing it to the Vendor, invoices, returns and refunds	Performance of a contract with You
Your Account and sign-in	Performance of a contract with You
Vendors' stores and payouts	Performance of a contract with the Vendor; for a Vendor's team members, Our legitimate interest in running the store they help with
Keeping accounting and tax records, answering authorities	Legal obligation
Collecting Vendors' tax reporting information and reporting to HMRC	Legal obligation
Dealing with reports about items	Legitimate interests (keeping the marketplace safe and lawful), or legal obligation
Keeping the Service secure, the activity log, preventing fraud and misuse	Legitimate interests (protecting accounts, money and the Service)
Product safety notices and recalls	Legal obligation, or Our legitimate interest in protecting customers
Counting how visitors found Us, with the optional cookie	Your consent, which You can withdraw at any time

Your Rights

Under the UK GDPR You have the right to:

Request access to Your Personal Data and receive a copy of it.
Request correction of anything incomplete or inaccurate.
Request erasure when there is no good reason for Us to keep it.
Request restriction of processing in certain circumstances.
Object to processing based on Our legitimate interests.
Request the transfer of Your Personal Data, in a structured, commonly used, machine-readable format.
Withdraw Your consent at any time, where We rely on it.

You may exercise these rights by contacting Us. We may ask You to verify Your identity. We generally respond within one month, and may extend by two further months where necessary.

You can complain to Us if You think We have handled Your Personal Data wrongly. We acknowledge a complaint within 30 days, look into it and reply without undue delay. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK's data protection authority.

Children's Privacy

Our Service is not intended for anyone under the age of 18, and We do not knowingly collect Personal Data from children. If You are a parent or guardian and believe Your child has provided Us with Personal Data, please contact Us.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. We strongly advise You to review the privacy policy of every site You visit.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time. The date each version came into force is shown on this page, with the earlier versions listed below it.

Contact Us

If You have any questions about this Privacy Notice, or want to use any of Your rights, You can contact Us using our contact form, by email at legal+dev@aquilativemarketplace.com, or by post at 124 City Road, Islington, London, EC1V 2NX.