Privacy and your data

Updated 2 October 2026. Byte Software LTD operates SpindlMarket and is responsible for the personal data described here. Company number 13370353.

Contact [email protected] about privacy, your information or a complaint. You can also make a privacy request online without an account.

SpindlMarket is currently a testing service. Our production retention schedule, provider contract and international transfer assessments are still being completed. Do not submit identity documents or sensitive personal information during testing.

Information we collect and why

We collect information you give us and technical information generated when you use the service. This includes:

• Account name, email, password hash, sessions and security information, to create and protect your account. If you enable two-factor authentication, we store an encrypted authenticator secret and encrypted recovery codes.
• Business membership, listings, photos and location, to publish equipment and connect buyers with sellers.
• Saved listings and searches, country, currency and measurement preferences, enquiries, messages and enquiry-pack revisions, to provide the marketplace features you choose.
• Verification submissions, content reports, review text and staff decisions, to assess claims, prevent misuse and handle disputes.
• Advertising requests and booking details, to manage advertisements and sponsorships.
• Website feedback and an optional reply address, to investigate problems and improve the service.
• Privacy requests, contact details, identity-check outcomes and response records, to handle your rights and complaints.
• IP addresses, browser information, security events and service logs, to operate and secure the service. Some abuse controls use a keyed IP digest, which is still personal data. Administrators can search accounts and review recorded sign-in IPs to manage account and network restrictions. Restriction reasons and audit records are private to authorised staff.

Why we may use personal data

Data protection law requires a lawful basis for each use. Relevant bases can include providing a service under a contract with you, meeting legal obligations, and legitimate interests in operating a secure business marketplace. Business contact data may concern an employee rather than the person who contracts with us. We must assess the appropriate basis and any competing rights in each case.

Optional permission to contact you about website feedback can be withdrawn by emailing us. We do not require consent to receive a rights request, and submitting a request does not give permission for marketing. The final purpose-by-purpose lawful-basis assessment is part of our production readiness review.

Required information and sources

Your account name, email and password are required for account features. Listing and business details are required to publish equipment. Verification evidence is required for the relevant seller check; it is not required just to browse. Feedback contact information and sponsorship contributions are optional. We ask only for evidence needed for a specific purpose, and use proportionate identity checks for rights requests.

Most information comes from you, your business representatives and the people you contact. Seller answers, review interactions and reports may describe you or your business. Verification can use public company registration records and address evidence, with the source recorded against the check. Security information is generated by your browser, requests and our service providers.

Purposes and lawful bases

• Providing the account, saved items and enquiry tools you request: performing our service contract with individual account holders. For employee and representative contact information, our legitimate interest in providing the business service and routing authorised communications.
• Publishing business listings and managing advertising bookings: performing the relevant service or booking contract, and legitimate interests in handling business representatives' contact details.
• Protecting accounts, checking seller evidence, scanning files, moderating content and handling reports: legitimate interests in reducing fraud, abuse, unsafe content and unauthorised access, balanced against your rights.
• Answering optional feedback: legitimate interests in resolving problems and improving the service. Permission to use a supplied reply address is optional and is not permission for marketing.
• Responding to data-protection rights and maintaining necessary accountability records: legal obligations under applicable data-protection law. Establishing or defending a legal claim can also require proportionate retention.

We do not use your private messages or identity evidence to target advertising, sell contact lists or automatically determine creditworthiness. If a proposed use needs consent, we will ask separately and explain how to withdraw it.

Postal checks and automated moderation

Map previews load automatically when shown. OpenStreetMap receives your browser connection information. We send the business’s published locality and country to its Nominatim lookup service and cache the approximate area. We do not send private verification addresses, messages or identity documents, and we do not request your device location.

UK postal verification creates a private letter containing a one-time code for an address confirmed by staff. Codes expire and failed attempts are limited. Access to the letter is restricted to authorised staff; submitting the code indicates access to that address, not guaranteed business ownership. EU/EEA verification is not implied by the UK process.

