1. Overview

This policy explains how Sellexa Limited (company number NI735255, registered office West Circular Close, 187 West Circular Road, Belfast, Northern Ireland, BT13 3QF) handles your personal data when you use sellexa.app. We comply with the UK GDPR and the Data Protection Act 2018.

2. Snapshot (UK GDPR Art. 13 transparency table)

3. What we collect

3.1 Account data (all users)

• Name, email, password hash, optional profile picture and bio.
• Buyer delivery addresses you save.
• Delivery phone number. Required at checkout, so your parcel can be delivered and the seller can reach you about that delivery. See section 5.

3.2 Seller-only data

• Business trading name, registered address, VAT/UTR (where applicable).
• KYC: identity verification handled by Stripe Connect; we receive only the verification status and a high-level summary.
• Bank-account details: held by Stripe; we never see the account number.
• WhatsApp number. Required at onboarding, because a WhatsApp message is how we tell you a new order has come in. UK mobile numbers only. We never show it to buyers and never display it on your storefront. See section 3.6.

3.3 Order and transaction data

• Items ordered, prices, quantities, taxes, shipping cost, delivery address.
• Stripe payment-intent IDs, charge IDs, refund IDs (no card numbers).
• Shipping tracking. For Simple orders, where Sellexa books the label through Parcel2Go, tracking is created automatically and we receive tracking updates from the Parcel2Go tracking API so you can follow your parcel. For same-day orders in Belfast, Sellexa books a rider job with Stuart and receives job status updates from Stuart so you can follow the delivery on your order page. For seller-managed Custom orders, the seller types in a tracking number when they dispatch your parcel.
• Ledger entries (commission, payout, refund), retained 7 years per HMRC and Companies Act 2006.

3.4 Messaging data

• Order-scoped messages between buyer and seller. The original message body is retained for moderation audit (admin-visible only) even where our contact-info filter strips parts before delivery.
• Notifications outbox: email and WhatsApp sends and their delivery status callbacks (12-month retention for delivery diagnostics). For WhatsApp we keep a record that a message was sent and which order it related to; we do not keep a copy of the message body.

3.5 Device and log data

• IP address, browser, OS, approximate location (city level, derived from IP).
• Pages viewed, click-through, error logs, and the words you type into search (never anything shaped like an email address or phone number).
• A random browser code (the sx_vid cookie) attached to your product views, clicks and searches, so suggestions can reflect what this browser has looked at. It holds a random code, not your name. See the Cookie Policy.

3.6 WhatsApp order notifications (sellers)

If you sell on Sellexa, we send you a WhatsApp message when one of your orders is paid, so you can pack and dispatch it. These are service messages about an order that has already been placed. We do not send marketing, offers, or promotions over WhatsApp, and we do not currently send buyers any WhatsApp messages.

• Where the number comes from: the WhatsApp number you gave at onboarding. Lawful basis: performance of contract (Art. 6(1)(b)), because dispatching on time is your obligation under the Seller Agreement.
• What is in the message: your business name, the order reference, the order total, and the number of items. We never put the buyer's name, address, phone number, or any payment detail in a WhatsApp message.
• Who else sees it: to deliver the message, your WhatsApp number and the message content pass to Meta, which runs the WhatsApp Business Cloud API for us as our processor. See section 6.
• Buyers never receive your WhatsApp number. Messages are sent from Sellexa's own business number, and your number is never shown to buyers or on your storefront.
• Turning it off: email support@sellexa.app and we will stop sending WhatsApp messages to your account. You keep getting order alerts by email and in the seller dashboard, so you will not miss an order.

4. Why we use it (lawful bases)

• Performance of contract (Art. 6(1)(b)), running your account, processing orders, sharing buyer name + delivery address + delivery phone number with the seller for fulfilment and with the carrier or same-day rider service that delivers the order, notifying sellers of new orders (including by WhatsApp), processing refunds, providing payouts.
• Legal obligation (Art. 6(1)(c)), HMRC DAC7 reporting, Companies Act record retention, responding to lawful enforcement requests, Modern Slavery Act due diligence.
• Legitimate interests (Art. 6(1)(f)), fraud prevention, abuse and contact-info filtering in messages, security logging, debugging, basic site analytics, personalising the products we show you (using the sx_vid browser code described in section 3.5), defending claims. We balance these against your privacy and you can object at any time by emailing support@sellexa.app; to stop the personalisation on this browser you can also simply clear the sx_vid cookie.
• Consent (Art. 6(1)(a)): analytics and marketing cookies, and marketing emails, which we send only if you ticked the box at sign-up. Withdraw at any time: for cookies, use "Cookie settings" in the footer; for emails, use the unsubscribe link in any marketing email or email support@sellexa.app.

