1. Who we are

Varitya is an online marketplace operated by [LEGAL ENTITY NAME], trading as Varitya ("Varitya", "we", "us" or "our").

Company number: [COMPANY NUMBER]
Registered office: [REGISTERED OFFICE ADDRESS]
Privacy contact: [PRIVACY EMAIL]
Data Protection Officer: [DPO DETAILS / "We are not required to appoint a DPO"]
ICO registration number: [ICO REGISTRATION NUMBER, IF APPLICABLE]

For personal information for which Varitya determines the purposes and essential means of processing, the legal entity identified above is the data controller.

2. Scope of this Policy

This Policy applies to personal information handled through or in connection with:

• varitya.com and related Varitya web pages;
• the public marketplace and Store pages;
• Buyer registration and Buyer account areas;
• Seller registration, onboarding and Store management;
• Seller staff invitations, permissions and security administration;
• Product listings, wishlists and recently viewed items;
• cart, checkout, Orders and stock reservation;
• payment-provider integrations;
• returns, refunds, cancellations and disputes;
• reviews and ratings;
• Buyer–Seller messaging;
• Seller analytics and Platform Admin analytics;
• notifications and transactional email;
• Seller Subscription billing;
• security monitoring and audit logging;
• the Varitya progressive web application or browser-installed experience, where used; and
• support, legal, compliance and administrative communications.

This Policy does not replace a Seller's own privacy notice where that Seller independently determines how it uses personal information for its own business purposes.

3. Varitya, Sellers, controllers and processors

3.1 Varitya as controller

Varitya acts as controller for processing necessary to operate and administer the Platform, such as account administration, marketplace security, Platform communications, Seller subscriptions, Platform analytics, moderation and compliance.

3.2 Sellers as independent controllers

A Seller may act as an independent controller when it determines why and how to use Buyer information for its own sale, fulfilment, delivery, customer service, tax, warranty, returns, fraud-prevention or legal obligations.

3.3 Processor relationships

In some circumstances one organisation may process personal information on behalf of another under a written data-processing arrangement. Whether an organisation is a controller or processor depends on the actual processing activity and who decides its purposes and essential means.

3.4 Seller privacy responsibilities

Sellers must provide any privacy information that they are independently required to provide, use Buyer information only for lawful purposes and protect it appropriately.

4. Our data-protection principles

We aim to handle personal information in accordance with the following principles:

• Lawfulness, fairness and transparency: we identify a lawful basis and explain material uses of information.
• Purpose limitation: information is collected for specified and legitimate purposes.
• Data minimisation: we seek to use information that is adequate, relevant and limited to what is necessary.
• Accuracy: we take reasonable steps to keep important account and transaction information accurate.
• Storage limitation: we do not intend to retain identifiable information indefinitely without a legitimate reason.
• Security: we use appropriate technical and organisational safeguards.
• Accountability: we maintain policies, controls and records appropriate to our processing activities.

5. Personal information we collect

Depending on how you use Varitya, we may process the following categories.

Special category information

Varitya is not designed to require health, biometric, political, religious, sexual-life or other special category information for ordinary marketplace use. Please do not send such information through general marketplace messaging unless it is genuinely necessary and lawful. If we need to process special category information in an exceptional case, we will identify an appropriate legal basis and additional condition where required.

Criminal-offence information

We do not routinely request criminal-offence information. We may, however, receive or create information connected with suspected fraud, theft, prohibited transactions or law enforcement enquiries. Where such processing constitutes criminal-offence data, we will handle it only where legally permitted.

6. Where we obtain personal information

We may obtain information:

• directly from you when you register, edit your account, save an address, create a Store, list a Product, message another User or contact support;
• from Sellers when they create or manage Orders, fulfilment records, staff invitations, refunds or returns;
• from Buyers when they place Orders, submit reviews or raise requests;
• from Payment Providers through redirects, callbacks, APIs and webhook events;
• from hosting and security infrastructure through request logs and technical events;
• from your browser/device through cookies, local storage and HTTP/network information;
• from publicly available sources where necessary for lawful verification, rights protection or compliance;
• from competent authorities or professional advisers where relevant to a lawful enquiry; and
• from service providers that support delivery of the Platform.

