Skip to main content
VeriBuy
UK GDPR & DPA 2018 CompliantLast updated: September 4, 2026

Privacy Policy

How VeriBuy collects, processes, secures, and protects your personal data and device verification records in compliance with UK GDPR.

Our Privacy Commitments

Zero Data SellingWe never sell, rent, or monetize your personal or transaction data with data brokers or ad networks.
Encrypted IdentifiersIMEI and serial numbers are encrypted and isolated exclusively for fraud prevention and Trust Lens checks.
Essential Cookies OnlyWe don't use invasive third-party ad trackers, cross-site beacons, or behavioral profiling cookies.

1. Overview & Data Controller

VeriBuy Ltd (“we”, “us”, “our”) is the Data Controller responsible for your personal data collected through veribuy.shop and associated API services under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

2. Categories of Information We Collect

Data CategorySpecific Data ElementsLawful Basis (UK GDPR)
Account & ProfileFull name, email address, password hash, contact phone number.Contract performance (Art. 6(1)(b))
Device IdentifiersIMEI (15-digit), Serial Number, evidence photos, battery metrics.Legitimate interests & fraud prevention (Art. 6(1)(f))
Order & DeliveryDelivery address, Royal Mail tracking numbers, transaction timestamps.Contract performance (Art. 6(1)(b))
Payment DetailsTokenised payment reference (processed strictly via Stripe; full card numbers are never stored on our servers).Legal obligation & Contract (Art. 6(1)(c))

3. How & Why We Use Your Data

  • Operating Trust Lens™: Conducting automated GSMA blacklist verification, stolen device cross-referencing, and cloud lock verification.
  • Escrow Transactions: Processing Stripe PaymentIntents and releasing funds after verified delivery and inspection.
  • Dispute Mediation: Inspecting timestamped device evidence packs to resolve condition discrepancies fairly.

4. Third-Party Service Providers

We disclose data strictly to vetted service providers bound by Data Processing Agreements (DPAs):

Stripe Payments UK

PCI-DSS Level 1 payment processor for escrow handling.

Cloudinary Media

Encrypted storage for timestamped evidence photos.

Royal Mail Logistics

Tracked parcel dispatch & delivery confirmation.

5. Security & Encryption Standards

TLS 1.3 in TransitAll browser-to-server communications use modern cryptographic ciphers with strict HSTS.
HttpOnly Session CookiesAuthentication tokens are stored in HttpOnly, SameSite=Strict cookies inaccessible to client scripts.

6. Your UK GDPR Rights

Under UK data protection law, you have enforceable statutory rights regarding your personal data:

Right to Access:Request a copy of all personal data we hold about you.
Right to Erasure:Request deletion of your account and associated personal data.
Right to Rectification:Correct any inaccurate or incomplete personal details.
Right to Data Portability:Obtain your listing and order history in standard machine-readable JSON format.

7. Data Retention Policy

We retain user profile data for as long as your account remains active. Transaction and VAT invoice records are retained for 6 years in accordance with UK statutory accounting obligations (HMRC requirements), after which they are permanently anonymised or destroyed.

8. Data Protection Officer & Contact

To exercise your privacy rights or submit a Data Subject Access Request (DSAR), please contact our Data Protection Officer at dpo@veribuy.shop. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.