Privacy Notice

Updated 3/12/2025

1. Who we are

This Privacy Notice explains how Arevua (“we”, “us”, “our”) collects, uses, and protects your personal information when you use our website and services.

We are the data controller for the personal information we process about you. If you have any questions about this Notice, you can contact us via the contact form on the site or by email at [your contact email].

2. What information we collect

We may collect the following types of personal information:

• Account details – name, email address, password and basic profile details.
• Contact details – email address, phone number, postal address.
• Transaction information – items bought or sold, prices, dates, order references.
• Payment information – limited payment details processed via our payment providers. We do not store full card numbers.
• Communications – messages you send to us (for example, via contact forms or support).
• Usage data – how you use the site, including pages viewed, clicks, and browsing patterns.
• Technical data – IP address, browser type and version, device and operating system.
• Cookie data – information collected through cookies and similar technologies (see Cookies Notice).

3. How we use your information

We use your personal information for the following purposes:

• To provide our services – creating and managing your account, enabling buying and selling of items.
• To process transactions – handling payments, fees, and refunds via third-party payment providers.
• To communicate with you – sending transactional emails (order confirmations, updates, support).
• To improve and personalise the site – understanding how the service is used and improving the experience.
• To maintain security – detecting and preventing fraud, abuse, and unauthorised access.
• To comply with legal obligations – keeping appropriate records, responding to lawful requests.
• Marketing (where permitted) – sending you updates or offers about Arevua, in line with your preferences.

4. Legal bases for processing

We rely on the following legal bases under data protection law (such as UK GDPR / GDPR):

• Performance of a contract – where processing is necessary to provide our services to you.
• Legitimate interests – for example, to improve our services, maintain security, and prevent fraud, provided these interests are not overridden by your rights.
• Legal obligations – where we must process data to comply with a legal requirement.
• Consent – for certain uses of cookies/analytics or direct marketing, where required by law. You can withdraw your consent at any time.

5. How we share your information

We may share your personal information with:

• Service providers – such as hosting providers, payment processors, analytics providers, and customer support tools who process data on our behalf.
• Other users – where necessary to complete a transaction (for example, delivery details for items purchased).
• Professional advisers – such as lawyers, accountants, or insurers where needed.
• Authorities – where required by law, to comply with legal obligations, court orders, or to protect our rights.

We do not sell your personal data to third parties.

6. International transfers

Some of our service providers may be located outside the UK or European Economic Area (EEA). Where this is the case, we take appropriate safeguards to protect your personal data, such as using standard contractual clauses or ensuring the recipient is in a country with adequate protection.

7. How long we keep your information

We keep your personal information only for as long as necessary for the purposes described in this Notice, including to meet legal, accounting, or reporting requirements.

In general, we will keep:

• Account information while your account remains active.
• Transaction records for the period required by tax and accounting laws.
• Communication records for a reasonable period to manage queries and disputes.

8. Your rights

Depending on your location and subject to certain conditions, you may have the following rights over your personal data:

• Access – to request a copy of the information we hold about you.
• Rectification – to correct inaccurate or incomplete data.
• Erasure – to request that we delete your data, where there is no good reason for us to continue processing it.
• Restriction – to ask us to suspend processing in certain circumstances.
• Objection – to processing based on our legitimate interests, or to direct marketing.
• Data portability – to request we transfer your data to you or another provider in a structured, commonly used format.
• Withdraw consent – where processing is based on your consent, you can withdraw this at any time.

To exercise these rights, please contact us using the details in section 1. You may also have the right to lodge a complaint with your local data protection authority.

9. Security

We use appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. However, no system can be guaranteed 100% secure.

10. Children

Our services are not intended for children under 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to remove it.

11. Updates to this Privacy Notice

We may update this Privacy Notice from time to time. The “last updated” date at the bottom of this page indicates when it was last revised. We encourage you to review this page regularly.