PRIVACY POLICY

iTrader.im - Online Vehicle Marketplace Effective on launch

1. WHO WE ARE

1.1 iTrader.im is a trading name of Code Lab Platforms Limited, a company incorporated in the Isle of Man (company number 139244C) whose registered office is at Ny Croityn, Bay View Road, Port Erin, Isle of Man, IM9 6NA ("Code Lab Platforms", "we", "us" or "our").

1.2 We are the data controller responsible for the personal data we collect and use in connection with the iTrader.im platform (the "Platform"). This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and what rights you have in relation to it.

1.3 This Privacy Policy applies to all users of the Platform, whether you are a visitor browsing Listings, a registered Private Seller, a Dealer, or a Buyer (each a "User", "you" or "your"). It should be read together with our Terms and Conditions and our Cookie Policy, which explains in more detail how we use cookies and similar technologies.

1.4 If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us using the details in clause 13 (Contact Us).

2. THE INFORMATION WE COLLECT

2.1 Account information. When you register an Account, we collect information such as your name, email address, telephone number, and, where applicable, your business name and trading details if you register as a Dealer. Authentication credentials are managed by our identity provider, Supabase, which stores credential hashes. The application does not store your password in encrypted or plain form.

2.2 Listing information. When you create a Listing, we collect the information you provide about the Vehicle, including its description, registration mark, mileage, price, insurance write-off category (None, Category N, or Category S), and any photographs or other Content you upload. Category N and Category S vehicles are a permitted exception to the general prohibition on advertising written-off vehicles, and only where that status is clearly and prominently disclosed.

2.3 Payment information. When you make a payment through the Platform, payment processing is carried out by Ripple, our appointed Payment Provider. We do not store your full card details or bank account credentials. We may receive limited transaction information from the Payment Provider, such as confirmation that a payment has been made, the amount, and a reference number, for the purpose of processing your order and maintaining our accounting records.

2.4 Communications. If you contact another User through the Platform's contact-seller form, or contact us directly (for example by email or through a contact form), the message is delivered through our email provider. We do not store contact messages in an application contact-message table. The provider may retain the message for delivery and operational purposes in accordance with its own terms.

2.5 Technical and usage information. When you use the Platform, we automatically collect certain technical information, including your IP address, device type, browser type and version, operating system, referral source, pages viewed, and the dates and times of your visits. Further detail on this is set out in our Cookie Policy.

2.6 Identity verification information. Where we need to verify your identity or your authority to sell a Vehicle (for example, as part of our fraud prevention measures under our Terms and Conditions), we may collect copies of identification documents, proof of address, or proof of ownership.

2.7 Information from third parties. We may receive information about you or a Vehicle from third parties, including our Payment Provider, fraud prevention and verification services, vehicle-data services used for Vehicle Check, and, where relevant, law enforcement or regulatory bodies.

2.8 Dealer reviews and responses. If you submit a dealer review, we collect the rating, optional comment, and the minimum information needed to prevent duplicate or abusive reviews. Reviews may be moderated, approved, rejected, or hidden. Reviewer names may be displayed where you provide them. Dealers may submit moderated public responses to approved written reviews. We also collect private dispute reasons, details, supporting-evidence notes, moderation decisions and audit records where a Dealer disputes an approved review. Disputes and their supporting information are visible only to the Dealer account and authorised administrators, while only the currently approved response is displayed publicly.

3. HOW WE USE YOUR INFORMATION AND OUR LAWFUL BASIS

3.1 We use your personal data for the following purposes, relying on the lawful bases indicated:

To create and administer your Account, and to provide the Service to you - necessary for the performance of our contract with you.

To publish and display your Listings on the Platform, and to enable Buyers and Sellers to communicate - necessary for the performance of our contract with you.

To process payments for Listings, upgrades, and subscriptions through our Payment Provider - necessary for the performance of our contract with you.

To verify your identity, investigate suspected fraud, and enforce our Terms and Conditions - necessary for our legitimate interests in maintaining a safe and trustworthy Platform, and, where relevant, to comply with a legal obligation.

To respond to your enquiries and provide customer support - necessary for the performance of our contract with you, or our legitimate interests in providing good service.

To send you service-related communications, such as confirmation of a Listing, renewal reminders, or notices about changes to the Platform - necessary for the performance of our contract with you.

To send you marketing communications about our services, where you have consented to receive them or where permitted under applicable law - based on your consent, or our legitimate interests, as applicable, and always with the ability for you to opt out.

To analyse and improve the Platform, including monitoring usage patterns and diagnosing technical issues - necessary for our legitimate interests in operating and improving our Service.

To comply with our legal and regulatory obligations, including tax, accounting, and reporting obligations, and to cooperate with law enforcement - necessary for compliance with a legal obligation, or our legitimate interests in cooperating with lawful authorities.

3.2 We will not use your personal data for a purpose materially different from those described in this Privacy Policy without notifying you and, where required, obtaining your consent.

4. SHARING YOUR INFORMATION

4.1 Other Users. Where you create a Listing, certain information (such as your first name, general location, and any contact details you choose to include) will be visible to other Users so that Buyers and Sellers can communicate. You should only include contact information in a Listing or message that you are comfortable sharing publicly or with prospective counterparties.

4.2 Payment Provider. We share the information necessary to process a payment with Ripple, our Payment Provider, which processes that information in accordance with its own privacy policy and terms.