5. The buyer → seller → carrier data flow

When you place an order, the lawful basis is "performance of contract" (UK GDPR Art. 6(1)(b)). Who your delivery details reach depends on how the listing is shipped:

• Your name and delivery address are shared with the seller so they can fulfil your order. Simple orders: Sellexa books the shipping label, so we also send your name, delivery address and delivery phone number to Parcel2Go, which produces the label and passes those details on to the courier that carries your parcel. Same-day orders in Belfast: Sellexa books the rider job, so we send your name, delivery address and delivery phone number to Stuart, whose rider collects the order from the seller and brings it to you. Seller-managed Custom orders: the seller arranges the label themselves and Sellexa does not transmit your data to any carrier.
• Your email address is never shared with the seller. It is passed to the delivery company on orders Sellexa books, to Parcel2Go on Simple orders and to Stuart on same-day orders, because each holds a contact email against the shipment and uses it to send you delivery notifications about that order. Your delivery phone number is shared with the seller (shown on their order page), on Simple orders with Parcel2Go and the courier, and on same-day orders with Stuart and the rider carrying the job, because carriers ask for a contact number for the delivery. A same-day rider may call or message you on it to complete the drop-off. Both may only be used in connection with delivering that order. A seller using it for anything else breaches the Seller Agreement and the Off-Platform Transactions Policy. All other buyer↔seller communication runs through in-app messaging on the order page.
• Some information about what is in the parcel travels with it. On every shipment Sellexa books, the titles of the items you ordered are sent to the delivery company as the contents description, because a carrier needs to know roughly what it is carrying. Parcel2Go is also given the declared value of the goods, along with the parcel's weight and dimensions. We do not send either company your payment details, your card, or your Sellexa account history.
• Sellexa retains the order record (including the address used at the time of purchase) for 7 years for tax and accounting purposes.

Once the seller receives the address for fulfilment, the seller becomes an independent controller of that data and must comply with their own UK GDPR obligations under the Seller Agreement §12. Parcel2Go and the courier that carries the parcel, and Stuart on a same-day delivery, likewise act as separate controllers for the carriage of the order, deciding for themselves how they run their delivery and record-keeping. See section 6.

6. Who processes your data on our behalf

• Stripe Payments UK Ltd / Stripe Inc., payment processing, KYC, payouts. UK Addendum to EU SCCs in place for transfers to the US.
• Supabase Inc., database, authentication, file storage, realtime. EU region (eu-west-2). UK adequacy + SCCs where applicable.
• Resend Inc. (US), transactional and newsletter email delivery. UK Addendum to EU SCCs.
• Netlify Inc. (US), application hosting and CDN. UK Addendum to EU SCCs.
• Meta Platforms Ireland Limited (WhatsApp Business Cloud API), delivery of seller order-notification messages. Message content is processed on Meta-hosted infrastructure and may be processed outside the UK. UK Addendum to EU SCCs.
• Google Ireland Limited (Google Analytics, Google Tag Manager and Google Ads measurement), site usage statistics and advert measurement. Receives your IP address, the page URL and device data. Data may be processed in the US under the UK Addendum to EU SCCs or a UK adequacy decision. Before you have made a cookie choice, and if you refuse analytics or marketing cookies, Google's tag still sends short cookieless pings (no cookie is read or set and no identifier is stored); with consent it sets the cookies listed in the Cookie Policy.
• Plausible Insights OU (Estonia), cookieless page-view analytics. Receives your IP address, the page URL and device data, and keeps no identifier that follows you between days. Processed in the EU, covered by the UK's adequacy regulations for the EEA.

Each processor is bound by a written data-processing agreement requiring confidentiality, appropriate security measures, and onward-transfer controls.

Parcel2Go.com Limited (company number 02591405, a courier-aggregation company registered in England) sits slightly differently. On Simple orders, and on Custom orders where the seller buys the label through us, Sellexa sends the buyer's name, delivery address, delivery phone number and email address to Parcel2Go so it can produce the shipping label, notify the buyer and provide tracking, together with the seller's collection address and business contact details, the titles of the items as the parcel's contents description, and its declared value, weight and dimensions. Parcel2Go passes what it needs to the courier that carries the parcel. Parcel2Go and the courier decide for themselves how they run delivery and keep records, so for the carriage of the parcel they act as separate controllers in their own right, not as processors acting only on Sellexa's instruction. Parcel2Go is UK-based, so this is a domestic transfer with no international-transfer mechanism needed. A written agreement covering data protection governs this sharing.

