Privacy Notice

1. Controller and scope

EMEN ECOMMERCE MANAGEMENT LTD (company number 15300650), 12 London Road, Morden, England, SM4 5BQ is the controller for account, marketplace, security and support processing described here. Independent sellers are separately responsible for buyer data they receive to fulfil orders and meet legal obligations.

2. Data we collect

• Account and contact data, login and email-verification records.
• Seller identity, trader, tax, registration and verification evidence.
• Listings, orders, delivery addresses, messages, disputes, reports and support records.
• Payment references and transaction status from a payment provider; EmenCraft does not need to store full card details.
• Security logs, device/browser data, IP hashes, cookie preferences and audit events.

3. Purposes and lawful bases

• Contract: create accounts, operate shops, prepare and fulfil orders, provide messaging and support.
• Legal obligation: tax reporting, consumer protection, accounting, safety, regulatory requests and fraud records.
• Legitimate interests: secure the service, prevent abuse, moderate content, improve reliability and defend legal claims, balanced against user rights.
• Consent: optional cookies, marketing and any processing that specifically requires consent. Consent may be withdrawn without affecting earlier lawful processing.

4. Sharing

Data is shared only as necessary with the relevant buyer or seller, hosting and security providers, payment and delivery providers, professional advisers, and competent authorities. Providers must be contractually controlled and receive only the data needed for their role.

International transfers require an approved safeguard, such as an adequacy decision or contractual protections, plus supplementary measures where needed.

5. Retention schedule

• Account profile: while active, then normally up to 24 months after closure unless another rule requires longer retention.
• Orders, payments, seller earnings and tax records: normally 7 years after the relevant financial year.
• Seller verification records: while selling and normally 5 years after the seller relationship ends, subject to tax, fraud and legal requirements.
• Messages and ordinary support records: normally 3 years after the conversation closes.
• Disputes, reports, appeals and IP notices: normally 6 years after final resolution.
• Security and audit logs: normally 12 months, extended only for an active incident, investigation or legal claim.
• Unsubmitted uploads and temporary files: normally deleted within 24 hours; rejected verification uploads within 30 days unless preservation is required.
• Cookie consent records: normally 24 months after the last update.

6. Rights and complaints

Depending on the law that applies, users may request access, correction, erasure, restriction, portability or objection and may withdraw consent. Requests can be opened in Account → Privacy. Identity may be verified before disclosure.

Users may complain to the UK Information Commissioner’s Office or their local data-protection authority. EmenCraft asks for the opportunity to investigate first but this is not required.