Prerode Privacy Policy

We collect personal information that you provide to us and information generated when you use Prerode.

Depending on how you use Prerode, this may include:

• information you provide when creating and managing an account, such as your email address, username or display name and account details;
• information you provide when creating, editing or managing a listing, including listing descriptions, prices, photographs, item details and location information;
• messages you send or receive using Prerode's messaging service, including the contents of those messages and information such as when they were sent or received;
• information you provide when you contact us, request support, report a listing or user, make a complaint or otherwise communicate with us;
• records relating to listings you create and your activity on Prerode;
• information collected automatically when you use Prerode, such as your IP address, browser or device information, login information, timestamps and security logs; and
• information collected through cookies and similar technologies as described in our Cookie Policy.

You are responsible for the information you choose to include in listings, photographs, messages and other content you submit to Prerode.

Please avoid including personal or sensitive information that is not necessary. In particular, check photographs before uploading them to make sure they do not unintentionally reveal information such as your home address, documents, vehicle registration or other information you do not want other people to see.

Prerode is a marketplace and information you include in a public listing is intended to be seen by other people.

Depending on the information you provide, this may include:

• your username or display name;
• photographs;
• the description of the item;
• the asking price;
• item details;
• general location information; and
• other information you choose to include in your listing.

You should not include information in a public listing that you do not want other people to see.

Information published publicly may also be copied, saved or shared by other people. Removing information from Prerode cannot necessarily remove copies that have already been made independently by other users or third parties.

Where you use Prerode's messaging service, we process the messages you send and receive so that we can provide the messaging service.

Messages between users are not published publicly.

Automated safety checks

We run an automated check on messages sent through Prerode's messaging service to help detect known scam, fraud and abuse patterns, such as attempts to move conversations off-platform, prompts to circumvent normal payment methods, or phrases associated with common marketplace scams.

Where the check identifies a possible risk, the recipient may see a warning about the message. The sender is not shown the warning, so that patterns used by scammers cannot be tested against the detector.

These checks are used only to display safety information and to help our moderators prioritise reviews. They do not, on their own, produce a decision about you that has legal or similarly significant effects within the meaning of Article 22 of the UK GDPR.

Human review

A Prerode moderator can only open the contents of a private conversation where there is a specific triggering event, and only where reasonably necessary to:

• investigate a reported user, listing or message;
• investigate an automated safety flag on the conversation;
• detect or investigate suspected fraud, scams, spam or abuse;
• enforce our Terms of Service or marketplace rules;
• protect the safety and security of Prerode and its users;
• respond to a support request;
• investigate technical problems; or
• comply with a legal or regulatory obligation.

Every time a moderator opens a private conversation, the action and the stated reason are recorded in an internal audit log.

Please do not send unnecessary financial, identity or other sensitive information through Prerode messages.

Depending on how you use Prerode, we may use your personal information to:

• create, authenticate and maintain your account;
• allow you to create and manage listings;
• display your listings to other users;
• provide messaging between users;
• operate and maintain Prerode;
• provide customer support and respond to enquiries;
• investigate reports and complaints;
• detect, investigate and prevent fraud, scams, spam, abuse and other prohibited activity;
• protect our users, systems and services;
• enforce our Terms of Service and marketplace rules;
• diagnose technical problems and improve the reliability and performance of Prerode;
• comply with our legal and regulatory obligations; and
• establish, exercise or defend legal claims.

We may also send you service-related communications concerning your account, listings, security, changes to Prerode or other important information about the service.

UK data-protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we rely on the following bases.

Contract

We process information where it is necessary to provide Prerode to you under our Terms of Service or to take steps at your request before doing so.

For example, this includes creating your account, publishing your listings and providing messaging functionality.

Legitimate interests

We process certain information where it is necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.

Our legitimate interests include:

• operating and improving Prerode;
• maintaining the security and integrity of the marketplace;
• preventing and investigating fraud, scams, spam and abuse;
• moderating listings and user activity;
• protecting Prerode and its users;
• responding to complaints and disputes; and
• establishing, exercising or defending legal claims.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation that applies to us.

Consent

Where we specifically ask for your consent to process information, you may withdraw that consent at any time.

Withdrawing consent does not affect processing that took place before consent was withdrawn.

Prerode provides a marketplace for advertising items and communicating with other users.

Prerode does not process the purchase price of items advertised by users.

Buyers and sellers arrange transactions directly between themselves, including:

• inspecting an item;
• negotiating and agreeing a price;
• deciding how payment will be made;
• making or receiving payment; and
• arranging collection or delivery.

Because Prerode does not process marketplace payments, we do not normally require your payment-card or bank-account details in order for you to buy an item from or sell an item to another user.