Stuart Delivery Ltd (company number 09790251, the UK company that runs the Stuart courier network, registered in England) sits the same way for same-day delivery in Belfast. When you choose same-day at checkout, Sellexa books and pays for the rider job, and to do that we send Stuart your name, delivery address, delivery phone number and email address, the seller's collection address and business contact details, a short description of what is being carried (the titles of the items), and the Sellexa order reference. Stuart assigns a rider, who uses those details to collect the order and bring it to you, and may contact you on the delivery number to complete the drop-off. We do not send Stuart your payment details or the value of the order. Stuart decides for itself how it runs its rider network and keeps its records, so for carrying the order it acts as a separate controller in its own right, not as a processor acting only on Sellexa's instruction.

One step happens before you order. While you are still choosing a delivery option, we send the delivery address you have entered (and the delivery phone number, if you have already given one) to Stuart, to check the address is inside the same-day coverage area and to get a price for the job. Your name and email are not sent at that stage. We contract with Stuart's UK entity, so the sharing itself is a domestic transfer. Stuart is part of an EU-headquartered group, and any handling that takes place in the EU is covered by the UK's adequacy regulations for the EEA. A written agreement covering data protection governs this sharing.

7. Other sharing

• Other users: public profile fields (display name, profile picture, shop content) are visible on the platform.
• HMRC: seller information is reported annually under DAC7.
• Law enforcement and regulators: only where we are legally required (court order, properly served notice).
• Corporate transactions: in the event of a merger or sale, data may transfer to the acquirer subject to this policy.

We do not sell, rent, or trade your personal data for marketing.

8. How long we keep it

• Active accounts: until you ask us to delete or until 24 months of inactivity.
• Order records and ledger entries: 7 years from the order date (HMRC + Companies Act 2006).
• Messages (including original body for moderation): 24 months.
• Notifications outbox: 12 months for delivery diagnostics.
• KYC records: 5 years after account closure (anti-money-laundering retention norm).
• Server logs: 12 months.
• Browsing and click records: 12 months, then deleted. A scheduled job in our database removes them automatically. Google Analytics keeps the event data it collects for the period set in our Google Analytics account; we do not extend that beyond 14 months.
• Search terms: 90 days, then deleted. A scheduled job in our database removes them automatically.
• Marketing preferences and any consent we have collected: until you withdraw consent.

9. Security

We use TLS encryption in transit, encryption at rest for our database, role-based access control (Supabase RLS), least-privilege service accounts, and audit logging. We test for common web vulnerabilities. No system is completely secure, please use a strong unique password and report any suspicious activity to support@sellexa.app.

We will notify the ICO of any qualifying personal-data breach within 72 hours and will notify affected users where the breach is likely to result in a high risk to their rights and freedoms.

10. Your rights

Under the UK GDPR you can:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase personal data where the lawful basis no longer applies (subject to legal retention obligations).
• Restrict our processing while a query is resolved.
• Port data you provided in a structured, machine-readable format.
• Object to processing based on legitimate interests, including any direct marketing.
• Withdraw consent for any consent-based processing at any time. For analytics and marketing cookies, choose "Cookie settings" in the footer of any page; it takes effect straight away.
• Not be subject to a decision based solely on automated processing that significantly affects you (we do not currently make such decisions).

Email support@sellexa.app to exercise any right. We respond within one calendar month and may ask for ID verification.

11. Complaining to the ICO

If you are unhappy with how we handle your personal data, please raise it with us first via the Complaints Policy. You also have the right to complain to the Information Commissioner's Office (the UK supervisory authority):

12. Cookies

We set essential cookies to sign you in and take payment, one functional cookie (sx_vid) that remembers this browser for product suggestions, and analytics and marketing cookies only with your consent (including, if you allowed analytics, a small Sellexa cookie called sellexa_signup_tracked that stops one sign-up being counted twice). Change your choice at any time with "Cookie settings" in the footer. Full detail, cookie by cookie, in the Cookie Policy.

13. Children

Sellexa is for adults. You must be at least 18 to use the platform, whether you are buying or selling. The service is not aimed at anyone under 18, and we do not knowingly collect personal data from anyone under that age. If you believe someone under 18 has registered, contact us and we will close the account and delete the data.

14. Changes to this policy

We will update this policy when our processing changes. Material changes will be notified in-app and by email at least 14 days before they take effect.