7. Purposes and lawful bases for using personal information

The lawful basis depends on the specific processing. More than one basis may apply to different elements of the same service.

Legitimate interests

Where we rely on legitimate interests, our interests may include operating a secure and commercially sustainable marketplace, preventing fraud, protecting Users, enforcing marketplace rules, improving service reliability and establishing or defending legal claims. We assess whether the processing is necessary and whether your rights and interests override those interests.

Consent

Where consent is the lawful basis, you may withdraw it at any time. Withdrawal does not make earlier lawful processing unlawful.

Contract

Some information is required in order to create an account, provide Seller tools, facilitate an Order or provide another service you request. If required information is not provided, we may be unable to provide that function.

8. Buyer information

Buyer accounts may include name, email address, password-derived authentication records, saved addresses, marketplace-country preference, wishlist, recently viewed Products, Orders, messages, returns and review history.

We use Buyer information to:

• provide and secure the Buyer account;
• remember selected marketplace country and interface preferences;
• display Products available for the selected marketplace country;
• maintain wishlists and recently viewed items;
• create and administer store-separated Orders;
• provide Order history and tracking information;
• support returns, refunds and disputes;
• allow verified-purchase reviews;
• facilitate Buyer–Seller messaging; and
• send Order, account and security notifications.

9. Seller and Seller staff information

9.1 Seller Owners

We process Seller Owner information to create and administer Stores, connect marketplace payment methods, configure countries/currencies, shipping, branding, Products, staff and Seller Subscriptions.

9.2 Seller staff

Store Owners may invite staff by work email and assign roles/permissions. We may process staff name, email, invitation token/status, role, permissions, sign-in activity and security/audit events.

9.3 Seller payment credentials

Where the Platform permits a Seller to enter payment-provider credentials, those credentials are intended to be encrypted at rest. Sensitive merchant credentials are not made available to Buyer Users or ordinary Seller staff who lack the relevant owner-level access.

9.4 Seller verification and reporting

We may collect additional Seller identity, business or tax information where required for compliance, platform integrity, payment-provider requirements or digital-platform reporting. The precise information collected may depend on applicable law and the Seller's country.

10. Orders, fulfilment and returns

Varitya separates marketplace transactions by Store. An Order record may contain:

• Buyer identity and contact information;
• delivery address;
• Seller and Store identifiers;
• Product and variant snapshots;
• quantity, currency, price, discount, shipping and total information;
• payment-provider/reference and payment status;
• stock reservation and inventory movement information;
• carrier/tracking information;
• fulfilment/status history;
• return, cancellation, refund and dispute records; and
• messages relevant to the Order.

We preserve appropriate Order snapshots so that historical transactions remain intelligible even if a Seller later changes a Product listing.

11. Payments and Payment Providers

11.1 Buyer payments to Sellers

Customer payments for marketplace Orders are ordinarily processed through the relevant Seller's enabled payment integration. Depending on Store and country, this may include Stripe Connect, Paystack, Flutterwave or another provider enabled by Varitya.

The Payment Provider may collect card, bank, wallet or other financial information directly. Varitya ordinarily receives transaction references and status information needed to update the Order, rather than the Buyer's complete payment-card credentials.

11.2 Payment-provider privacy

Payment Providers process information under their own privacy notices and legal responsibilities. Buyers and Sellers should review the notice presented by the relevant provider.

11.3 Webhooks and verification

Varitya receives and verifies payment-related server notifications and may perform server-side transaction verification. We use these events to prevent duplicate processing, update payment state, reconcile transactions and administer refunds.

12. Seller Subscription billing

Seller Subscription billing is separate from Buyer payments to Sellers. We may process:

• Seller and Store identifier;
• plan and billing cycle;
• trial and subscription status;
• billing-provider customer/subscription references;
• invoice/payment state;
• billing events and webhook identifiers; and
• information needed to provide billing-portal access.

Where Stripe Billing or another billing provider is used, that provider also processes information under its own privacy notice.

13. Country, localisation and international shopping

Varitya uses a marketplace-country setting to determine which Products and Sellers are relevant to a visitor. An initial country may be inferred from hosting/proxy/browser signals or a Platform default, but Users can manually change the marketplace country.

