Privacy notice
Pre-counsel draft. This is the platform's first full draft of this instrument, written for review by counsel rather than as a placeholder. It is not legal advice and is not yet the published text. Bracketed drafting notes mark the points counsel is asked to settle; the wording outside them states what the service actually does.
1. Who this covers
This notice describes what the Provider, which operates the platform (the "Service"), does as controller with the personal data it holds for its own purposes: the accounts people use to sign in to the Provider's own parts of the Service, as a member of a customer's team or of the Provider's own staff, and the contact and billing records of the customers it contracts with. What a site does with a person's account there, and with their registration, bids, orders and messages, is decided by the customer that runs it, which is the controller of that data and whose own notice describes it; the Provider processes that data only as the customer's processor, under the data processing agreement. [Drafting note: the Provider's identity and contact details, and any representative or data protection officer applicable law requires, are fixed at adoption.]
2. What is held
For an account: its sign-in address and any name given with it; the credentials proving it, a password being held only as a hash; the record of its sessions and sign-in attempts; and the teams it belongs to. For a customer: its legal name, its contact details, the agreements it accepted and the legal entity they bind, and its billing records.
3. Why
To operate accounts and their access; to keep the Service and its customers secure and to prevent abuse; to administer the Provider's relationship with its customers, including contracts, billing and support; to operate and evidence the handling of privacy requests; and to meet legal obligations the Provider is itself under. Each processing purpose is registered, and the register governs what is done with each field.
4. How long
Each type of record is kept for the period its own purpose needs and is then deleted or anonymised; retention is declared per record type rather than as one blanket period. An account not signed in to for three years is anonymised: the person's name and address are removed and the record of what the account did remains without them. Thirty days' notice is sent first to the account's address, and signing in during that time keeps the account. A customer's identity and billing records are kept for as long as its relationship with the Provider lasts and for ten years after it ends, as accounting law requires, and are then anonymised. A record a legal obligation or a legal claim requires is kept for as long as that requires.
5. Rights
Access, rectification, erasure, restriction, portability and objection are exercised through the Service's own privacy request process, which confirms that the person asking controls the address the request came from before it answers.
6. Sharing and transfers
Personal data is shared with the infrastructure and service providers the Service runs on, listed in the Provider's published register of sub-processors, under contract and only as the Service requires. It is not sold. Where personal data is transferred out of a country or region whose law restricts that, the transfer is made only with a safeguard that law recognises.