You should not send payment-card details or other unnecessary financial information through Prerode messages.

We do not sell your personal information.

We may share or make personal information available where necessary to operate Prerode.

Other users and the public

Information you publish in a listing may be visible to other users and members of the public.

Messages you send to another user are provided to that user and are not made available to the public.

Service providers

We use third-party service providers to help operate Prerode. These providers act as our processors under UK data-protection law and can only handle personal information in line with our written instructions.

The categories of provider we currently use include:

• infrastructure providers (hosting, database, storage, backups);
• email delivery providers (account and service emails);
• analytics providers (only where you have given consent, see our Cookie Policy); and
• error and performance monitoring.

Where a provider processes personal information on our behalf, we require it to handle that information appropriately and only as permitted by our arrangements with it. If you would like to know which specific providers we are using at any point, email support@prerode.com.

Error monitoring and session replay

We use a third-party error-monitoring provider (Sentry) to detect and diagnose problems on the site. When an error occurs in your browser, Sentry may capture a short recording of the interactions that led up to it (for example, page navigations, clicks and scrolls) so that we can reproduce and fix the fault. All text on the page and in form fields is masked before it leaves your browser, and images and video are blocked, so the actual content of what you saw or typed is not recorded. Normal browsing sessions where no error occurs are not recorded.

Requests to Sentry are routed through our own domain, so no third-party cookies are set. We rely on our legitimate interests under Article 6(1)(f) of the UK GDPR to run this monitoring, on the basis that it is necessary to keep Prerode working reliably and securely for all users. Further detail is in our Cookie Policy.

Legal and regulatory disclosures

We may disclose personal information where reasonably necessary to:

• comply with applicable law or a legal obligation;
• respond to a valid request from a court, regulator, law-enforcement authority or other competent authority;
• investigate suspected unlawful activity;
• protect Prerode, our users or other people; or
• establish, exercise or defend legal claims.

Some of the service providers we use are based outside the United Kingdom, in the European Economic Area or the United States, and may process personal information there.

Where personal information is transferred internationally, we rely on appropriate safeguards required by UK data-protection law. Depending on the provider and the destination country, these may include:

• UK adequacy regulations, where the destination country has been recognised as providing an essentially equivalent level of protection;
• the UK Extension to the EU-US Data Privacy Framework (also known as the UK-US Data Bridge), where the recipient in the United States is certified under that framework;
• the International Data Transfer Agreement (IDTA); or
• the UK Addendum to the EU Standard Contractual Clauses.

You can contact support@prerode.com if you would like a summary of the safeguards that apply to a specific provider or category of personal information.

We keep personal information for as long as reasonably necessary for the purposes for which it was collected and to meet any legal, security, fraud-prevention or dispute-resolution requirements.

Where we operate a fixed retention period, that period is listed below. These periods are enforced by automated jobs that run on a regular schedule. Other categories of information are kept for as long as reasonably necessary for the purposes described in Section 4, and are reviewed against that need.

Fixed retention periods

• Signup rows that never confirm an email address: deleted 14 days after signup.
• Your account after you request deletion: hidden from public surfaces immediately, then permanently erased 30 days after the request. The 30-day period may be extended where a legal hold applies (see below).
• Copies of the data you generate through a data export request: the download link is valid for 72 hours from the moment the export is generated. After 72 hours the link is deactivated and the underlying file is deleted from our storage.
• Automatic legal hold on open reports or investigations: when a report is opened that involves you, we automatically place a 90-day hold on the relevant information. The hold is extended for as long as any related report or investigation remains open, and is cleared when those close.
• Direct messages: conversations and their messages are deleted 2 years after the last message in the conversation was sent, provided neither participant is on legal hold and the conversation is not the subject of an open report or investigation.
• Reports and their resolution history: deleted 7 years after the report is resolved or dismissed, provided no other open report or investigation references the same parties. The 7-year window applies to both reports you have filed and reports filed about you, so that we can spot repeat patterns and defend legal claims within the applicable limitation periods.
• Internal records of moderator actions: retained for 7 years from the date of the action for accountability and then deleted.
• Orders and reviews: deleted 6 years after the order or review was created. Orders that are the subject of an open dispute are excluded from this cap until the dispute is resolved.
• Records of sold listings: deleted 6 years after the listing was marked sold.
• Tax information required under UK platform reporting rules: retained for the period required by the Reporting Rules for Digital Platforms (which implement the OECD Model Rules, often referred to as DAC7), currently 5 years from the end of the reporting year to which the information relates, then deleted.
• Database backups: our hosting provider retains encrypted database snapshots for up to 30 days, together with 7 days of point-in-time recovery data. Deletions applied to the live database propagate through to backups within this window.

