Privacy Policy.

1. Who is the data controller

Rapideal is the data controller for the personal data we collect through the Platform. Our contact details are at the bottom of this policy.

2. What personal data we collect

Account data: name, email address, password (stored hashed), account type (seller, buyer, admin).

Verification data: proof of identity (passport, driving licence, or company registration), proof of address (utility bill, bank statement), and proof of funds (bank statement, mortgage agreement in principle, or bridging finance offer) when required.

Transaction data: bid amounts, bid timestamps, financial types, accept/decline decisions, deposit payments, bank transfer references, and auction results.

Communications data: emails sent to and from us, including bid notifications, deposit instructions, and transaction briefs.

Technical data: IP address, browser type, device type, pages visited, and authentication events. We use this to operate the Platform, detect fraud, and improve our service.

Cookie data: see our Cookie Policy for details.

3. How we use your personal data

We use your personal data to: (a) operate the Platform and provide our services; (b) verify your identity and financial standing; (c) process bids, transactions, and deposits; (d) send you transactional emails (bid confirmations, deposit instructions, transaction briefs); (e) detect and prevent fraud, money laundering, and other illegal activity; (f) comply with our legal obligations; and (g) improve the Platform.

4. Lawful basis for processing

We process your personal data under the following lawful bases under the UK GDPR:

• Performance of a contract — to provide our auction services to you.
• Legal obligation — to comply with anti-money-laundering, proceeds-of-crime, and tax reporting laws.
• Legitimate interests — to detect fraud, secure the Platform, and improve our services.
• Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.

5. Who we share your data with

We share your personal data only with:

• The other party to a transaction (seller sees buyer's contact details after the £500 deposit is received; buyer sees seller's contact details after).
• Solicitors instructed on a transaction (both parties' solicitors receive a deal brief).
• Service providers (hosting, email delivery, payment processing) who act as data processors under contract.
• Law enforcement and regulators when required by law.

We never sell your personal data.

6. International transfers

Some of our service providers (e.g. our email delivery infrastructure) may transfer your personal data outside the UK. Where this happens, we ensure the transfer is covered by appropriate safeguards (UK adequacy regulations, Standard Contractual Clauses, or equivalent).

7. How long we keep your data

We keep your account data for as long as your account is active. We keep transaction records for 7 years after the transaction closes, to comply with HMRC and anti-money-laundering record-keeping requirements. We keep technical logs for 12 months.

8. Your rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate personal data.
• Erasure of personal data (subject to legal retention obligations).
• Restriction of processing.
• Data portability (receive your data in a structured, machine-readable format).
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, email privacy@rapideal.co.uk. We respond within 1 month.

9. Security

We use industry-standard security measures to protect your personal data: TLS encryption in transit, bcrypt-hashed passwords, segregated database access, audit logging, and restricted employee access. Despite our efforts, no system is perfectly secure — if you suspect a data breach, contact us immediately.

10. Automated decision-making

We use automated systems to detect fraudulent bids and accounts. These decisions are reviewed by a human before any action is taken that affects your account. You have the right to contest any automated decision.

11. Children

The Platform is not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have, contact privacy@rapideal.co.uk.

12. Contact us

Rapideal — Data Protection Officer
Email: privacy@rapideal.co.uk

You can also complain to the Information Commissioner's Office at ico.org.uk.