Privacy policy

Refresh Surplus is a surplus stock brokerage. People use this site to send us stock lists, register as buyers, refer stock they've spotted and send us general enquiries. Every one of those routes involves giving us personal details, so this page explains what we collect, why, where it goes and how to get it removed.

Who we are

Refresh Surplus Ltd is the data controller for this site. We are registered in England and Wales (Company No. 15565781) at 4th Floor, 14 Museum Place, Cardiff CF10 3BH, and with the Information Commissioner's Office under registration ZB850769. For anything to do with your data, email [email protected].

What we collect

We only collect what you give us, plus the minimum needed to run the site securely:

• Form details. Name, email and phone on all four forms, plus company on the seller, buyer and referral forms (optional when referring). Sellers can add a company website, a general enquiry can add a best time to call, and sellers, buyers and general enquiries tell us how they heard about us. We keep whatever you write in the free-text fields.
• Stock lists. Sellers can attach a spreadsheet or document of up to 5MB. We read it to price the stock, nothing else.
• Technical data. Your IP address, used to rate-limit submissions, screen out bots and, transiently, by our analytics. The analytics is cookieless and pseudonymous: it tells us which pages get read, not who you are.

Information about other people

Two of our routes can carry someone else's details. A stock list you upload might name your own contacts, and a referral usually tells us about a business holding surplus stock. Only share what we need to price or trace the stock. We use those details to approach the business about the deal and nothing else, and this policy covers them the same way it covers yours.

Why we use it

UK GDPR requires a lawful basis for each use. Ours are:

• Answering your enquiry. Contacting you about the stock you want to sell, buy or refer is a step you've asked us to take before any contract (Article 6(1)(b)).
• Sending matched offers. If you join the buyer list, matched stock offers are the service you signed up for (Article 6(1)(b)). Tell us to stop at any time and we will.
• Keeping the site secure. Bot-screening and rate-limiting run on legitimate interest (Article 6(1)(f)): we can't run public forms without them.

We don't run marketing lists, we don't profile you and we never sell your data.

Cookies

We set no analytics or marketing cookies, which is why there is no cookie banner. Our analytics works without cookies entirely. The one exception is security: a security service sits in front of the whole site and runs the bot check on our forms, and it may set strictly necessary cookies on any visit while it screens out automated traffic. Strictly necessary cookies don't need consent under UK law, so no pop-up.

Who we share it with

Your details go to the suppliers we need to run the site, under contract, and nowhere else:

• Email. Form submissions are emailed to our desk and stored in our business mailbox.
• Security. A security service sits in front of the site and screens out bots; your IP address is part of what it verifies.
• Hosting. The site runs on servers in Europe.

Some of these providers are US-headquartered, so limited transfers outside the UK can occur. Where they do, the providers operate under UK-approved safeguards, including the UK Extension to the EU-US Data Privacy Framework. If you want the specific providers named, email us and we'll tell you.

How long we keep it

Submissions land in our email inbox and stay there; there's no customer database behind this site. We keep enquiry emails for up to 24 months after our last contact with you, then delete them. If your enquiry turns into a deal, records tied to the transaction are kept for up to 6 years to meet UK tax and contract rules. IP addresses used for rate-limiting are held in server memory only, used within a 10-minute window, cleared when the server restarts and never written to disk.

Your rights

UK GDPR gives you the right to:

• access a copy of what we hold about you
• correct anything that's wrong
• have it deleted
• restrict or object to how we use it
• receive it in a portable format

Email [email protected] and we'll action it, usually within days and always within the one-month statutory window. If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd welcome the chance to fix it first.

Changes to this policy

If how we handle data changes, this page is updated and the date at the top moves with it. This version is the first for the new site.