Privacy Policy

01 —Who we are

The peer-to-peer fashion marketplace at reluv.co.uk is operated by Reluv Ltd (“Reluv”), a company registered in England and Wales under company number 17271596, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For the purposes of UK data protection law, Reluv is the data controller — that means we decide how and why your personal data is processed. We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration number ZC182698.

Reluv acts as data controller for account registration, platform activity, and fraud prevention data. For payment processing and certain identity (KYC) checks, Stripe acts as an independent controller or as our processor, as described in its own privacy policy. Where a third-party provider processes your data on our behalf, we put appropriate contractual safeguards in place; we are not responsible for the independent processing activities of providers such as Stripe beyond ensuring those safeguards exist and that the provider processes data in accordance with applicable law.

You can contact us about anything in this policy at privacy@reluv.co.uk.

02 —What data we collect and why

We only collect data that is necessary to run the platform, process transactions, prevent fraud, and meet legal obligations. Here is a plain-English breakdown.

Account registration

Selling

Buying

Platform activity

Fraud prevention and safety

Site analytics — only with your consent

If — and only if — you consent to analytics cookies in our cookie banner, we use Google Analytics (alongside our cookieless tools) to understand, in aggregate, how the site is used so we can improve it. None of this is collected before you opt in, and you can withdraw your consent at any time (see section 8).

Advertising measurement — only with your consent

If — and only if — you consent to advertising cookies in our cookie banner, we collect the following to measure how well our own advertising for Reluv performs on Meta (Facebook and Instagram), TikTok, and Google (Google Ads). None of this is collected before you opt in, and you can withdraw your consent at any time (see section 8).

Mobile apps

When you use our mobile applications, we may additionally collect the following.

In-app advertising measurement — with your consent only. With your consent, our apps also use the Meta (Facebook) and TikTok software development kits (SDKs) to measure and improve our own advertising — for example, to understand which ads brought you to Reluv. Until you accept the advertising option in our consent banner, these SDKs are not started and no data is sent to Meta or TikTok from the app. On Apple devices we will additionally ask for the iOS “allow tracking” permission (App Tracking Transparency); if you do not allow it, neither SDK is enabled at all — even if you accepted our banner — and we receive only anonymous, aggregate install statistics provided by Apple (SKAdNetwork). You can withdraw your consent at any time via “Cookie preferences” in the footer, which stops in-app sharing with Meta and TikTok; on Apple devices you can also change the tracking permission in Settings → Privacy & Security → Tracking.

When you have consented (and, on iOS, allowed tracking), this covers:

Meta and TikTok process data collected through their SDKs for their own purposes as independent (and in some respects joint) controllers; see their own privacy policies. Both companies process data in the United States — the safeguards described in section 6 apply.

03 —Legal basis for processing

UK GDPR requires us to have a lawful reason for processing your personal data. We rely on the following lawful bases:

• Contract performance — processing that is necessary to operate your account, complete a transaction, arrange shipping, or handle a dispute. Without this data we cannot provide the service.
• Legitimate interest — fraud prevention, ban enforcement, IP logging for security, and retaining dispute evidence. We have carried out balancing tests and concluded that our legitimate interests in preventing fraud, ban evasion, and prohibited business selling, and in protecting the safety and integrity of the Platform, are not overridden by the impact on your rights and freedoms in these specific circumstances. You can object to processing on this basis (see section 10).
• Legitimate interest — sending you activity notifications for things you have chosen to follow on the Platform, such as letting you know when a shop you follow lists new items. These are part of the following feature you opted into, not marketing, and you can turn them off at any time in your notification settings (or via the unsubscribe link in the email).
• Legitimate interest — listing screening (fraud, IP, safety and quality): preventing fraud, protecting intellectual-property rights and buyers, detecting prohibited or illegal items, and maintaining the quality and safety of the marketplace. Our duties under the Online Safety Act 2023 reinforce these interests. We have carried out a Legitimate Interests Assessment and a Data Protection Impact Assessment for this processing.
• Legal obligation — retaining transaction records for HMRC and other applicable UK law. We cannot honour deletion requests for data we are required by law to keep.
• Consent — sending you marketing emails (Reluv news, offers and tips), only if you have opted in. This is entirely optional, never required to use Reluv, and you can withdraw it at any time in your notification settings or via the unsubscribe link in any marketing email.
• Consent — setting optional analytics cookies (Google Analytics and our cookieless tools) and advertising cookies (the Meta and TikTok pixels), and sharing the related analytics and conversion data described in section 2, only if you have opted in via our cookie banner. Entirely optional, never required to use Reluv, and withdrawable at any time via “Cookie preferences” in the footer (see section 8).

