1. Lawful Basis for Processing Personal Data: For the purposes of GDPR, when selling on ebay, I process all personal data lawfully, fairly and in a transparent manner. Under Art.6 of GDPR, the lawful basis on which I process personal data that I receive from ebay & Paypal (method of payment) is that of "Contract", whereby processing is necessary to fulfil buyer orders and enquiries. I may retain such data provided by ebay on transaction information for internal, financial, accounting, and audit purposes. It is a legal requirement to retain this information for a period of 7 years.

2. Data Received/Personally Identifiable Information: I receive personally identifiable information from ebay & paypal only when voluntarily submitted by buyers placing an on-line order. The data received can include: name, billing address, delivery name, delivery address, e-mail address (encrypted format), contact number, order date, value and/or number of items ordered, delivery method. I do not sell nor rent any personally identifiable information to third parties for any purpose.

3. Use of Personal information: In accordance with current legal requirements, I may use personal buyer information provided by ebay and paypal to: i) process and dispatch buyers’ orders so as to fulfil my contractual obligation to the buyer; ii) carry out regulatory checks to meet my legal obligations; iii) prevent and detect crime; iv) develop internal, anonymised, analysis on stock sales (with no ability to identify individuals from data). I treat all information held about buyers as private and confidential.

I will not disclose any personal details or data concerning buyers’ orders to anyone not connected with me, unless: i) a buyer asks me to reveal such information or I have a buyer’s permission to do so; ii) I were required or permitted to do so by law; iii) it is required by law enforcement or fraud prevention. I lawfully share buyer personal information with my service providers and contractors (such as Royal Mail, ebay Global Shipping Centre) to fulfil orders that buyers place with me on ebay. All information shared is subject to this Privacy Notice.

4. Data Subject Access Requests: Under GDPR, buyers are entitled to obtain from me (a Data Processor for the purposes of GDPR when selling on ebay) a copy of the data held concerning them, and to have any inaccuracies in the data rectified. In accordance with current regulations, I am obliged to provide this data to the buyer within 1 calendar month of the request, and free of charge. However I have the right to refuse or charge for requests manifestly unfounded or excessive and repetitive.