Privacy Policy

Elite Pokémon Auctions Ltd ("we", "us", "our") is the data controller of the personal data you provide when using elitepokemonauctions.co.uk (the "Platform"). We process personal data in accordance with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Data we collect

• Account data: name, email address, password (hashed), display name, avatar.
• Verification data: for higher-value sellers, ID documents and address confirmation.
• Transaction data: bids, purchases, sales, order history, tracking numbers, delivery confirmations, disputes.
• Payment data: handled by Stripe Payments UK Ltd; we receive metadata (last 4 digits, brand, country) but never full card details.
• Technical data: IP address, device/browser, timestamps, session cookies (see our Cookie Policy).
• Communications: messages you send to us or to other users through the Platform.

2. How we use your data and our legal bases

• Providing the Platform (Article 6(1)(b) — performance of a contract): account management, bidding, order fulfilment, payments, payouts, disputes.
• Fraud prevention and platform safety (Article 6(1)(f) — legitimate interests): detecting shill bidding, counterfeit listings, fraudulent chargebacks.
• Legal and tax compliance (Article 6(1)(c)): AML checks, HMRC digital-platform reporting, court/ICO orders.
• Service communications (contract): auction results, payment receipts, dispute updates, security alerts.
• Marketing (Article 6(1)(a) — consent): promotional emails; you can unsubscribe at any time.

3. Who we share data with

• Sellers and buyers of a completed transaction (limited to information needed for delivery).
• Stripe Payments UK Ltd, our payment processor.
• Cloud infrastructure and email providers acting as our processors.
• HMRC and other authorities where legally required.
• Professional advisers, in confidence.

We never sell your personal data.

4. International transfers

Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation.

5. Data retention

• Account data: while your account is active, plus 6 years after closure for tax and legal records.
• Transaction and payment records: 6 years, in line with UK tax law.
• Marketing preferences: until you withdraw consent.
• Dispute evidence: 6 years from resolution.

6. Your rights under UK GDPR

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal retention obligations).
• Restriction and objection — limit or object to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time (does not affect prior lawful processing).
• Complain to the UK Information Commissioner's Office (ICO) — ico.org.uk.

To exercise a right, email privacy@elitepokemonauctions.co.uk. We respond within one month.

7. Security

We use TLS for all traffic, encrypt passwords with modern hashing, enforce access controls, and monitor for suspicious activity. No system is perfectly secure — if we become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and you where required.

8. Children

The Platform is not intended for anyone under 18 and we do not knowingly collect data from children.

9. Changes

We will notify you of material changes to this Policy by email or on-Platform notice.

10. Contact

Data controller: Elite Pokémon Auctions Ltd, registered in England & Wales. Contact: privacy@elitepokemonauctions.co.uk.