4.3 Service providers (processors). We share personal data with third-party processors who support our operation of the Platform. The current processor categories include: Supabase (authentication and database hosting), Vercel (application hosting), Google (Google Analytics 4, if you consent to analytics, and advertising measurement only if you separately consent to marketing), Cloudinary (image hosting), Resend (transactional and, where consented, marketing email), Ripple (payment processing), and vehicle-data services used to supply Vehicle Check information. These providers act on our instructions and are contractually required to keep your data secure and to use it only for the purposes we specify. We do not claim that personal data is never shared with third parties.

4.4 Law enforcement and regulators. We may disclose personal data to the Isle of Man Constabulary, courts, regulators, or other public authorities where we are required to do so by law, or where we reasonably believe disclosure is necessary to prevent or investigate fraud, protect the rights and safety of Users or the public, or enforce our Terms and Conditions.

4.5 Business transfers. If we sell, transfer, or merge all or part of our business or assets, we may disclose personal data to a prospective or actual purchaser, provided that the recipient agrees to handle your personal data in a manner consistent with this Privacy Policy.

4.6 We do not sell your personal data to third parties for their own independent marketing purposes.

5. INTERNATIONAL TRANSFERS

5.1 Some of our service providers, including our Payment Provider and certain cloud hosting or software providers, may process personal data outside the Isle of Man, including in the United Kingdom, the European Economic Area, or elsewhere.

5.2 Where we transfer personal data outside the Isle of Man, we take steps to ensure it is protected to a standard consistent with Isle of Man data protection law, including by using service providers based in jurisdictions recognised as providing adequate protection, or by putting in place appropriate contractual safeguards such as standard contractual clauses.

6. DATA RETENTION

6.1 We retain personal data for as long as necessary to provide the Service to you, and thereafter for as long as necessary to comply with our legal and regulatory obligations, resolve disputes, prevent fraud, and enforce our agreements.

6.2 Our retention periods are: direct account and profile identifiers are removed or anonymised on approved deletion; Listing content and images are retained for 24 months after expiry or removal; anonymous and authenticated view events and monitoring events are retained for 90 days; contact messages are retained only under the email provider's delivery-retention arrangements; reports, moderation records, dealer reviews, dealer responses, response revisions, disputes and supporting evidence are retained for 24 months after closure or removal; and financial and legally necessary audit records are retained for at least six years. Dealer-authored response and dispute content is removed when an approved account-deletion job anonymises the Dealer account, unless a legal hold or legal obligation requires longer retention. Waitlist marketing use stops immediately on withdrawal or campaign closure, identifiers are anonymised after 30 days, and residual non-identifying evidence is retained for 24 months. A longer period applies where a legal hold, dispute, fraud investigation, or legal obligation requires it.

6.3 Where personal data is no longer required, we will securely delete or anonymise it.

7. YOUR RIGHTS

7.1 Subject to applicable law, you have the following rights in relation to your personal data:

the right to be informed about how we collect and use your personal data;

the right to access a copy of the personal data we hold about you;

the right to have inaccurate personal data corrected, or incomplete data completed;

the right to have your personal data erased in certain circumstances ("the right to be forgotten");

the right to restrict our processing of your personal data in certain circumstances;

the right to receive certain personal data in a structured, commonly used, machine-readable format, and to have it transferred to another controller ("data portability");

the right to object to our processing of your personal data in certain circumstances, including processing for direct marketing purposes;

the right to withdraw consent at any time, where our processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

7.2 To exercise any of these rights, please contact us using the details in clause 13. We may need to verify your identity before responding to a request, and we will respond within the timeframe required by applicable law.

7.3 You also have the right to lodge a complaint with the Information Commissioner of the Isle of Man if you believe we have not handled your personal data in accordance with applicable law. We would, however, appreciate the opportunity to address your concerns directly before you approach the Information Commissioner.

8. SECURITY

8.1 We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, secure hosting arrangements, and authentication credential hashing by our identity provider.

8.2 No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your Account password confidential and for notifying us promptly if you suspect any unauthorised access to your Account.

9. CHILDREN

9.1 The Platform is not directed at, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

10. MARKETING COMMUNICATIONS

10.1 Where you have consented to receive marketing communications from us, or where otherwise permitted by law, we may contact you about new features, products, and offers relevant to the Platform.

10.2 You can opt out of marketing communications at any time by using the unsubscribe link included in our marketing emails, by updating your Account preferences, or by contacting us using the details in clause 13. Opting out of marketing does not affect our ability to send you service-related communications necessary for the operation of your Account or a Listing.

11. COOKIES

11.1 We use cookies and similar technologies on the Platform to operate core functionality, remember your preferences, and, only with your consent, understand how the Platform is used. Continuing to use the Platform is not consent to non-essential cookies. Full details are set out in our Cookie Policy.

12. CHANGES TO THIS PRIVACY POLICY

12.1 We may update this Privacy Policy from time to time to reflect changes in our data practices, our services, or applicable law. Where we make a material change, we will take reasonable steps to notify you, for example by posting a notice on the Platform or by email.

12.2 The "last updated" date at the top of this Privacy Policy indicates when it was last revised. We encourage you to review this Privacy Policy periodically.

13. CONTACT US

13.1 If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us at:

Code Lab Platforms Limited, trading as iTrader.im

Registered office: Ny Croityn, Bay View Road, Port Erin, Isle of Man, IM9 6NA

Company number: 139244C

Email: hello@itrader.im