We may store the User's chosen marketplace country in a cookie or browser storage so that the preference persists. The selected marketplace country is not intended to be a precise geolocation record.

A Buyer's delivery country and address are processed separately where needed for an Order.

14. Messages and customer support

Marketplace messaging is designed for Product enquiries and Order-related conversations. We may store message content, sender/recipient identifiers, Store/Order/Product context, timestamps and read/unread status.

We may access relevant messages where reasonably necessary to:

• provide support;
• resolve disputes;
• investigate fraud, harassment or prohibited activity;
• enforce Terms and marketplace policies; or
• comply with law.

Do not send passwords, complete card details or other unnecessary sensitive information through marketplace messages.

15. Reviews, ratings and public content

A published review may be visible to other marketplace visitors together with information necessary to present it appropriately, such as rating, text, date and an appropriately limited reviewer identity.

We may process Order linkage to verify that a review relates to a genuine purchase. Sellers cannot unilaterally edit or remove Buyer reviews, although Platform Admin may moderate content under applicable policies.

Do not include another person's private information in a public review.

16. Images, logos and Cloudinary-hosted media

Varitya supports uploads such as Product images, Store logos/banners and Platform branding. Where Cloudinary is configured, uploaded media may be transmitted to and hosted by Cloudinary or its infrastructure.

Uploaded images may contain personal information if a User chooses to include identifiable people, documents, addresses or other personal details. Users should avoid uploading unnecessary personal information in marketplace images.

17. Security, audit logs and fraud prevention

To protect Users and the Platform, we may record security events including:

• successful and failed sign-ins;
• blocked sign-in attempts;
• access-denied events;
• attempts by Seller staff to access owner-only areas;
• staff invitations, role changes, suspensions and removals;
• request route and HTTP method;
• IP address;
• browser/user-agent information;
• request ID;
• date/time and severity; and
• Store/User context where relevant.

Security logs are not intended to store passwords, payment-provider secret keys or complete payment-card credentials.

18. Technical, device and usage information

Web servers and application infrastructure ordinarily receive technical information when a User accesses Varitya. This may include IP address, request time, browser/user-agent, requested URL, referring page, response/status information and security metadata.

We use technical information for service delivery, debugging, performance, abuse prevention, security investigation and aggregate operational analysis.

19. Cookies, local storage and similar technologies

19.1 Essential technologies

Varitya uses browser technologies necessary for functions such as account sessions, security, cart continuity and interface preferences. For example, the Platform may use:

• signed session cookies;
• security/CSRF-related state;
• an opaque cart identifier or equivalent cart state;
• marketplace-country preference;
• Buyer Grid/List view preference;
• service-worker/PWA state; and
• other storage needed for requested functionality.

19.2 Non-essential technologies

If Varitya enables non-essential analytics, advertising, behavioural profiling or similar storage/access technologies that require consent, we will provide an appropriate consent mechanism before using them where required by law.

19.3 Cookie information

We recommend maintaining a separate Cookie Policy or cookie-preference panel listing the actual technologies, providers, purposes and durations used in production.

20. Analytics and service improvement

Varitya creates operational analytics for Sellers and Platform Admin. These may include sales, Orders, Products, countries, fulfilment, reviews, payment-gateway usage, subscription status, refunds and other marketplace metrics.

We aim to present financial reporting in a currency-safe manner and avoid combining unlike currencies into misleading totals.

Where possible, we use aggregated or de-identified information for trend analysis. If a third-party analytics service that uses non-essential cookies or similar technologies is introduced, this Policy and the cookie controls should be updated before deployment.

21. Marketing communications

We may send marketing only where permitted by applicable data-protection and electronic communications rules.

For individual subscribers, we will generally obtain consent unless a lawful soft opt-in or another permitted rule applies. Where a soft opt-in is relied on, it will be limited to circumstances in which the legal requirements are met.

Marketing consent is separate from accepting Terms or creating an account. We do not use pre-ticked boxes as evidence of consent.

Every applicable electronic marketing message will provide a simple means of opting out. You can also contact [MARKETING/PRIVACY EMAIL].

