Privacy Policy

1Introduction

1.1Purpose of this Privacy Policy

This Privacy Policy explains how Swapaya collects, uses, stores, shares and otherwise processes personal data when individuals access or use the Swapaya Platform.

It also explains the rights available to individuals under applicable data protection laws and how those rights may be exercised.

This Privacy Policy forms part of the legal framework governing the Platform and should be read together with the Terms and Conditions and the Platform Policies. Where there is any inconsistency regarding the processing of personal data, this Privacy Policy shall prevail.

1.2Scope

This Privacy Policy applies to all personal data processed through:

• the Swapaya mobile application;
• the Swapaya website (where available);
• customer support communications;
• marketing communications;
• and any other services operated by Swapaya.

It applies whether you create an Account, browse the Platform, contact us or otherwise interact with our Services.

1.3Applicable Laws

Swapaya processes personal data in accordance with applicable data protection legislation, including:

• the UK General Data Protection Regulation ("UK GDPR");
• the Data Protection Act 2018;
• the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), where applicable; and
• any other applicable data protection legislation.

2Who We Are

2.1Data Controller

Unless otherwise stated, the data controller responsible for processing your personal data is:

Digvijay Singh, trading as Swapaya

A sole trader established in England and Wales.

Contact address:

Flat 503 Dillon House
5 Bowen Drive
London SE7 7GB
United Kingdom

2.2Contact Details

If you have any questions regarding this Privacy Policy or the way we process personal data, you may contact us at:

Privacy enquiries:

privacy@swapaya.com

Legal enquiries:

legal@swapaya.com

Website:

www.swapaya.com

If required by applicable law, Swapaya may appoint a Data Protection Officer or another designated privacy contact in the future. The relevant contact details will be published in this Privacy Policy.

3Personal Data We Collect

The personal data we collect depends on how you use the Platform.

We do not intentionally collect more personal data than is reasonably necessary to operate the Platform, provide our Services, comply with legal obligations and protect the security of our users.

3.1Information You Provide

When creating an Account or using the Platform, you may provide:

• your username;
• your email address;
• your password (stored in encrypted form);
• your telephone number (where provided);
• your profile photograph;
• your profile biography;
• your approximate location;
• information contained within your Listings;
• photographs of Items;
• messages sent through the Platform;
• reports submitted to Swapaya;
• customer support requests;
• appeals relating to moderation decisions; and
• any other information you voluntarily choose to provide.

3.2Information Generated Through Your Use of the Platform

When you use the Platform we may generate or record information including:

• Listings you publish;
• Offers you make or receive;
• completed Swaps;
• QR Verification records;
• reports relating to your Account;
• moderation decisions;
• account status information;
• security logs;
• fraud prevention records;
• customer support history; and
• records relating to appeals.

3.3Technical Information

When you access the Platform we may automatically collect certain technical information, including:

• IP address;
• device identifiers;
• operating system;
• device model;
• application version;
• browser type (where applicable);
• language settings;
• crash reports;
• diagnostic information;
• security logs; and
• usage analytics.

3.4Location Information

Depending on your device settings, Swapaya may process:

• approximate location derived from your account or device information; and
• precise device location where you have chosen to grant permission.

You may withdraw permission for precise location through your device settings at any time.

4How We Use Your Personal Data

We process personal data only where we have a lawful basis for doing so.

Depending on how you use the Platform, we may use personal data for the following purposes.

4.1Providing the Platform

Including:

• creating and managing Accounts;
• enabling Listings;
• facilitating Offers and Swaps;
• enabling messaging between Users;
• recording completed Swaps;
• providing customer support.

4.2Operating and Improving the Platform

Including:

• improving Platform performance;
• maintaining Platform security;
• analysing Platform usage;
• developing new features;
• troubleshooting technical issues;
• preventing abuse.

4.3Safety and Fraud Prevention

Including:

• detecting fraudulent activity;
• preventing prohibited use;
• investigating reports;
• preventing spam;
• protecting Users;
• enforcing the Terms and Platform Policies.

4.4AI-Assisted Features

Where AI Features are used, personal data may be processed to:

• analyse Listing photographs;
• suggest Listing descriptions;
• suggest categories;
• improve search functionality;
• identify potentially prohibited Listings;
• assist moderation processes.

AI processing is described in greater detail in the AI Transparency Policy.

4.5Communications

We use personal data to:

• respond to support requests;
• notify Users about their Account;
• send important security notifications;
• communicate changes to our legal documents;
• send marketing communications where permitted by law.

4.6Legal Compliance

We may process personal data where reasonably necessary to:

• comply with legal obligations;
• respond to lawful requests from public authorities;
• establish, exercise or defend legal claims;
• protect the rights, safety and security of Swapaya, our Users and third parties.

5Legal Bases for Processing

Depending on the circumstances, Swapaya relies on one or more lawful bases under applicable data protection legislation.

5.1Performance of a Contract

We process personal data where necessary to provide the Platform and perform our contractual obligations to Users, including creating Accounts, facilitating Listings, enabling messaging and operating core Platform functionality.

5.2Legitimate Interests

We process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

These legitimate interests include:

• operating and improving the Platform;
• maintaining Platform security;
• preventing fraud and abuse;
• protecting Users;
• analysing Platform performance;
• improving AI-assisted features;
• enforcing our legal rights;
• responding to complaints and disputes.

5.3Compliance with Legal Obligations

We process personal data where necessary to comply with applicable laws, regulatory requirements, court orders or lawful requests from competent authorities.

5.4Consent

Where required by law, we will request your consent before processing personal data.

This may include:

• optional marketing communications;
• precise device location;
• optional device permissions; and
• any other processing activities requiring consent under applicable law.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6AI Processing and Automated Technologies

6.1AI Features

Swapaya may use artificial intelligence ("AI") and machine-learning technologies to support the operation of the Platform.

AI may process personal data and other information submitted through the Platform for purposes including:

• assisting Users in creating Listings;
• analysing photographs of Items;
• suggesting categories, titles and descriptions;
• improving search results and recommendations;
• detecting potentially prohibited or unlawful Content;
• identifying suspicious or potentially fraudulent activity; and
• supporting moderation and safety processes.

AI is intended to assist the operation of the Platform and does not replace human judgement.

6.2Human Oversight

Where AI is used to assist moderation or fraud detection, significant enforcement decisions are not based solely on automated processing.

Where appropriate, automated assessments may be reviewed by appropriately authorised personnel before enforcement action is taken.

Users may also have the right to challenge certain decisions in accordance with applicable law and the Content Moderation & Appeals Policy.

6.3Improving AI Systems

We may use information generated through the use of the Platform to evaluate, improve and develop AI-assisted features.

Where reasonably possible, we use aggregated, anonymised or de-identified information for these purposes.

We do not use private user messages to train publicly available artificial intelligence models.

7Sharing Your Personal Data

Swapaya does not sell your personal data.

We only disclose personal data where necessary to operate the Platform, comply with legal obligations or protect the rights, safety and security of our Users and the Platform.

7.1Service Providers

We may share personal data with carefully selected service providers acting on our behalf, including providers of:

• cloud hosting;
• authentication services;
• customer support systems;
• analytics;
• mapping and geolocation services;
• email delivery;
• artificial intelligence services;
• security monitoring;
• data storage; and
• technical infrastructure.

These providers process personal data only on our documented instructions and are required to implement appropriate security measures.

7.2Legal and Regulatory Disclosure

We may disclose personal data where reasonably necessary to:

• comply with applicable law;
• comply with a court order or other legally binding request;
• protect the rights, property or safety of Swapaya, our Users or third parties;
• investigate suspected unlawful activity;
• establish, exercise or defend legal claims.

7.3Business Transfers

If Swapaya undergoes a merger, acquisition, investment, restructuring or sale of assets, personal data may be transferred as part of that transaction.

Where required by law, affected Users will be informed.

8International Transfers

Swapaya is established in the United Kingdom.

Some of our service providers may process personal data outside the United Kingdom or the European Economic Area ("EEA").

Whenever personal data is transferred internationally, we take reasonable steps to ensure that an appropriate level of protection is maintained.

8.1Safeguards

Where required, international transfers are protected through one or more of the following mechanisms:

• adequacy regulations recognised by the UK Government;
• adequacy decisions adopted by the European Commission;
• the European Commission's Standard Contractual Clauses ("SCCs");
• the UK International Data Transfer Addendum; or
• any other transfer mechanism recognised under applicable data protection legislation.

8.2Further Information

You may contact us using the details provided in this Privacy Policy if you would like further information regarding the safeguards applied to international transfers.

9Data Retention

Swapaya retains personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on the nature of the information and the purpose for which it was collected.

9.1Account Information

We retain Account information while your Account remains active.

Following Account closure, certain information may be retained where reasonably necessary to:

• comply with legal obligations;
• investigate fraud;
• resolve disputes;
• enforce our legal rights;
• maintain appropriate security records.

9.2Listings and User Content

Listings, photographs and other User Content may remain available until removed by the User or otherwise removed in accordance with the Terms and Conditions.

Following removal, copies may continue to be retained for a limited period within backup systems or where necessary for legal compliance, fraud prevention or dispute resolution.

9.3Messages

Messages exchanged through the Platform may be retained for a reasonable period after an Account is closed where necessary to:

• investigate abuse;
• respond to legal requests;
• enforce our legal rights;
• maintain Platform security.

9.4Technical and Security Records

Technical logs, security records and similar information may be retained for as long as reasonably necessary to protect the Platform, detect fraud, investigate security incidents and comply with legal obligations.

9.5Anonymised Information

Information that has been irreversibly anonymised so that it can no longer identify an individual may be retained indefinitely for statistical, analytical and business purposes.

10Security of Personal Data

Swapaya takes the security of personal data seriously and implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

10.1Security Measures

Depending on the nature of the processing, these measures may include:

• encryption of data in transit;
• secure authentication mechanisms;
• role-based access controls;
• monitoring and logging;
• vulnerability management;
• secure cloud infrastructure;
• regular software updates;
• incident response procedures.

10.2User Responsibilities

Users are responsible for maintaining the confidentiality of their Account credentials and should notify Swapaya promptly if they believe their Account has been compromised.

10.3No Absolute Security

Although we use reasonable security measures designed to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.

Users acknowledge that the transmission of information over the internet is undertaken at their own risk.

11Your Privacy Rights

Depending on your location and the applicable data protection legislation, you may have certain rights regarding the personal data that Swapaya processes about you.

These rights are not absolute and may be subject to legal conditions or exemptions.

11.1Right of Access

You may request confirmation as to whether we process your personal data and, where we do, request access to that information together with certain additional information required by applicable law.

11.2Right to Rectification

If you believe that personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated.

Where possible, you may also update certain information directly through your Account settings.

11.3Right to Erasure

You may request that we delete your personal data where:

• the information is no longer necessary for the purposes for which it was collected;
• you withdraw consent where processing is based on consent;
• you successfully object to processing;
• the processing is unlawful; or
• deletion is otherwise required by applicable law.

This right does not apply where we are required or permitted by law to retain certain information.

11.4Right to Restrict Processing

In certain circumstances, you may request that we temporarily restrict the processing of your personal data while a concern or objection is investigated.

11.5Right to Data Portability

Where applicable, you may request a copy of certain personal data that you have provided to us in a structured, commonly used and machine-readable format.

Where technically feasible, you may also request that the data be transmitted directly to another organisation.

11.6Right to Object

You may object to certain processing carried out on the basis of our legitimate interests.

Where you object, we will consider your request in accordance with applicable law.

11.7Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

11.8Exercising Your Rights

You may exercise your privacy rights by contacting us using the contact details provided in this Privacy Policy.

We may request reasonable information to verify your identity before responding to a request.

We will respond within the time periods required by applicable law.

12Marketing Communications

12.1Service Communications

Certain communications are necessary for the operation and security of the Platform.

These may include communications relating to:

• your Account;
• security alerts;
• completed Swaps;
• changes to the Platform;
• updates to our legal documents; and
• customer support.

These communications form part of the Services and cannot generally be opted out of while you continue to use the Platform.

12.2Marketing Communications

Where permitted by applicable law, Swapaya may send marketing communications regarding:

• new Platform features;
• promotions;
• events;
• referral programmes;
• sustainability initiatives; and
• other information relating to Swapaya.

Where consent is required by law, we will obtain it before sending marketing communications.

12.3Opting Out

You may unsubscribe from marketing communications at any time by:

• using the unsubscribe link included in the communication;
• updating your communication preferences within the Platform (where available); or
• contacting Swapaya.

Opting out of marketing communications does not affect service-related communications.

13Cookies and Similar Technologies

13.1Use of Cookies

The Swapaya website and certain Platform features may use cookies or similar technologies to support the operation of the Services.

These technologies may be used to:

• maintain user sessions;
• remember preferences;
• improve security;
• analyse Platform usage;
• measure performance; and
• improve the user experience.

13.2Consent

Where required by applicable law, we will request your consent before placing non-essential cookies or similar technologies on your device.

You may withdraw or modify your consent at any time using the cookie preferences made available through the Platform or website.

13.3Cookie Policy

Swapaya may publish a separate Cookie Policy providing additional information regarding the cookies and similar technologies used by the Platform.

14Children's Privacy

Swapaya is intended exclusively for individuals who are at least 18 years of age.

We do not knowingly collect personal data from children.

If we become aware that personal data has been collected from a person under the age permitted to use the Platform, we will take reasonable steps to remove the relevant Account and delete the associated personal data, unless we are required to retain it by law.

If you believe that a child has provided personal data to Swapaya, please contact us using the details provided in this Privacy Policy.

15Third-Party Services

15.1Third Party Services

The Platform relies on a number of third-party service providers to operate efficiently and securely.

Depending on the functionality used, these providers may process personal data on our behalf.

These providers may include:

• cloud hosting providers;
• authentication providers;
• mapping and geolocation providers;
• analytics providers;
• customer support providers;
• email delivery providers;
• artificial intelligence providers;
• content delivery providers;
• security service providers.

Where third parties process personal data on our behalf, they do so under appropriate contractual arrangements designed to protect personal data and comply with applicable data protection legislation.

The use of third-party websites or services that are not operated by Swapaya is governed by the privacy policies of those third parties.

16Changes to this Privacy Policy

16.1Updates

We may update this Privacy Policy from time to time to reflect changes to:

• applicable laws and regulations;
• the Platform and its functionality;
• our business operations;
• our service providers;
• our data processing activities; or
• our security practices.

16.2Notification of Material Changes

Where changes materially affect the way we process personal data, we will take reasonable steps to notify Users before those changes take effect.

Notification may be provided through:

• the Platform;
• email;
• or another appropriate communication channel.

Minor amendments, corrections or changes required solely to comply with legal obligations may take effect immediately where appropriate.

16.3Continued Use

By continuing to use the Platform after an updated Privacy Policy takes effect, you acknowledge the revised Privacy Policy.

Where applicable law requires your consent for particular processing activities, we will seek that consent separately where required.

17Complaints

If you believe that Swapaya has not handled your personal data in accordance with applicable data protection legislation, we encourage you to contact us first so that we have the opportunity to investigate and resolve your concerns.

Nothing in this Privacy Policy affects your right to submit a complaint to the competent data protection authority.

17.1United Kingdom

If you are located in the United Kingdom, you may submit a complaint to:

Information Commissioner's Office (ICO)

https://ico.org.uk/

17.2European Economic Area

If you are located in the European Economic Area, you may submit a complaint to the data protection supervisory authority in the Member State where:

• you normally reside;
• you work; or
• the alleged infringement occurred.

End of Policy

End of Privacy Policy · Questions? legal@swapaya.com