Privacy Policy

1. Introduction and Data Controller

Welcome to Vrool. Vrool is a social marketplace and classified platform operated by Vrool ("Vrool", "we", "us", or "our").

Your privacy is extremely important to us. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use our website vrool.com, our mobile services, or any related features (collectively, the "Service").

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller responsible for your personal data is:

• Data Controller: Vrool
• Website: vrool.com
• Data Protection Officer (DPO) Email: [email protected]

By using Vrool, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein. If you do not agree with this Privacy Policy, you must not use the Service.

This Privacy Policy should be read alongside our Terms of Service, which govern your use of the platform.

2. Information We Collect

We collect various types of information to provide, maintain, and improve the Service. The categories of information we collect include:

2.1 Account Data

When you register for an account, we collect:

• Full name and display name.
• Email address.
• Password (stored in encrypted form).
• Phone number (if provided).
• Profile photograph (if uploaded).
• Date of birth or age verification information.
• Account preferences and settings.

2.2 Listing Data

When you create listings, we collect:

• Listing title, description, and category.
• Photographs and images uploaded to listings.
• Pricing information, including auction starting prices and reserve prices.
• Item condition, specifications, and attributes.
• Location information associated with the listing (city, postcode area, or approximate location).
• Listing type (standard, auction, B&B, food, services).

2.3 Transaction Data

When you engage in transactions, we collect:

• Purchase and sale history.
• Bid history and auction participation records.
• Offer history (Make an Offer feature).
• Payment method details (processed and stored by our third-party payment processors; we do not store full card numbers).
• Vrool wallet and credit balance information.
• QR payment transaction records.
• Invoices and receipts.

2.4 Device and Browser Data

When you access the Service, we automatically collect:

• IP address.
• Browser type and version.
• Operating system and device type.
• Screen resolution and viewport size.
• Referring URL and pages visited.
• Date, time, and duration of visits.
• Unique device identifiers.
• Language and locale preferences.

2.5 Location Data

We may collect location information, including:

• Approximate location derived from your IP address.
• Location information you provide when creating listings or setting your profile location.
• Precise geolocation data from your device, only if you have granted explicit permission through your browser or device settings. You may revoke this permission at any time.

2.6 Communication Data

We collect information from your communications on the platform, including:

• Messages sent and received through the Vrool messaging system.
• Social feed posts, comments, and interactions.
• Customer support enquiries and correspondence.
• Reviews and feedback.

2.7 Advertising Data

If you use the Vrool ad network, we collect:

• Campaign details, targeting preferences, and creative assets.
• Ad performance metrics (impressions, clicks, conversions).
• Advertising spend and billing information.

2.8 Identity and Address Verification Documents

If you apply to sell on Vrool, or to drive or host with us, we ask you to upload documents so that we can confirm your identity and your address. Depending on the type of account you are applying for, these may include:

• A passport or other photographic identity document.
• Both sides of a driving licence.
• A recent utility bill or other proof of address.
• Photographs of a vehicle, where you apply to drive.

We ask for these only where the type of account requires them. We use them solely to verify your identity, your address and, where relevant, your vehicle, and to meet our legal and regulatory obligations. We do not use verification documents for marketing, and they are never shown on your public profile or to other users.

Verification documents are stored on our own servers and can be opened only by authorised Vrool staff, through an administrative tool that refuses access to anyone who is not signed in as an administrator. An image of a document you upload may also be transmitted to OpenAI for an automated legibility and consistency check, which is described in section 6.3.

3. How We Use Your Information

We use the information we collect for the following purposes:

1. Providing the Service: To create and manage your account, display your listings, facilitate transactions, process payments, and enable communication between users.
2. Safety and Security: To detect and prevent fraud, abuse, spam, and other harmful activity. To verify user identities and enforce our Terms of Service.
3. Content Moderation: To scan and analyse images, text, and other content using automated systems (including AI) to identify prohibited content, policy violations, and unsafe material.
4. Personalisation: To personalise your experience, including showing relevant listings, recommendations, and search results based on your activity and preferences.
5. Communication: To send you service-related notifications, transaction updates, security alerts, and customer support responses. To send marketing communications where you have opted in or where we have a legitimate interest to do so.
6. Advertising: To operate the Vrool ad network, deliver targeted advertisements, and measure ad performance.
7. Analytics and Improvement: To analyse usage patterns, monitor platform performance, diagnose technical issues, and improve the Service.
8. Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests. To establish, exercise, or defend legal claims.
9. Financial Operations: To process payments, manage Vrool wallet credits, handle refunds, and maintain financial records.

4. Legal Basis for Processing (GDPR)

Under the UK GDPR, we must have a lawful basis for processing your personal data. The legal bases we rely on include:

1. Contract Performance (Article 6(1)(b)): Processing necessary to perform our contract with you, including providing the Service, managing your account, facilitating transactions, and processing payments.
2. Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate interests or those of a third party, provided your rights do not override those interests. This includes fraud prevention, platform security, analytics, service improvement, and direct marketing to existing users.
3. Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose, such as marketing communications, precise geolocation tracking, or the use of non-essential cookies.
4. Legal Obligation (Article 6(1)(c)): Processing necessary to comply with a legal obligation, such as tax reporting, responding to law enforcement requests, or maintaining records required by financial regulations.

Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Cookies and Tracking Technologies

Vrool uses cookies and similar tracking technologies to enhance your experience, analyse usage, and support our advertising services.

5.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of the Service, including session management, authentication, security, and load balancing. These cookies cannot be disabled.
• Functional Cookies: Enable enhanced functionality and personalisation, such as remembering your preferences, language settings, and display options.
• Analytics Cookies: Help us understand how users interact with the Service by collecting information about pages visited, time spent, and navigation patterns. We use this data to improve the platform.
• Advertising Cookies: Used to deliver relevant advertisements and measure the effectiveness of advertising campaigns on the Vrool ad network.

5.2 Managing Cookies

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, blocking certain cookies may affect the functionality of the Service.

Where required by law, we will obtain your consent before placing non-essential cookies on your device. You may withdraw your consent at any time by adjusting your cookie settings.

5.3 Other Tracking Technologies

In addition to cookies, we may use web beacons, pixel tags, local storage, and similar technologies to collect information about your interactions with the Service and our communications.

6. Third-Party Services

Vrool integrates with and relies on various third-party services to operate the platform. These third parties may process your personal data on our behalf or as independent data controllers. The key third-party services we use include:

6.1 Payment Processing - Stripe

We use Stripe to process card payments and manage financial transactions. When you make a payment, your payment card details are transmitted directly to Stripe and are not stored on Vrool's servers. Stripe processes your data in accordance with its own privacy policy and is PCI DSS Level 1 certified. For more information, visit Stripe's Privacy Policy.

6.2 Cloud Storage and CDN - DigitalOcean Spaces

We use DigitalOcean Spaces for cloud storage and content delivery network (CDN) services. Images, files, and other media uploaded to Vrool are stored on DigitalOcean's infrastructure. DigitalOcean processes data in accordance with its privacy policy and data processing agreement.

6.3 AI Content Moderation - OpenAI

We use OpenAI services to assist with automated content moderation, including analysing listing descriptions, messages, and other text content for policy violations, spam, and prohibited material. Text content may be transmitted to OpenAI's API for analysis. OpenAI processes this data in accordance with its data processing terms and does not use data submitted via its API to train its models.

OpenAI is also used to check identity and address verification documents. Where you upload a passport, driving licence, proof of address, or similar document as described in section 2.8, an image of that document may be transmitted to OpenAI's API so that it can be read and compared with the details you have given us. The outcome is reviewed by our staff: the automated check does not by itself determine whether your account is verified, and you may ask us to review any decision using the contact details in section 14.

6.4 Image Moderation - Sightengine

We use Sightengine for automated image analysis and moderation. Images uploaded to the platform may be transmitted to Sightengine for scanning to detect nudity, violence, offensive content, and other policy violations. Sightengine processes image data in accordance with its privacy policy.

6.5 Other Third-Party Services

We may also use additional third-party services for analytics, email delivery, push notifications, error monitoring, and other operational purposes. Where these services process personal data, we ensure appropriate data processing agreements are in place.

