Privacy Policy (payments and Stripe update)

This update to the Privacy Policy describes personal data connected to marketplace payments and Stripe. Blackwellen Limited (Propvora) is the controller for the marketplace data described here. Contact details are in section 11.

• order and transaction records: items, prices, fees, tax lines, dates and statuses;
• payment status, Stripe customer and account identifiers, and payment, transfer, payout and refund references;
• fraud and risk signals, including results returned by Stripe;
• dispute, chargeback and resolution case records and evidence you supply;
• for Providers, the status of their Stripe account, requirements due, agreement acceptance records and the outcome of identity and business verification;
• receipts, statements and communications about payments.

We do not store full card numbers. Card details are collected and processed by Stripe.

Stripe provides payment services under its own terms. For its own regulated and fraud-prevention purposes Stripe acts as an independent controller, and its privacy notice explains how it uses data. For Providers, Stripe collects identity and bank details directly through its hosted onboarding.

• to take payments, release them under the rules you agreed, refund them and keep records (contract);
• to meet tax, accounting and anti-fraud obligations (legal obligation);
• to prevent and investigate fraud and misuse and to run disputes (legitimate interests);
• to send service messages about payments, releases, refunds, disputes and fee or terms changes (contract and legitimate interests).

We share data with Stripe; with the other party to an order so that the order can be performed; with our service providers under contract; and with regulators, courts and law enforcement where the law requires or permits. We do not sell personal data.

Stripe and our other providers may process data outside the UK. Where they do, we rely on adequacy regulations or appropriate safeguards such as the UK addendum to standard contractual clauses.

We keep order, payment and accounting records for six years from the end of the financial year to which they relate, dispute records for [period to be confirmed by Propvora], and other data as set out in the main Privacy Policy.

Stripe and our systems may use automated fraud checks that can lead to a payment being paused or declined. You can ask for a person to review a decision that significantly affects you.

You have rights of access, correction, erasure, restriction, portability and objection, and the right to complain to the Information Commissioner's Office. Some records must be kept for legal reasons.

Payment pages may use technologies provided by Stripe for security and fraud prevention. See the Cookie Policy.

Contact [legal email not yet configured] or write to 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom. ICO registration: ZB905402.