Privacy Policy

1. Introduction

TBD UK Marketplace Ltd trading as Islington Marketplace ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use our marketplace platform at islingtonmarketplace.co.uk (the "Platform").

We are registered with the Information Commissioner's Office (ICO) under registration number ZB244498 and comply with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

2. Data Controller

3. What Data We Collect

We collect and process the following categories of personal data:

3.1 Account Information

• Name (first and last name)
• Email address
• Password (stored as encrypted hash)
• Phone number (optional)
• Account type (Consumer, Provider, or Admin)

3.2 Profile Information

• For Providers: Business name, business type, logo, website, city, description, company registration details
• For Consumers: Avatar image, preferences

3.3 Transaction Data

• Payment information (processed securely by Stripe - we do not store card details)
• Purchase history (tickets, deals, listing fees)
• Stripe Connect account details (for providers)

3.4 Content & Usage Data

• Listings you create (events, jobs, deals)
• Images and files you upload
• Job applications (CVs, cover letters)
• Reviews and ratings
• Messages sent through contact forms
• Page views and listing analytics

3.5 Technical Data

• IP address
• Browser type and version
• Device information
• Operating system
• Cookies and similar tracking technologies
• Usage analytics (via Google Analytics and Clicky)

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Service Provision

• Create and manage your account
• Enable you to browse and purchase tickets/deals
• Enable you to apply for jobs
• Allow providers to create and manage listings
• Process payments and listing fees
• Facilitate communication between users and providers

4.2 Transactional Communications

• Send email verification and password reset links
• Send purchase confirmations and receipts
• Notify providers of new applications or sales
• Send listing expiry reminders
• Respond to support inquiries

4.3 Platform Analytics & Improvement

• Track listing views and performance metrics
• Analyze platform usage patterns
• Improve user experience and features
• Prevent fraud and abuse

4.4 Marketing Communications & Newsletter Subscriptions

Automatic Subscription: By creating an account on Islington Marketplace, you automatically subscribe to our newsletter and marketing communications (managed via MailerLite). This is how we communicate important platform updates, new features, and promotional offers.

We may send you:

• Platform updates and announcements
• New feature releases
• Promotional offers and discounts
• Tips for optimizing your listings (Providers)
• Curated events, jobs, and deals (Consumers)

You can unsubscribe at any time:

• Click the "Unsubscribe" link at the bottom of any marketing email
• Update your email preferences in your account settings
• Contact us at [email protected] to opt-out

Note: Unsubscribing from marketing emails does NOT affect transactional emails (e.g., purchase confirmations, password resets, listing expiry notifications), which are essential to platform operation.

5. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide marketplace services you've requested (e.g., creating listings, processing purchases)
• Legitimate Interests: Platform analytics, fraud prevention, service improvement (balanced against your rights)
• Legal Obligations: Compliance with tax, accounting, and regulatory requirements
• Consent: Marketing communications and newsletter subscriptions. By creating an account, you consent to receive marketing emails. You can withdraw consent anytime by unsubscribing via the link in emails or updating your account preferences.

Important: Registration on Islington Marketplace constitutes your consent to be added to our subscriber list for platform communications. This is part of how our platform operates. You have the right to unsubscribe at any time without affecting your ability to use essential platform features.

6. How We Share Your Data

We share your personal data with the following third parties:

6.1 Service Providers

• Stripe: Payment processing and Stripe Connect account management (PCI-DSS compliant)
• Supabase: Cloud storage for images and files (encrypted)
• MailerLite: Email marketing platform (only if you opt-in)
• Google Analytics & Clicky: Website analytics and usage tracking

6.2 Public Information

• Provider business names and logos are publicly visible on listings
• Event, job, and deal details you publish are publicly accessible
• Reviews and ratings (if you choose to leave them)

6.3 Legal Disclosures

We may disclose your data if required by law, court order, or to protect our legal rights, prevent fraud, or ensure platform security.

6.4 Business Transfers

If TBD UK Marketplace Ltd trading as Islington Marketplace is acquired or merges with another company, your data may be transferred to the new owner (you will be notified).

Important: We operate exclusively in the UK and EU. Your data is not transferred outside these regions.

7. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted via HTTPS/TLS encryption
• Passwords stored as bcrypt hashes (never plain text)
• Payment data processed securely by Stripe (PCI-DSS Level 1)
• Regular security audits and vulnerability assessments
• Access controls and authentication requirements
• Encrypted file storage via Supabase

While we take all reasonable precautions, no internet transmission is 100% secure. You are responsible for keeping your password confidential.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data we hold
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal obligations)
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Restrict Processing: Temporarily limit how we use your data
• Right to Withdraw Consent: Withdraw consent for marketing communications anytime

To exercise any of these rights, contact us at [email protected] or write to our Data Protection Officer at the registered address above. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Data Retention

We retain your personal data as follows:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Personal data deleted within 4 weeks of account deletion
• Transaction Records: Retained for 7 years to comply with UK tax and accounting laws
• Analytics Data: Anonymized and aggregated (no longer personally identifiable)
• Legal Claims: Data may be retained longer if involved in legal proceedings

10. Cookies & Tracking Technologies

We use cookies to improve your experience. Here's what we use:

10.1 Essential Cookies (Required)

• Authentication tokens (keep you logged in)
• Session management
• Security and fraud prevention

10.2 Analytics Cookies (Optional)

• Google Analytics: Track page views, user behavior, traffic sources
• Clicky: Real-time analytics and heatmaps
• These help us understand how users interact with the platform

10.3 Marketing Cookies (Optional)

• MailerLite: Track email campaign performance (only if you opt-in to marketing)

You can manage cookie preferences in your browser settings. Disabling essential cookies may affect platform functionality.

11. Third-Party Links

Our Platform may contain links to external websites (e.g., provider websites, external ticket booking systems). We are not responsible for the privacy practices of these third-party sites. Please review their privacy policies before providing any personal information.

12. Children's Privacy

Our Platform is intended for users aged 14 and over. We do not knowingly collect personal data from children under 14. If you believe a child under 14 has provided us with personal data, please contact us immediately at [email protected], and we will delete it.

Users aged 14-17 should obtain parental/guardian consent before using our services.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you via email (for material changes)
• Display a prominent notice on the Platform

Your continued use of the Platform after changes indicates acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: