Privacy policy

1. Who is responsible

QUANTUM LIME LTD (company number 16377380, registered office: 167-169 Great Portland Street, London, England, W1W 5PF, United Kingdom) is the controller of personal data under the UK GDPR and the Data Protection Act 2018. The service is offered under the trading name Lootzy at https://lootzy.com.

Privacy questions: privacy@lootzy.com. Orders and refunds: support@lootzy.com. A data protection officer is not appointed; that address handles privacy requests.

2. Data we process

We process only what we need to run an order, protect the payment, and keep the account working.

• Account data: email, display name, sign-in code, language and currency settings.
• Order data: items, price, buyer-protection fee, delivery status, order chat, and dispute materials you upload.
• Seller data: bank details the seller saves for a payout, and identity information collected before the first payout.
• Technical data: IP address, browser and device, time of visit, session id, cart and saved items.
• Payment metadata: the fact of payment, amount, currency, card brand (Visa or Mastercard), and the truncated details the payment provider returns. We never receive or store the full card number or CVV/CVC.
• Support messages and our replies.

3. Why, and the legal basis

Each purpose has a UK GDPR basis.

• Contract (Art. 6(1)(b)): registration, Visa or Mastercard payment, delivery of the digital item, buyer protection, and refunds.
• Legal obligation (Art. 6(1)(c)): accounting and tax records, and lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, site security, and dispute handling. You can object to this processing.
• Consent (Art. 6(1)(a)): optional analytics cookies and marketing email. You can withdraw consent at any time.

4. Card payments and Stripe

Lootzy accepts Visa and Mastercard only.

Stripe processes the payment. The card number and CVV/CVC are entered in Stripe's payment form. We do not store full card data and we never ask for it by email or chat.

Stripe processes data under its own policy and PCI DSS. See stripe.com/privacy.

5. Who receives data

We do not sell personal data.

• Stripe, to take the payment, issue a refund, and handle a card dispute.
• The seller of that order, and only the delivery details you entered plus the order chat. Sellers do not receive your card data.
• Hosting and email providers, under contract, solely to run the service.
• The seller's bank, using the payout details the seller saved, and only after the order is confirmed.
• Public authorities, when the law of England and Wales requires it.

6. Transfers outside the United Kingdom

Providers may process data outside the United Kingdom. Where the destination is not recognised as adequate, we use the UK international data transfer agreement or another lawful Art. 46 UK GDPR safeguard.

7. How long we keep data

The account is kept while you use it and is deleted or anonymised on request, unless the law requires a record to stay. Orders, payments, and refunds are kept for up to 6 years after the end of the relevant financial year for UK accounting and claims.

Dispute correspondence is kept through that same period when it relates to a payment. Security logs are kept for no more than 12 months. Marketing consent lasts until you withdraw it.

8. Cookies

Essential cookies are required for sign-in, the cart, and abuse prevention. Analytics cookies are set only after you accept them in the banner. Details are in the cookie policy.

9. Your rights

You can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Email privacy@lootzy.com. We reply within one month.

You can complain to us and to the Information Commissioner's Office (United Kingdom): ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you live outside the UK, you may also contact your local authority where that right exists.

We do not make solely automated decisions that produce legal effects. Fraud checks can flag an order for a person to review.

10. Children

The service is for people aged 18 and over. We do not knowingly collect children's data. Email the privacy address if you believe a child has sent us data.

11. Changes

The current version is this page, dated above. If a change materially affects data we already hold, we will say so on the site or by email when the law requires it.