22. Transactional notifications

Operational communications are different from direct marketing. We may send messages that are necessary or reasonably expected for your use of Varitya, including:

• account verification and password-reset messages;
• security alerts;
• Seller staff invitations;
• Order and payment-status updates;
• shipping/tracking updates;
• return/refund/dispute updates;
• new marketplace message notifications;
• inventory or low-stock notifications to Sellers;
• Seller Subscription and billing notices; and
• material legal or service notices.

Where Varitya offers notification preferences, some non-essential operational notices may be configurable, while critical security or legal notices may not be optional.

23. Who we share personal information with

Depending on the transaction and service, we may disclose information to:

• the relevant Seller or authorised Seller staff;
• Payment Providers;
• cloud hosting/infrastructure providers;
• media hosting/processing providers;
• email/communications providers;
• delivery/carrier services where information is provided or integration is enabled;
• professional advisers, auditors and insurers;
• fraud-prevention or security providers;
• tax, regulatory, judicial or law-enforcement authorities where legally permitted or required;
• prospective purchasers/investors in a controlled business transaction, subject to appropriate safeguards; and
• other parties where you direct us to disclose information or validly consent.

We do not sell personal information to advertisers.

24. Information shared with Sellers

When a Buyer places an Order, the relevant Seller needs sufficient information to perform the sale. This may include:

• Buyer/recipient name;
• delivery address;
• contact information reasonably needed for fulfilment;
• Order items, variants and quantities;
• Order value/currency;
• payment-status information;
• Buyer messages and return/refund requests; and
• other information necessary to meet Seller legal obligations.

Sellers must not use Buyer information obtained through Varitya for unrelated marketing unless they independently have a lawful basis and comply with applicable electronic marketing rules.

25. Service providers and subprocessors

Varitya uses third-party technology to operate the Platform. Production providers may include, where configured:

Publication requirement: this table must be checked against the providers actually enabled in production. If Varitya maintains a separate Subprocessors page, that page should be kept consistent with this Policy.

26. Legal disclosures and authorities

We may preserve or disclose personal information where reasonably necessary and lawful to:

• comply with a court order, warrant, statutory request or other binding legal obligation;
• respond to regulators, tax authorities or law enforcement;
• protect the rights, property or safety of Varitya, Users or others;
• detect, investigate or prevent fraud, cybercrime or serious abuse;
• establish, exercise or defend legal claims; or
• comply with applicable digital-platform reporting duties.

Where lawful and appropriate, we assess requests for validity and proportionality before disclosure.

27. Corporate transactions and business transfers

If Varitya or its operating company is involved in a merger, acquisition, financing, restructuring, sale of assets or transfer of the marketplace business, personal information may be disclosed to professional advisers, potential counterparties and successors where reasonably necessary and subject to appropriate confidentiality and data-protection safeguards.

28. International transfers

Varitya is designed for international commerce and may use providers whose infrastructure, support personnel or group companies are located outside the United Kingdom.

Where UK data-protection rules treat a disclosure as a restricted international transfer, we will use an appropriate transfer mechanism where required. Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK Extension to the EU–US Data Privacy Framework where applicable;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to approved EU Standard Contractual Clauses;
• binding corporate rules or another approved safeguard; or
• a lawful exception where strictly applicable.

Where required, we assess the circumstances of transfers and any supplementary safeguards. You may contact us for information about the relevant safeguards.

29. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention, security, dispute-resolution and enforcement requirements.

We may retain anonymised or effectively de-identified statistical information for longer where it no longer identifies an individual.

30. How we protect personal information

We use technical and organisational measures proportionate to the nature of the Platform and the risks involved. Measures built into or planned for Varitya include:

• password hashing rather than storing plain-text passwords;
• signed HTTP-only session cookies;
• secure-cookie settings in production where appropriate;
• CSRF protection for browser write actions;
• rate limiting on authentication and sensitive write routes;
• security headers;
• server-side validation and role/permission checks;
• Store-scoped Seller staff permissions;
• encrypted storage for supported Seller payment-provider credentials;
• webhook signature verification and duplicate-event protection;
• request IDs and structured operational/error logging;
• security and access auditing;
• restricted access to owner-only payment and billing controls;
• database constraints/application validation appropriate to the hosting environment;
• graceful process handling and health/readiness checks; and
• controlled production deployment practices.

