Privacy notice

1. Who is responsible

1. 1.1Angelina Clayfield, who runs Assaypost, is the controller of the personal data described here: the person who decides what is collected and what is done with it. In this notice “we” means Angelina Clayfield trading as Assaypost. No Information Commissioner's Office registration number is given here, because the registration has not yet been made. Write to us at Unit 172, 14-15 Triangle South, Clifton, Bristol, BS8 1EY. Email messinabenni@gmail.com. Telephone 07369 296063. You can also reach us through the contact page.

2. What we collect and why

1. 2.1Every kind of data we hold is in the table below, with the reason we hold it, the lawful basis under UK GDPR and how long it stays.
2. 2.2None of it is used for marketing. There is no mailing list, there is no newsletter, and nothing is sent to you that you did not ask for. If you decline an offer, we do not write to you about it again, and if you ask a question and never come back, nothing follows you.
3. 2.3Two of the rows below are more revealing than the rest, and each has a section of its own: photographs of your possessions at section 6, and identity documents at section 7. A record we may have to make about a suspected offence is at section 8.

Scroll sideways for more →

The three forms on this website are not taking submissions at present, so nothing in the rows above is reaching this website today. WhatsApp and the telephone reach the same person, and both work. The periods stated are the ones that apply from the moment a form is open again; anything held outside this website keeps the case file periods in section 3.2.

Photographs and messages sent on WhatsApp, and anything given by telephone or email, are held in the same case file as a website request and are deleted on the case-file periods in section 3.2. They are not added to a marketing list, and the message itself stays in the messaging account it arrived in until the case file is closed and deleted.

3. How long we keep it

1. 3.1What you send through this website (the details you type and any photographs) is deleted 90 days after you send it. Deletion is automatic and runs every day. It removes the record, the photographs and the waiting notice that tells us your request arrived, all together. Ask us sooner and we will delete it sooner.
2. 3.2The case file period is six years from a completed transaction, which covers the six years in which a claim about a contract can normally be brought and the time HMRC expects a sole trader's records to be kept, or twelve months from your last contact where no transaction took place. That period covers the transaction and accounting records described above, which are kept in our case and accounting systems rather than on this website. Identity documents have a shorter period of their own, set out in section 7.3. Anything held on consent stops when you withdraw it.
3. 3.3Deletion means deletion, not archiving. When a period ends the record is removed rather than moved somewhere quieter, and the same applies to the copy in any backup as that backup rotates. If you ask us to delete something and the law requires us to keep a part of it, such as an accounting record, we delete the rest and tell you exactly what was kept and why.

4. Who can see it

1. 4.1Inside the business, the person handling your case and anyone reviewing a complaint about it. Photographs sit in private storage that the public website cannot reach (there is no address on this site that serves them), and identity documents are kept apart from the case file with access logged.
2. 4.2Outside it: the carrier sees the name and address on your label; our bank sees what is needed to make the payment; our accountant sees the transaction records; and the police or another law-enforcement body sees a report where we make one. Two different things sit behind that last item, and they should not be run together. Sometimes we are compelled: a court order or a production order, which we comply with and, where we are permitted to, tell you about. Sometimes we are not compelled and report anyway, because we suspect an item is stolen or that money laundering is involved. This business is not supervised for money laundering, so that second kind of report is a voluntary one we have chosen to make, not a duty imposed on us. Section 8 sets out when we would, and what you are told. We do not sell personal data and we do not share it for anyone's marketing.
3. 4.3Everyone who handles your data works to written instructions and only on what their part of the job needs. Access to identity documents and to the records described in section 8 is logged, and the log is kept for as long as the record is.

5. Where it is stored, and whether it leaves the UK

1. 5.1This website runs on Vercel. Its server functions for this site are configured to run in Vercel's London region, so the ordinary handling of a form you submit happens in the United Kingdom. Vercel Inc. is a United States company, so the US authorities could in principle ask it for data wherever its servers are.
2. 5.2Where a processor is outside the United Kingdom, UK data protection law allows the transfer only under a specific mechanism: the UK's International Data Transfer Agreement, the UK Addendum to the European standard contractual clauses, or adequacy regulations covering the country concerned. A general assurance that a provider offers “equivalent safeguards” is not one of those mechanisms.
3. 5.3The only other processor this website would use is the relay that emails you the acknowledgement when a form is received, which necessarily sees your email address and your reference. No relay is connected at present, so nothing is sent to one and no address leaves this site by that route.

The transfer document for the hosting provider has not yet been signed and no email relay has been chosen, so neither is named here with the mechanism that covers it. A list of processors, the country each is in and the document relied on for each is yours on request.

6. Photographs of your things

1. 6.1A photograph of your items is personal data about you, and it is among the most revealing data this business will ever hold: with the offer beside it, it says what you own and what it is worth, and with an address on the same record it says where those things are. We treat it accordingly.
2. 6.2We hold three kinds. The photographs you send us before posting, to get a rough idea. The photographs we take when your parcel arrives, of the unopened parcel and then of each item as it is unpacked. And, where you took one, the photograph you took yourself before sealing the parcel and sent us because something was in dispute. All three are held to perform the contract between us and to be able to prove what arrived. None of them is held on consent, or for any interest of ours in advertising.
3. 6.3Photographs you send through this website are deleted with the rest of your request, 90 days after you send it. Photographs taken here on arrival are kept with the case file for the case file period in section 3.2 and are then deleted. Photographs are stored privately: there is no address on this website that serves them, and the public site cannot reach them at all.
4. 6.4Ask and they are deleted. One line through the contact page with your reference is enough, you do not have to give a reason, and we do not ask you to justify it. If a case is still open we will tell you what we will no longer be able to evidence if they go, and then do as you ask.
5. 6.5Your photographs are never used to advertise anything. Not on this website, not on a social account, not in a case study, not blurred, not cropped, and not “anonymised”. A piece of jewellery is as identifiable as a face to the family that owned it. If we ever wanted to show a piece, we would ask you separately and specifically for that one use, at a time when you have already been paid and have nothing to gain by saying yes; a refusal would change nothing about your sale, and consent given could be withdrawn afterwards. There is no box on any form that does this quietly, and there never will be.

7. Identity documents

1. 7.1We ask for a photograph of one government-issued photo identity document before the first payment to any seller, and for entitlement documents such as a grant of probate where an item has been inherited. The responsible sourcing page says when and why.
2. 7.2What we keep is the document and the date it was checked. A document sent through this website, once the forms are switched on, is held apart from the case file, encrypted in transit and at rest wherever the storage supports it, and every opening of it is logged with who opened it and when. A document sent by WhatsApp or email is downloaded to that store and deleted from the message thread once the store is in use. We do not pass it to a third party for verification.
3. 7.3Only the person handling your case and, if there is a complaint, the person reviewing it can open it. It is deleted five years after the transaction, and if no transaction happens it is deleted when the case closes rather than kept in case you come back.
4. 7.4You may cover anything on the document we do not need. We need the photograph, the name, the date of birth and the expiry date; you are welcome to mask a document number or an address, and we will say so if what is left cannot do the job.

8. Suspicions, offences and the police

1. 8.1If we come to suspect that an item is stolen, or that a sale involves the proceeds of crime, we make a record of the suspicion and of what we did about it. That record is data about a suspected criminal offence, which UK data protection law treats separately from everything else in this notice. We hold it under the substantial public interest condition for the prevention or detection of an unlawful act, at Schedule 1 Part 2 paragraph 10 of the Data Protection Act 2018, and it is kept apart from your case file with access logged.
2. 8.2A suspicion is not a finding. The record says what was seen and what was done, not that anybody did anything; if the matter is resolved in your favour, that is recorded on the same file so that the record cannot be read on its own as though nothing had followed it.
3. 8.3You are told that an item is being held and why, promptly, unless telling you would itself be unlawful or the police have asked us not to. The full procedure (what triggers a hold, what happens to the item, how long it can last and how you challenge it) is on the responsible sourcing page. Where the law prevents us from telling you, we say nothing rather than say something misleading, and we tell you as soon as we are allowed to.

Relying on a Schedule 1 Part 2 condition also requires an Appropriate Policy Document under Schedule 1 Part 4, which has to exist, be reviewed and be produced to the Information Commissioner on request. It has not yet been written, so this section describes how such a record would be handled rather than a control already in place.

9. Your rights

1. 9.1You can ask for a copy of your data, have it corrected or erased, restrict what we do with it, object to our using it, and receive it in a portable form. Where we rely on consent you can withdraw it at any time, and doing so does not make anything lawful that happened before.
2. 9.2Write to us through the contact page and we will answer within a month. There is no charge. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. The ICO recommends raising a concern with the organisation first in most cases, so please tell us and we will try to put it right.
3. 9.3Two limits, stated rather than discovered. Where the law requires us to keep a record (accounting, or a record under section 8), a request to erase it will be refused as to that record, and we will tell you which one and under what rule. And a request about the section 8 record may be answered in limited terms, or not at all, where answering it would prejudice the prevention or detection of crime; if that ever happens we will tell you that a restriction applies, unless even that is not permitted.

10. Cookies and analytics

1. 10.1The cookies page lists every cookie this site can set, what it does and how long it lasts. No analytics provider is running, so no analytics cookies are set whatever you choose.

11. Changes to this notice

1. 11.1When this notice changes, the version, the date and the change history at the foot of the page change with it, and the history says what changed rather than only that something did. This notice is reviewed at least once every twelve months, and whenever what we collect or who processes it changes before that.