Privacy policy

Refresh Surplus is a surplus stock brokerage. People use this site to send us stock lists, register as buyers, refer stock they've spotted and send us general enquiries. Every one of those routes involves giving us personal details, so this page explains what we collect, why, where it goes and how to get it removed.

Who we are

Refresh Surplus Ltd is the data controller for this site. We are registered in England and Wales (Company No. 15565781) at 4th Floor, 14 Museum Place, Cardiff CF10 3BH, and with the Information Commissioner's Office under registration ZB850769. For anything to do with your data, email info@refreshsurplus.com.

What we collect

We only collect what you give us, plus the minimum needed to run the site securely:

• Form details. We ask for business contact details: your name, email and phone on all four forms, plus your company on the seller, buyer and referral forms (optional when referring). Sellers can add a company website, a general enquiry can add a best time to call, and sellers, buyers and general enquiries tell us how they heard about us. We keep whatever you write in the free-text fields.
• Quantities, dates and delivery. Sellers tell us how much stock there is, and can add where it is, when it needs to move and whether they want collection or delivery. Buyers tell us how much they buy at a time.
• Stock lists. Sellers can attach a spreadsheet, document or photograph of up to 5MB. We read it to price the stock, nothing else.
• Technical data. Your IP address, used to rate-limit submissions, screen out bots and, transiently, by our analytics. The analytics is cookieless and pseudonymous: it tells us which pages get read, not who you are.

Information about other people

Two of our routes can carry someone else's details. A stock list you upload might name your own contacts, and a referral usually tells us about a business holding surplus stock. Only share what we need to price or trace the stock. For the people you name, we only need business contact details. We use those details to approach the business about the deal and nothing else, and this policy covers them the same way it covers yours.

Why we use it

UK GDPR requires a lawful basis for each use. Ours are:

• Answering your enquiry. Contacting you about the stock you want to sell, buy or refer, including using AI tools to sort and summarise what you send, is a step you've asked us to take before any contract (Article 6(1)(b)).
• Sending matched offers. If you join the buyer list, matched stock offers are the service you signed up for (Article 6(1)(b)). Tell us to stop at any time and we will.
• Keeping the site secure. Bot-screening and rate-limiting run on legitimate interest (Article 6(1)(f)): we can't run public forms without them.

We don't run marketing lists, we don't profile you and we never sell your data.

Cookies

We set no analytics or marketing cookies, which is why there is no cookie banner. Our analytics works without cookies entirely. The one exception is security: a security service sits in front of the whole site and runs the bot check on our forms, and it may set strictly necessary cookies on any visit while it screens out automated traffic. Strictly necessary cookies don't need consent under UK law, so no pop-up.

Who we share it with

Your details go to the suppliers we need to run the site, under contract, and nowhere else:

• Email. Form submissions are emailed to our desk and stored in our business mailbox.
• AI processing. We use AI tools to help us read and sort what comes in through the forms, so a stock list or an enquiry may be processed by an automated assistant before a person picks it up. The providers are xAI (Grok) and Anthropic (Claude). They process the text you submit on our instructions. We've set those accounts so the text isn't used to train their models. Files you attach aren't opened by the AI; a person reads those. Every offer, reply and decision about your stock is made by someone at our desk, not by the software.
• Security. A security service sits in front of the site and screens out bots; your IP address is part of what it verifies.
• Hosting. The site runs on servers in Europe.

Some of these providers are US-headquartered, so limited transfers outside the UK can occur. Where they do, the providers operate under UK-approved safeguards: the UK Extension to the EU-US Data Privacy Framework, or the ICO's international data transfer agreement. If you want the specific providers named, email us and we'll tell you.

How long we keep it

Submissions land in our email inbox and stay there; there's no customer database behind this site. We keep enquiry emails for up to 24 months after our last contact with you, then delete them. If your enquiry turns into a deal, records tied to the transaction are kept for up to 6 years to meet UK tax and contract rules. The AI tools may keep a working copy of the text they process for a limited time under their terms; we don't keep a separate store of it with them. IP addresses used for rate-limiting are held in server memory only, used within a 10-minute window, cleared when the server restarts and never written to disk.

Your rights

UK GDPR gives you the right to:

• access a copy of what we hold about you
• correct anything that's wrong
• have it deleted
• restrict or object to how we use it
• receive it in a portable format

Email info@refreshsurplus.com and we'll action it, usually within days and always within the one-month statutory window. If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd welcome the chance to fix it first.

Changes to this policy

If how we handle data changes, this page is updated and the date at the top moves with it. On 28 August 2026 we added that form submissions may be read by AI tools, and we named those providers. On 12 September 2026 we set out in full the details each form asks for, and said we only need business contact details.