04 —How we use your data

We use the data described in section 2 to:

• Create and maintain your account.
• Process payments, hold funds securely with Stripe, and release them to sellers.
• Generate and manage shipping labels through Parcel2Go (and the carriers it books, such as Royal Mail, Evri, and Yodel).
• Send transactional emails (order confirmations, dispute updates, shipping notifications) via Resend.
• Send transactional push notifications to your device if you use our mobile apps and have notifications enabled.
• Notify you about activity you have chosen to follow — for example, a daily email and in-app updates when shops you follow list new items. You can turn these off in your notification settings.
• Resolve disputes fairly — we review messages and evidence from both parties.
• Detect and prevent fraud, ban evasion, and other abuse of the platform.
• Let you block other Users and act on those blocks to prevent unwanted contact, and keep the Platform safe.
• Keep Reluv a marketplace for private individuals — we use sales activity and the declaration you give when selling to identify and prevent prohibited business selling.
• Meet our legal obligations, including UK tax law and digital-platform reporting to HMRC (DAC7).
• Respond to your support requests.
• Send you marketing emails (news, offers and tips) — only if you have opted in, and you can unsubscribe at any time.
• Measure and improve our own advertising for Reluv on Meta, TikTok and Google — only if you have consented to advertising cookies, and you can withdraw that consent at any time (see section 8).

Screening listings. We review the listings and listing images you submit to check compliance with our Terms and to detect prohibited items, counterfeit or replica goods, stock or catalogue images used as cover photos, and poor-quality photos. This review is carried out both manually and by automated means, including an AI tool provided by a third-party processor. The automated screening is directed at the item being sold and the photograph itself — it is not used to identify or analyse any person who may appear in a photo. Your images are sent to our processor only for this analysis: the processor does not use your content to train its models, and retains it only briefly to operate the service and prevent misuse, after which it is deleted. We keep only the resulting assessment (a flag, a confidence score and a short internal note), not the images.

Promoting Reluv. We may feature your own item photographs, together with the item details, to promote and advertise the Platform — on our website and apps, in emails, on our social media accounts, and in paid advertising on third-party platforms. We use your own photographs only (never third-party stock or manufacturer images), and only to promote Reluv itself — not to build a profile of you or to target you with ads. You can opt out at any time in your account settings or by emailing marketing@reluv.co.uk; the full terms of this licence are in the User-generated content section of our Terms & Conditions.

05 —Who we share your data with

We share data only with the third-party providers and partners listed below, and only to the extent necessary for them to perform their service.

We may also disclose personal data if required to do so by law, court order, or a regulatory authority, or if necessary to protect the rights or safety of Reluv or its users.

06 —International transfers

Reluv is a UK-based service. Some of our third-party processors (Stripe, Resend, Vercel, Anthropic, Google) operate infrastructure in the United States and other countries outside the UK and the European Economic Area. Separately, where you have consented to advertising cookies, our advertising partners Meta and TikTok act as independent (and in some respects joint) controllers rather than processors, and process and transfer data under their own arrangements and safeguards.

Where your data is transferred outside the UK, we ensure it is protected by appropriate safeguards, which may include:

• UK adequacy regulations (for countries the ICO has deemed adequate);
• Standard contractual clauses (SCCs) approved by the ICO; or
• The processor's participation in a recognised certification framework.

Some processing by our AI provider (Anthropic) takes place in the United States. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (incorporated into our provider's data-processing agreement), supported by a transfer risk assessment, to ensure an equivalent level of protection. Where our provider is certified under the UK Extension to the EU–US Data Privacy Framework, that framework may also apply.

Google (Google Ads). We contract with Google LLC in the United States. That transfer is covered by the UK extension to the EU–US Data Privacy Framework and, where that does not apply, by standard contractual clauses together with the UK International Data Transfer Addendum.

You can contact us at privacy@reluv.co.uk if you would like further information about the specific safeguards in place for any transfer.

07 —How long we keep your data

When a deletion request is made, we will confirm whether a legal hold applies to any part of your data and, if so, explain what is retained and for how long.

08 —Cookies and similar technologies

We use cookies and similar technologies. Some are strictly necessary to run the site (for example, to keep you signed in) and do not require your consent under PECR. With your consent, we also use analytics cookies (to understand how the site is used and improve it) and advertising cookies — including the Meta Pixel, the TikTok Pixel and the Google Ads conversion tag — to measure and improve our advertising and reach people who might like Reluv. We do not set any analytics or advertising cookie until you accept it. You can accept or reject non-essential cookies when you first visit, and change your choice at any time via “Cookie preferences” in the footer — rejecting is as easy as accepting. Meta, TikTok and Google process data collected through these tags for their own purposes as independent (and in some respects joint) controllers; see their own privacy policies. A full list of the cookies we use, their purpose and how long they last is set out in the table below.

Vercel Web Analytics and Speed Insights are cookieless — they set no cookies and the data they collect is aggregated. Google Analytics, which we also use with your analytics consent, does set cookies (the _ga and _ga_<id> cookies listed above) and shares aggregated usage data with Google. We set no analytics or advertising cookie until you accept it. If you withdraw analytics consent, we stop Google Analytics and delete its cookies from your browser; if you withdraw consent for advertising cookies, we stop the sharing with Meta and TikTok and delete the advertising cookies listed above from your browser.

09 —How we protect your data

We take appropriate technical and organisational measures to protect your personal data. In particular:

• All traffic between your device and Reluv is encrypted in transit (HTTPS/TLS), and our databases and file storage are encrypted at rest.
• Passwords are stored only as salted one-way hashes — we cannot read them.
• Payment card details are tokenised and held by Stripe; they never touch our servers.
• Dispute evidence is stored in a private bucket and is accessible only via short-lived signed links.
• Access to personal data is restricted to staff who need it to operate the platform and handle disputes.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the ICO and, where required, affected users in accordance with UK GDPR.

10 —Your rights

Under UK GDPR you have the following rights over your personal data:

• Access — you can ask for a copy of the personal data we hold about you.
• Rectification — you can ask us to correct inaccurate data.
• Erasure — you can ask us to delete your data, and you can delete your account yourself at any time in the app (Settings → Security) or by emailing privacy@reluv.co.uk. When you delete your account, we erase or irreversibly anonymise your identifying data within 30 days, as set out in “How long we keep it”, except where a legal hold applies. This right is not absolute: we will explain any legal hold that prevents full deletion.
• Portability — you can ask for your data in a structured, machine-readable format so you can transfer it to another service.
• Restriction — you can ask us to pause processing of your data while a dispute or investigation is ongoing.
• Objection — you can object to processing based on our legitimate interest (for example, IP logging for fraud prevention). We will stop unless we can show a compelling legitimate ground that overrides your interests.
• Withdraw consent — where processing is based on your consent (marketing emails, analytics and advertising cookies), you can withdraw it at any time — via your notification settings or the unsubscribe link for emails, and via “Cookie preferences” in the footer for cookies. Withdrawal stops the processing going forward; it does not affect the lawfulness of processing before you withdrew.

Automated decisions. Some of our fraud-prevention, ban-evasion and safety checks use automated signals, and we use automated tools to help screen listings; an order may also be cancelled automatically if a Seller misses the dispatch deadline. These automated steps flag or pause activity for review — they do not, on their own, make decisions that significantly affect you. Any decision to remove or suspend a listing, to suspend or ban an account, or to resolve a dispute is reviewed and decided by a member of our team. Where we take such action you will receive a statement of reasons and can ask us to review the decision, make representations and obtain human intervention — by raising a support ticket (your removal notice includes a reference code) or by emailing privacy@reluv.co.uk.

To exercise any of these rights, email privacy@reluv.co.uk. We will respond within one month. We may ask you to verify your identity before we action a request.

11 —Children

Reluv is intended for users who are 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at privacy@reluv.co.uk and we will delete it promptly.

12 —Changes to this policy

We may update this policy from time to time to reflect changes in how we operate or in applicable law. When we make a material change, we will notify registered users by email and update the “Last updated” date at the top of this page. We encourage you to review the policy periodically.

Continued use of Reluv after a notified change constitutes acceptance of the updated policy. If you do not agree with a change, you can delete your account before it takes effect.

13 —Contact and complaints

If you have a question or concern about how we handle your data, please contact us first — we would like the chance to resolve it directly.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):