No method of internet transmission or storage is completely secure. Users must also protect their credentials and promptly report suspected account compromise.

31. Personal-data breaches

We maintain processes to assess suspected personal-data breaches. Where a breach meets the applicable legal reporting threshold, we will notify the Information Commissioner's Office within the legally required timeframe and provide further information as required.

Where a breach is likely to result in a high risk to affected individuals and notification is legally required, we will also communicate relevant information to those individuals without undue delay, subject to applicable exceptions.

32. Your data-protection rights

Depending on the processing and applicable law, you may have rights to:

• be informed about how your information is used;
• access your personal information and receive supplementary information;
• rectify inaccurate or incomplete information;
• erase personal information in applicable circumstances;
• restrict processing in applicable circumstances;
• data portability for qualifying information and processing;
• object to certain processing;
• withdraw consent where processing relies on consent; and
• receive protections in relation to certain automated decisions and profiling.

These rights are not all absolute. For example, legal retention obligations, the rights of others, fraud prevention or the establishment/defence of legal claims may affect what we can delete or disclose.

To exercise a right, contact [PRIVACY EMAIL]. We may request proportionate information to confirm identity and protect accounts from unauthorised requests.

33. Access requests

You may request confirmation of whether we process your personal information and, where applicable, a copy of that information together with legally required supplementary details.

We may need to redact information relating to other people or apply another lawful exemption. We will respond within the applicable statutory timeframe, subject to any lawful extension for complex or multiple requests.

34. Deletion and account closure

Closing an account does not necessarily mean that every record is immediately erased. We may need to retain limited information relating to completed Orders, refunds, payment records, tax/accounting duties, fraud prevention, disputes, safety investigations, security events or legal claims.

Where deletion is appropriate, we will delete or anonymise information in accordance with our retention process and technical capabilities.

36. Automated decision-making and profiling

Varitya uses automated logic for ordinary technical and marketplace functions, for example determining country eligibility, sorting/ranking Products, validating stock, checking access permissions, applying promotions and updating states from verified payment events.

[VERIFY BEFORE PUBLICATION] Varitya does not currently intend to make decisions based solely on automated processing that produce legal or similarly significant effects on an individual without appropriate safeguards.

If we introduce such processing, we will update this Policy and provide legally required information about the logic, significance, consequences and applicable rights.

37. Children's privacy

[CHOOSE AND VERIFY THE APPROPRIATE POSITION BEFORE PUBLICATION]

Option A — service not intended for children

Varitya is intended for adults who can lawfully enter into marketplace transactions and for authorised business Sellers. We do not knowingly invite children to create Seller accounts. If we learn that personal information has been collected from a child in circumstances where it should not have been collected, we will take appropriate steps.

Option B — service may be likely to be accessed by children

If Varitya is likely to be accessed by children in the UK, we will assess and implement the protections required by applicable law and the ICO's Children's Code, including consideration of children's best interests, age-appropriate transparency, data minimisation, privacy by default, geolocation, profiling and data-sharing practices.

38. Third-party sites and services

Varitya may contain links to Seller websites, social profiles, Payment Providers, carriers and other third-party services. Those third parties control their own websites and may have separate privacy practices.

This Policy does not govern independent third-party processing merely because Varitya links to or integrates with the service.

39. Changes to this Privacy Policy

We will review this Policy when our processing, service providers, legal obligations or Platform functionality materially change.

The "Last updated" date will be changed when this Policy is revised. Where a new use of personal information is materially different or otherwise requires specific notice or consent, we will provide additional information before beginning that processing where required by law.

40. Complaints and the Information Commissioner's Office

If you have a privacy concern, please contact us first so that we have an opportunity to investigate: [PRIVACY EMAIL].

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe that your personal information has been handled unlawfully. You can obtain current complaint and contact information from the ICO's official website.

If you are located outside the UK, you may also have rights to contact a competent local data-protection authority where applicable.

41. How to contact us

When contacting us about a privacy request, please do not send passwords, complete payment card details or unnecessary identity documents by ordinary email.