UK GDPR Compliance Statement

AnchorExchange is committed to protecting your personal data and respecting your privacy rights in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller Information

AnchorExchange operates as a data controller under UK data protection law and is responsible for deciding how we hold and use personal information about you.

2. Your Rights Under UK GDPR

Under the UK GDPR, you have the following rights regarding your personal data:

• Right to Access – You can request a copy of the personal data we hold about you.
• Right to Rectification – You can ask us to correct inaccurate or incomplete data.
• Right to Erasure – You can request deletion of your personal data in certain circumstances.
• Right to Restrict Processing – You can ask us to limit how we use your data.
• Right to Data Portability – You can request your data in a structured, commonly used format.
• Right to Object – You can object to certain types of processing, including direct marketing.
• Right to Withdraw Consent – Where we rely on consent, you can withdraw it at any time.
• Right to Lodge a Complaint – You can complain to the Information Commissioner's Office (ICO).

3. Legal Basis for Processing Your Data

We process your personal data under one or more of the following lawful bases as defined by UK GDPR:

Consent

Where you have given us clear consent to process your personal data for specific purposes, including:

• Email subscriptions and newsletters
• Marketing communications
• Optional cookies and analytics

Contract Performance

Where processing is necessary for the performance of a contract with you, including:

• User account registration and management
• Processing and displaying listings
• Processing payments and transactions
• Providing customer support

Legal Obligation

Where we must process your data to comply with legal requirements, such as:

• Tax and accounting obligations
• Regulatory compliance
• Legal proceedings or requests from authorities

Legitimate Interests

Where processing is necessary for our legitimate interests or those of a third party, provided your rights don't override these interests:

• Site analytics and performance monitoring
• Fraud prevention and security
• Service improvement and development
• Business administration and operations

4. What Personal Data We Collect

We collect and process the following categories of personal data:

Account Information

• Name and contact details (email address, phone number)
• Username and password (encrypted)
• Business name and registration details (for business accounts)
• Profile information and preferences

Listing Information

• Listing titles, descriptions, and categories
• Images and media uploads
• Location information
• Pricing and specification details

Payment and Transaction Data

• Payment information (processed securely by Stripe)
• Transaction history and invoices
• Billing address

Technical and Usage Data

• IP address and device information
• Browser type and version
• Pages visited and time spent on site
• Cookies and similar tracking technologies
• Referral sources

Communications

• Messages sent through our platform
• Customer support inquiries
• Feedback and survey responses

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• Account Management – To create, maintain, and secure your account
• Listing Services – To publish, display, and manage your marketplace listings
• Payment Processing – To handle transactions for paid services and subscriptions
• Communication – To send service updates, password resets, and respond to inquiries
• Analytics – To understand how our platform is used and improve user experience
• Security – To prevent fraud, abuse, and maintain platform integrity
• Marketing – To send promotional materials (only with your consent)
• Legal Compliance – To meet legal, regulatory, and contractual obligations

6. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

Retention Periods

• Active Accounts – Retained while your account remains active
• Inactive Accounts – Deleted after 24 months of inactivity (with prior notice)
• Listings – Retained while published and for 12 months after removal
• Transaction Records – Retained for 7 years for tax and accounting purposes
• Marketing Data – Deleted immediately upon unsubscribe request
• Analytics Data – Anonymized after 26 months

You may request early deletion of your data at any time by contacting us at privacy@anchorexchange.app.

7. Who We Share Your Data With

We never sell your personal data to third parties.

We may share your data with the following categories of recipients:

Service Providers and Processors

• Payment Processors – Stripe (for secure payment processing)
• Email Service Providers – Brevo (for transactional emails and newsletters)
• Analytics Providers – Open Web Analytics (self-hosted) and Google Analytics
• Hosting Providers – For website infrastructure and data storage
• Cloud Storage – For secure image and file uploads

Legal and Regulatory Bodies

We may disclose your data when required by law or to:

• Comply with legal processes, court orders, or government requests
• Enforce our terms of service
• Protect our rights, property, or safety, or that of others
• Prevent fraud or investigate suspected illegal activity

8. International Data Transfers

Some of our service providers may process personal data outside the United Kingdom. When personal data is transferred outside the UK, we ensure that adequate safeguards are in place as required by UK GDPR, such as:

• Approved Standard Contractual Clauses (SCCs)
• Adequacy decisions by the UK government
• Binding corporate rules
• Specific contractual protections

For more information about the safeguards we use, please contact us at privacy@anchorexchange.app.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience on our platform. For detailed information, please see our Cookie Policy.

Types of Cookies We Use

• Essential Cookies – Required for the website to function (login sessions, security)
• Analytics Cookies – Help us understand how visitors use our site
• Functional Cookies – Remember your preferences and settings
• Marketing Cookies – Used with your consent for targeted advertising

You can manage your cookie preferences through your browser settings or our cookie consent banner.

10. How We Protect Your Data

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• SSL/TLS encryption for data transmission
• Encrypted storage of sensitive data (passwords, payment information)
• Regular security audits and penetration testing
• Access controls and authentication mechanisms
• Regular data backups and disaster recovery procedures
• Staff training on data protection and security
• Secure development practices and code reviews

While we strive to protect your personal data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children under 16.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@anchorexchange.app and we will delete such information from our systems.

12. Automated Decision Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

Any automated processing (such as spam filtering or fraud detection) is used only to assist our manual review processes and does not result in automated decisions that affect your rights.

13. Contact Us About Your Data

Right to Complain

You have the right to lodge a complaint with the UK's supervisory authority for data protection:

14. Changes to This Policy

We may update this GDPR Compliance Statement from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons.

The latest version will always be available on this page with the updated date shown at the top. We encourage you to review this policy periodically.

If we make material changes that significantly affect your rights, we will notify you by email (if you have an account with us) or through a prominent notice on our website.

15. Compliance Statement

AnchorExchange is committed to full compliance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• All applicable UK data protection legislation

16. Related Policies

For more information about how we protect your privacy, please review our related policies:

• Privacy Policy
• Cookie Policy
• Terms of Service

---