Automated text and image checks may block content or files, and rate limits may prevent repeated requests. Complete listings publish automatically; duplicate inventory, recent submission volume, links and moderation history may send a listing to staff review. They can make mistakes. Contact us or use Website feedback to ask for human review of a content or verification decision. We do not use these tools to make credit or insurance decisions.

Read our Cookie policy for browser-storage names, purposes and configured lifetimes, and our Community rules for reporting and review routes.

Who can see your information

Published listings and business profiles are public. Your name, enquiry messages and shared pack information are available to the buyer and authorised seller staff in that conversation. Those businesses may keep their own records and are responsible for their own use. Downloaded packs can be shared by their recipients.

Public reviews show “Anonymous buyer” and moderated text. We retain the account link privately for eligibility, moderation and complaints, so these reviews are not anonymous in our internal records.

Authorised staff review verification information, reports, campaign requests and feedback. Privacy request details are encrypted and available to the staff reviewer assigned to the case. We may disclose information when legally required or necessary to establish, exercise or defend legal claims, subject to applicable law.

Service providers and transfers

We use Hetzner for application hosting, Cloudflare for network protection, Turnstile and private R2 object storage, and Postmark for application emails. Private Email remains in use for business correspondence. We disable open and link tracking in application emails. Discord receives limited operational alerts such as environment, event, release and opaque references. Request text, email addresses, identity evidence and private messages are excluded from those alerts.

Provider processing and support may involve countries outside the UK or EEA. Our review of processing agreements, locations, subprocessors and applicable transfer safeguards is not yet complete. Contact us for the current information. We do not treat encryption or a storage-region setting as a substitute for those safeguards.

Cookies, storage and advertisements

When you save display preferences, we store a first-party preference cookie for one year. If signed in, we also save those settings to your account. You can reset them in Preferences. Exchange-rate requests are made by our server to Frankfurter with fixed currency codes; we do not send your account, country choice or searches to that provider.

Authentication uses cookies to maintain and secure your session. Cloudflare security checks may use device information and security storage. We do not currently use advertising tracking scripts or behavioural advertising profiles. Direct advertisements and sponsorships are selected by page placement. Following an advertiser link takes you to their website, where their privacy notice applies.

We will assess any new analytics, advertising or device-storage technology before introducing it and obtain consent where required. Signing out ends your current session; you can also use the account security controls to manage sessions.

Security and retention

Hosted connections use HTTPS. Private message bodies, verification responses, feedback details and privacy case details are encrypted in application storage. This is server-side encryption, not end-to-end encryption. Authorised services can decrypt information to provide the relevant feature. Encrypted backups are kept separately.

Information must be kept only as long as needed for its purpose, including justified legal and security requirements. Different rules apply to active accounts, business records, messages, verification, complaints and backups. The detailed periods and backup expiry policy have not yet been approved. Deleting a visible item does not automatically remove all audit or backup copies. We assess deletion requests individually and explain any lawful retention or backup restrictions.

Your rights and complaints

In Privacy and your data, verified account holders can download an account copy and request account deletion after a recent sign-in. Eligible accounts close immediately and their account-linked data is erased or redacted automatically. Requests involving shared business responsibilities, holds or retained records go to the privacy team. The account copy does not include every record held about you; use the request form for a wider search.

Depending on the circumstances, you may request access, correction, erasure, restriction, portability, or object to processing. You can withdraw consent where processing relies on it. You can remove saved listings and searches through your account. Other rights can be exercised using our privacy request form or privacy email.

We aim to respond without undue delay and within one calendar month for rights requests. If a lawful extension or identity clarification is needed, we will explain it. We use proportionate identity checks before disclosing or changing personal data. Requests are normally free. Seller evidence and publication reviews involve staff; automated controls also screen uploads, text and requests as described above.

You can complain to us about how we use personal data. We acknowledge complaints, investigate without undue delay and explain the outcome. You also have the right to complain to the Information Commissioner’s Office or, where EU GDPR applies, the competent EU supervisory authority, and seek a judicial remedy. You do not have to complete our process before exercising those rights.