DRAFT — LEGAL REVIEW REQUIRED
This document has not been approved by legal counsel and is not yet in force.

Privacy Policy (payments and Stripe update)
Version 0.1

How personal data connected to marketplace payments, Stripe and Payment Protection is used.

1. About this update

This update to the Privacy Policy (/legal/privacy) describes personal data connected to marketplace payments and Stripe. Blackwellen Limited (Propvora) is the controller for the marketplace data described here. Contact details are in section 11.

2. Payment-related data we process

- order and transaction records: items, prices, fees, tax lines, dates and statuses;
- payment status, Stripe customer and account identifiers, and payment, transfer, payout and refund references;
- fraud and risk signals, including results returned by Stripe;
- dispute, chargeback and resolution case records and evidence you supply;
- for Providers, the status of their Stripe account, requirements due, agreement acceptance records and the outcome of identity and business verification;
- receipts, statements and communications about payments.

We do not store full card numbers. Card details are collected and processed by Stripe.

3. What Stripe does

Stripe provides payment services under its own terms. For its own regulated and fraud-prevention purposes Stripe acts as an independent controller, and its privacy notice (https://stripe.com/gb/privacy) explains how it uses data. For Providers, Stripe collects identity and bank details directly through its hosted onboarding.

4. Why we use it and our legal bases

- to take payments, release them under the rules you agreed, refund them and keep records (contract);
- to meet tax, accounting and anti-fraud obligations (legal obligation);
- to prevent and investigate fraud and misuse and to run disputes (legitimate interests);
- to send service messages about payments, releases, refunds, disputes and fee or terms changes (contract and legitimate interests).

5. Sharing

We share data with Stripe; with the other party to an order so that the order can be performed; with our service providers under contract; and with regulators, courts and law enforcement where the law requires or permits. We do not sell personal data.

6. International transfers

Stripe and our other providers may process data outside the UK. Where they do, we rely on adequacy regulations or appropriate safeguards such as the UK addendum to standard contractual clauses.

7. Retention

We keep order, payment and accounting records for six years from the end of the financial year to which they relate, dispute records for [period to be confirmed by Propvora], and other data as set out in the main Privacy Policy.

8. Automated decisions

Stripe and our systems may use automated fraud checks that can lead to a payment being paused or declined. You can ask for a person to review a decision that significantly affects you.

9. Your rights

You have rights of access, correction, erasure, restriction, portability and objection, and the right to complain to the Information Commissioner's Office. Some records must be kept for legal reasons.

10. Cookies

Payment pages may use technologies provided by Stripe for security and fraud prevention. See the Cookie Policy (/legal/cookies).

11. Contact

Contact [legal email not yet configured] or write to 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. ICO registration: ZB905402.