What we collect
We collect the minimum personal data needed to run the marketplace and meet our legal obligations:
- Account information: email address, display name, handle, country, and account preferences.
- Identity & payment information (Sellers): we do not hold your bank details or full ID documents. Stripe Connect handles seller identity verification and payouts. We receive only a confirmation status and the last 4 digits of your linked bank account.
- Listing & transaction data: Listings you create, items you buy or watch, offers you send or receive, and the resulting payment status.
- Communications: messages exchanged with other users on the platform, and emails you send to support.
- Device & usage data: IP address, browser type, device type, pages visited, and interactions. This is collected via essential and analytics cookies (see §5).
- Where you came from: when you join we keep the campaign tags on the link you arrived by, the name of the site that sent you, the page you landed on, and, if you came from an ad, which platform it was, so we can see which posts and ads actually bring people in. Never the full web address you came from, and never the advertising click id itself. It is deleted when your account is closed.
- First-order offer: to keep the offer to one per person and one per delivery address, when you use it we keep a one-way hash of your delivery address (never the address itself), the fingerprint Stripe gives the card you pay with (it identifies the card, not its number), and notes of what those checks found. If you leave the checkout unpaid, the claim and its hash are usually deleted within 3 hours, or within 25 hours if your bank's security check was left open. Otherwise we delete the hash and the card fingerprint when your account is closed, and keep the record that the saving was given with the order's records.
We do not collect special-category personal data (e.g. health, biometric, political).
How we use it
We use your personal data only for the following purposes:
- Provide the service: create your account, display your Listings, route messages, and surface relevant search results.
- Fulfil orders: route payment via Stripe, share shipping addresses between Buyer and Seller for a confirmed order, and track delivery via Royal Mail.
- Communicate: send transactional emails (sign-in links, order confirmations, dispute updates) and, with your consent, occasional marketing emails. You can withdraw marketing consent at any time.
- Comply with law: meet our obligations under the Money Laundering Regulations 2017, the Consumer Rights Act 2015, and UK tax law, and respond to lawful requests from authorities.
- Improve the service: analyse aggregated usage to find and fix bugs, prioritise features, and detect fraudulent behaviour.
Legal basis
Under UK GDPR we rely on the following legal bases:
- Contract: processing necessary to provide the service to you, including processing your account, Listings, and orders.
- Legitimate interests: running the marketplace safely (e.g. fraud detection, abuse prevention), measuring usage, and improving the product.
- Consent: marketing emails and non-essential analytics cookies. You can withdraw consent at any time without affecting prior lawful processing.
- Legal obligation: tax records, anti-money-laundering checks, and responses to lawful authority requests.
Your rights
Under UK GDPR you have the right to:
- Access your personal data and obtain a copy.
- Rectify inaccurate or incomplete data we hold about you.
- Erase your data (the “right to be forgotten”), subject to our retention obligations below.
- Restrict processing while a complaint is being reviewed.
- Object to processing based on legitimate interests, including direct marketing.
- Portability: receive your data in a structured, machine-readable format.
- Withdraw consent at any time, for the processing that relies on consent.
To exercise any of these rights, email privacy@thegemmint.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
Data retention
We retain personal data only as long as needed:
- Account data: for as long as your account is active. Closing your account erases it straight away. The order records we must keep by law stay for 6 years, without your name.
- Transaction records: 6 years from the date of the transaction, to comply with HMRC record-keeping rules.
- Messages between members: deleted 12 months after they are sent.
- Marketing consent records: for as long as the consent applies, plus 12 months after withdrawal.
International transfers
Some of our processors (Stripe, Supabase, Resend, PostHog Inc., Auctane LLC, Vercel Inc. and Functional Software, Inc. (Sentry)) are US-headquartered and may transfer data outside the UK. PostHog stores the analytics it receives on its EU servers, in Germany. Sentry stores the error reports it receives on its EU servers, in Germany. Auctane, which buys our postage labels through ShipStation, processes the delivery details on each label in the United States. We rely on the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs) to ensure equivalent protections apply. We choose EU-region hosting where it is offered.
Under-18s policy
TheGemMint is not intended for users under 18. We do not knowingly collect personal data from anyone under 18.
If you believe a child's data has been collected, please contact privacy@thegemmint.co.uk and we will delete it as soon as possible (within 30 days). Where the data must be retained for legal or fraud-prevention reasons, we will document the retention basis and review it on a 12-month cycle.
See also our Terms of Service · Age requirement.
Contact our DPO
Data Protection enquiries
Data controller: TheGemMint Ltd, 66 Paul Street, London EC2A 4NA
Company number: 17200360 (England & Wales)
DPO contact: privacy@thegemmint.co.uk
Supervisory authority: UK Information Commissioner's Office (ico.org.uk)