Other information

Other categories of information (including technical and security logs, listing content that is not yet marked sold, and correspondence with our support team) are retained for as long as reasonably necessary for the purposes described in Section 4, taking into account our legal obligations, the need to prevent and investigate fraud, scams and abuse, the need to resolve disputes, and applicable limitation periods.

When information is no longer required for these purposes, we delete or anonymise it unless we are required or permitted by law to retain it. We keep this section under review and will publish specific retention periods for further categories as they are put in place.

You can request deletion of your Prerode account through Settings → Data & privacy or by contacting support@prerode.com.

When you request account deletion, your account enters a 30-day deletion period. If you do not cancel the request during that period, your account and personal information associated with it will be deleted or anonymised, subject to the exceptions below.

We may retain limited information after account deletion where reasonably necessary to:

• comply with a legal obligation;
• prevent or investigate fraud, scams or abuse;
• protect the security of Prerode and its users;
• resolve disputes;
• enforce our Terms of Service; or
• establish, exercise or defend legal claims.

Information that has been anonymised so that it no longer identifies you may also be retained.

Deleting your account cannot remove copies of information that other people have independently saved or copied from public listings or messages they received.

We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

However, no website, online service or method of transmitting information over the internet can be guaranteed to be completely secure.

You are responsible for keeping your account credentials secure and should not share your password or authentication credentials with another person.

If you believe your account or personal information has been compromised, please contact us.

Prerode uses cookies and similar technologies to provide and secure the service.

Some cookies may be necessary for Prerode to function correctly. Where we use non-essential cookies or similar technologies that require consent under applicable law, we will ask for your consent before using them.

Further information about the cookies and similar technologies used by Prerode, their purposes and the choices available to you can be found in our Cookie Policy.

Prerode is only available to users aged 18 or over. We do not knowingly allow anyone under 18 to create an account, buy or sell through Prerode. If we become aware that an account has been created by someone under 18, we may restrict or delete it.

Prerode does not ask users to provide special-category personal information such as information about racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation or similar sensitive matters.

Please do not include this type of information in listings, messages or other content unless there is a genuine reason to do so.

If this information appears in content submitted by a user, we may process it where necessary to provide the relevant service, deal with reports or disputes, comply with applicable law or protect Prerode and its users, subject to the requirements of applicable data-protection law.

Under UK data-protection law, you may have rights in relation to your personal information.

Depending on the circumstances and the lawful basis on which we process your information, these may include the right to:

• request access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete personal information;
• ask us to delete your personal information;
• ask us to restrict the way we process your personal information;
• receive certain personal information in a portable format;
• object to certain uses of your personal information; and
• withdraw your consent where processing is based on consent.

These rights are not absolute and do not apply in every circumstance.

You can exercise your rights using the relevant controls under Settings → Data & privacy or by contacting support@prerode.com.

We may need to verify your identity before fulfilling a request.

Your right to object

Where we process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

You can object by contacting support@prerode.com.

If you have a question or concern about how we use your personal information, please contact us at support@prerode.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

You can find information about making a complaint on the ICO website at ico.org.uk.

You do not have to contact us before making a complaint to the ICO.

UK law may require operators of certain digital platforms to collect, verify, retain or report information about sellers and their activities.

Where a legal reporting obligation applies to Prerode, we may process the information necessary to comply with that obligation and may provide required information to HM Revenue & Customs or another competent authority.

Where applicable, further information about information collected from sellers for these purposes and how it is used will be provided through Prerode and our Selling & taxes information.

Most personal information we process is provided directly by you or generated through your use of Prerode.

We may also receive information about you from another person where, for example, another user reports a listing, message or account to us or provides information in connection with a complaint or dispute.

Where required by data-protection law, we will provide appropriate privacy information concerning personal information obtained from other sources.

Prerode does not currently make decisions about users based solely on automated processing where those decisions produce legal effects or similarly significant effects.

If this changes, we will update this Privacy Policy and provide the information required by applicable data-protection law.

We may update this Privacy Policy from time to time, including where we change Prerode's features, service providers or the way we process personal information, or where legal requirements change.

The date at the top of this policy shows when it was last updated.

Where a change materially affects how we use your personal information, we will take appropriate steps to bring the change to your attention where required.

If you have questions about this Privacy Policy, want to exercise a data-protection right or have a concern about how we use your personal information, contact:

support@prerode.com

SP8CESTUDIO LTD (trading as Prerode)
21 Uplands Avenue, Willenhall, WV13 3PR
Company number: 12134895
ICO registration number: ZC047049