7. Data Sharing and Disclosure

We do not sell your personal data to third parties. We may share your information in the following circumstances:

1. With Other Users: Certain information is shared with other users as part of the normal operation of the platform, including your display name, profile photograph, listing details, approximate location, and public social feed posts. When you engage in a transaction, relevant contact and transaction details may be shared with the other party.
2. With Service Providers: We share data with trusted third-party service providers who assist us in operating the Service, as described in Section 6. These providers are contractually obligated to process your data only on our instructions and in accordance with applicable data protection laws.
3. For Legal Reasons: We may disclose your information if required to do so by law, regulation, legal process, or governmental request. We may also disclose information to enforce our Terms of Service, protect our rights, property, or safety, or the rights, property, or safety of our users or others.
4. With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.
5. Business Transfers: In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.
6. Aggregated and Anonymised Data: We may share aggregated or anonymised data that cannot reasonably be used to identify you, for research, analytics, and business purposes.

8. International Data Transfers

Vrool is based in the United Kingdom. However, some of our third-party service providers may process your data in countries outside the UK and the European Economic Area (EEA).

Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data, including:

• Transfers to countries that the UK Government has determined provide an adequate level of data protection.
• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) or the European Commission.
• Other legally recognised transfer mechanisms, such as binding corporate rules or approved certification schemes.

You may request further information about the safeguards we use for international data transfers by contacting our Data Protection Officer at [email protected].

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

9.1 Retention Periods

• Account Data: Retained for the duration of your account and for up to 2 years after account closure, unless longer retention is required by law.
• Transaction Data: Retained for a minimum of 6 years after the transaction date to comply with tax and financial record-keeping obligations under UK law.
• Listing Data: Active listings are retained for the duration of the listing. Expired or removed listings may be retained in archived form for up to 2 years for dispute resolution and compliance purposes.
• Communication Data: Messages and correspondence are retained for up to 2 years after the last activity, unless required for ongoing dispute resolution or legal proceedings.
• Device and Browser Data: Typically retained for up to 12 months.
• Content Moderation Logs: Records of automated moderation decisions are retained for up to 12 months for audit and appeal purposes.
• Identity and Address Verification Documents: Retained for the duration of your verified account and for up to 5 years after the account is closed, to meet anti-money-laundering, tax, and regulatory record-keeping obligations, after which they are securely deleted. You may ask us to delete them sooner, and we will do so unless we are required to retain them.

9.2 Deletion

When personal data is no longer required, we will securely delete or anonymise it. In some cases, we may anonymise your data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

10. Your Rights Under GDPR

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

1. Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of your request.
2. Right to Rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
3. Right to Erasure (Article 17): You have the right to request that we delete your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or when you withdraw consent. This right is not absolute and may be subject to legal obligations that require us to retain certain data.
4. Right to Data Portability (Article 20): You have the right to request that we provide your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
5. Right to Object (Article 21): You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. You also have the right to object to processing for direct marketing purposes at any time.
6. Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you have objected to processing pending verification of our legitimate grounds.
7. Right to Withdraw Consent: Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
8. Right to Lodge a Complaint: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe that your data protection rights have been violated. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113.

Exercising Your Rights

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We may need to verify your identity before processing your request. We will respond to your request within one month, although this period may be extended by a further two months for complex or numerous requests, in which case we will inform you of the extension and the reasons for it.

11. Children's Privacy

Vrool is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. Users aged 16 or 17 may use the Service with verifiable parental or legal guardian consent, as outlined in our Terms of Service.

If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that information as promptly as possible. If you believe that a child under 16 has provided us with personal data, please contact us immediately at [email protected].

12. Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security). Sensitive data at rest is encrypted using industry-standard encryption algorithms.
• Access Controls: Access to personal data is restricted to authorised personnel on a need-to-know basis. Staff with access to personal data are subject to confidentiality obligations.
• Password Security: User passwords are hashed using strong, one-way hashing algorithms. We never store passwords in plain text.
• Infrastructure Security: Our servers and infrastructure are hosted in secure data centres with physical and network security controls, including firewalls, intrusion detection systems, and regular security audits.
• Regular Testing: We conduct regular security assessments, vulnerability scans, and penetration testing to identify and address potential security weaknesses.
• Incident Response: We maintain an incident response plan to address data breaches promptly. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay, as required by the UK GDPR.

While we implement robust security measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to protecting your data to the highest practicable standard.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

1. Update the "Last updated" date at the top of this page.
2. Provide notice of material changes through the Service, by email, or by other reasonable means.
3. Where required by law, seek your consent to the updated Privacy Policy before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us using the following details:

• Company: Vrool
• Website: vrool.com
• Data Protection Officer (DPO): [email protected]
• General Support: [email protected]
• Legal Enquiries: [email protected]

If you are not satisfied with our response to your enquiry or complaint, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom