Privacy Notice

1. Who we are

The Watch Platform connects private sellers of watches with vetted UK dealers through sealed bids, and lets approved dealers trade with each other. This notice explains what personal information we hold, why, who can see it, how long we keep it and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

We are the controller of your personal information. The Watch Platform is a trading name of [LEGAL ENTITY NAME], a company registered in England and Wales (company number [NUMBER]), registered with the Information Commissioner's Office under number [ICO REGISTRATION NUMBER].

Newtown House, Newtown Road, Henley-on-Thames, Oxfordshire, RG9 1HG, United Kingdom

Data protection contact: DPO@thewatchplatform.com

Please use this address for any question about your information or to exercise your rights.

2. Information we collect

We collect what you give us, what is created when you use the platform, and a small amount from other sources.

Everyone with an account

• Email address, name, telephone number, country and address
• Password (stored only in scrambled, one-way form by our authentication provider; we cannot read it)
• Account role (seller, dealer or administrator) and account status
• If you sign in with Google: your Google account identifier, email address, name and profile picture link

Sellers

• Watch details: brand, model, reference number, year, condition, ownership details, alterations, how often it is worn, box, papers and receipt, purchase date, whether bought new, description, asking price and buy-it-now price
• Photographs you upload
• Bids you receive, offers you accept, and messages with dealers

Dealers

• Business details: company, registered and trading names, Companies House number, VAT number, business type, trading start date, year established, trading address, website, biography and logo
• The names, roles and email addresses of you and any team members you invite
• Annual watch sales volume, information about your KYC (know-your-customer) procedures, and trade association memberships
• Bids you place, bid amendment history, comments, messages, reviews you receive, and dealer-to-dealer listings, bids and partner lists
• Records of which listings you have viewed

Created when you use the platform

• Payment records (see section 5)
• Server and security logs: IP address, browser and device type, access times, errors and security events
• Email records: delivery, bounces, unsubscribes and, for some emails, whether they were opened or links clicked (see section 5)
• Messages sent through our contact form

From other sources

• Companies House and VAT registration checks, to verify dealers
• Google, if you choose Google sign-in
• Stripe, which tells us whether a payment succeeded

Please do not include personal details such as your phone number, email address or postcode in watch descriptions or messages. The platform automatically checks this text and blocks contact details, to protect you.

3. How we use it and our lawful basis

UK GDPR requires a lawful basis for each use of your information. The table shows ours.

Where we rely on legitimate interests, we have weighed our interests against yours. You can object at any time (section 9). Where we rely on consent, you can withdraw it at any time without affecting earlier use.

4. Who can see your information

Dealers never see a seller's name, email, phone number or address through the platform. We do not sell personal information.

On the platform

Once a seller contacts a dealer to complete a sale, that dealer becomes responsible for the information it receives, under its own privacy notice.

Service providers

These organisations process information for us under contract, or as independent controllers where stated.

We may also disclose information where the law requires it, to enforce our terms, or to protect users, ourselves or others. If our business is sold or restructured, information may pass to the new owner under this notice.

5. Payments, cookies and email tracking

Payments

Stripe processes all card payments. Card numbers, security codes and payment credentials never reach our systems. We keep only the Stripe payment reference, amount, currency, status, time and the listing or submission it relates to. Stripe collects billing and fraud-prevention information as an independent controller; see Stripe's privacy policy.

Cookies and browser storage

We use essential cookies and browser storage to keep you signed in, remember your cookie choices and remember interface settings. We use non-essential cookies only with your consent. Details are in our Cookie Policy.

Email tracking

Some of our emails contain a small image or tracked links that tell us whether an email was opened or a link clicked. We use this to check our emails arrive and are useful. Where the law requires your consent for this, we ask for it, and you can withdraw it at any time in your account settings or by contacting us. Tracked links only ever take you to our own site or the page stated in the email.

6. Where your information is stored

Our database and photo storage are in a data centre in Frankfurt, Germany. The UK recognises the European Economic Area as giving adequate protection, so no further safeguards are needed for this.

Some providers, including Stripe, Google and our email provider, may process information in the United States or elsewhere. Where they do, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Agreement or Addendum. You can ask us for details of the safeguard used.

7. How long we keep it

We keep information only as long as we need it. When you delete your account, we erase or anonymise your personal details within [30] days, except the records below that the law requires us to keep.

8. Data security

We implement technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encrypted connections (HTTPS)
• Access controls
• Authentication protections
• Secure hosting infrastructure
• Payment processing through PCI-compliant providers

While no system can guarantee absolute security, we continually work to maintain appropriate safeguards.

9. Your rights

Under UK GDPR, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of personal data
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent where applicable
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, please contact: DPO@thewatchplatform.com

We may need to verify your identity before responding to certain requests.

10. Complaints

If you are unhappy with how we handle your personal information, we encourage you to contact us first.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: https://www.ico.org.uk

11. Changes to this notice

We may update this notice periodically to reflect changes in our services, legal obligations, or business practices.

Any updates will be published on this page and the "Last Updated" date will be amended accordingly.

Continued use of the platform after changes become effective constitutes acceptance of the revised notice.