Privacy policy

1Who is responsible

[COMPANY LEGAL NAME] (company number [COMPANY NUMBER]), of [REGISTERED ADDRESS LINE 1], [CITY], [POSTCODE], [COUNTRY], is the controller of the personal data described here. For anything in this policy, write to [privacy@softuplift.com].

2What we collect, and why

We only collect what a marketplace needs to function.

• Account details — your email address, name and a hashed password, held by our identity system. We never see your password in a readable form. Needed to give you an account.
• Phone number — if you verify a phone number, we store it and a short-lived verification code. Needed to reduce fraudulent accounts.
• Identity documents — if you complete identity checks, we store your full legal name, date of birth, the type of document and the document file itself. Needed to meet anti-fraud and, where applicable, anti-money-laundering obligations.
• Business details — for suppliers: legal business name, registration number, tax identifier and supporting documents. Needed to verify that a business is real before buyers deal with it.
• Listings and catalogue content — what you publish, including photographs and any location you provide.
• Messages — conversations between buyers and sellers. We keep contact details private by routing messages through the platform, which means we hold their content.
• Transactions — quotes, orders, bookings, escrow records, and payment references. Where you pay by mobile money we store the transaction identifiers and receipt number returned by the payment provider. We do not store card numbers or PINs.
• Activity records — an audit log of significant actions, such as a change to an order's state or a role being granted. This exists so a dispute can be resolved on evidence.

3Cookies

We use the minimum needed to make the site work: a cookie storing your chosen language, and — once you sign in — a session cookie and a security token that prevents forged requests. We do not currently use advertising or analytics cookies. If that changes, this page will be updated and you will be asked first.

4Who we share it with

We do not sell personal data. We share it only where the service cannot work otherwise: with the counterparty to a transaction you enter into, with our payment provider to move money, and with infrastructure suppliers who host the service on our behalf. Where a verification provider is used to check an identity or a business, that provider receives the documents you submit for that purpose alone.

5Where it is held

Data is stored on servers in [HOSTING LOCATION — e.g. Germany (IONOS)]. Where information moves outside that jurisdiction — for example to a payment provider — we rely on the safeguards available to us in law for that transfer.

6How long we keep it

Account and transaction records are kept while your account is open and afterwards for as long as we are required to retain them — financial and anti-money-laundering rules generally set that period, not us. Identity and business verification documents are kept for the statutory retention period and then deleted. Operational backups are retained for 14 days on a rolling basis, which means deleted data can persist in a backup for up to that long before it ages out.

7Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Some of these have limits: we cannot delete a transaction record we are legally required to keep, and doing so would also remove the other party's evidence of a deal.

Write to [privacy@softuplift.com]. If you are unhappy with the response, you can complain to [SUPERVISORY AUTHORITY — e.g. the UK Information Commissioner's Office].

8Changes

If we change how we use your data we will update this page and change the effective date above. Where the change is significant, we will tell you directly rather than relying on you noticing.