Privacy Policy

1. Introduction

Coral Auction ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our coral auction marketplace services.

We are registered in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information You Provide

When you register and use our services, we collect:

• Account Information: Email address, password (encrypted), and username
• Buyer Profile: Full name, shipping address, phone number, and delivery preferences
• Seller Profile: Business name, Companies House registration number, pet shop licence details, business address, and contact information
• Verification Documents: Pet shop licences and business registration documents (stored securely)
• Transaction Data: Bidding history, purchase history, and payment records

2.2 Payment Information

We use Stripe to process payments. Your payment card details are collected and processed directly by Stripe and are never stored on our servers. Stripe's privacy policy applies to this data. We receive only transaction confirmations and partial card details (last 4 digits) for your records.

2.3 Automatically Collected Information

• Device Information: Browser type, operating system, and device identifiers
• Usage Data: Pages visited, time spent on pages, and interaction with features
• Log Data: IP address, access times, and referring URLs
• Cookies: See our Cookie Policy for details

2.4 Shipping Information

We collect and share shipping addresses with sellers and courier services (Royal Mail, APC, DX Express) to facilitate delivery. Tracking information is monitored via AfterShip to provide delivery updates.

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: Process auctions, bids, payments, and shipments
• Account Management: Create and manage your buyer or seller account
• Verification: Verify seller business credentials and pet shop licences
• Communication: Send auction notifications, payment confirmations, shipping updates, and customer support responses
• Security: Prevent fraud, detect suspicious activity, and protect user accounts
• Legal Compliance: Meet our legal obligations including tax reporting and consumer protection
• Dispute Resolution: Handle Dead on Arrival (DOA) claims, refunds, and buyer-seller disputes
• Service Improvement: Analyse usage patterns to improve our platform

4. Legal Basis for Processing

Under UK GDPR, we process your data based on:

• Contract: Processing necessary to fulfil our contract with you (account creation, auction services, payment processing)
• Legal Obligation: Processing required by law (tax records, consumer protection regulations)
• Legitimate Interests: Processing for fraud prevention, service improvement, and platform security
• Consent: Marketing communications and optional analytics (you can withdraw consent at any time)

5. How We Share Your Information

We share your information with:

• Sellers/Buyers: Shipping addresses and contact details are shared between parties to complete transactions
• Payment Processors: Stripe processes all payments and payouts
• Shipping Partners: Courier services receive shipping details for delivery
• Tracking Services: AfterShip monitors shipments and provides delivery updates
• Cloud Services: Supabase (database hosting) and Netlify (website hosting)
• Legal Authorities: When required by law or to protect our legal rights

We do not sell your personal information to third parties.

6. Data Retention

We retain your data for the following periods:

• Account Data: Until you request deletion, plus 30 days for backup recovery
• Transaction Records: 7 years (UK tax and accounting requirements)
• Verification Documents: Duration of seller account plus 2 years
• DOA Claims: 2 years from resolution
• Communication Logs: 2 years for customer service purposes
• Analytics Data: 26 months (anonymised)

7. Your Rights

Under UK GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw previously given consent at any time

To exercise these rights, contact us at privacy@coralauction.co.uk. We will respond within 30 days.

8. Data Security

We implement appropriate security measures including:

• SSL/TLS encryption for all data transmission
• Encrypted password storage using industry-standard hashing
• Secure, access-controlled storage for verification documents
• Regular security audits and vulnerability assessments
• Row-level security policies for database access
• Webhook signature verification for payment processing

While we strive to protect your data, no method of electronic transmission is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

Some of our service providers (Stripe, Supabase) may process data outside the UK. When this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK GDPR.

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our website. Your continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.