FairwayX · Legal information
Privacy policy
How information is used in the current FairwayX website and marketplace app, including the approved retention schedule.
Version 1.0 · Updated
1. Who is responsible for your information?
John Rawlings, a sole trader trading as FairwayX, is responsible for the personal information used to operate the FairwayX website and marketplace app. Correspondence address: 27 Trouville Road, Liverpool, L4 7UB, United Kingdom. Contact: support@fairwayx.co.uk.
FairwayX accounts, buying, selling and marketplace messaging are restricted to people aged 18 or older. Public listings and website information may be browsed without an account. Contact support if you believe someone under 18 has opened an account. This notice covers the current service. Online checkout, payment processing and buyer protection are not operational. We will explain any additional processing before those services launch.
2. Information we collect and where it comes from
You provide account, profile and marketplace information when you use the app or contact support. Other users may provide information about you in messages, offers or support enquiries. Firebase services generate account identifiers, timestamps and technical information needed to provide and secure the service.
- Accounts: email address, password handled by Firebase Authentication, account identifier, username and sign-in information.
- Profiles: full name, and an optional phone number and delivery address if you choose to save them. Phone and address details are not required to create an account or browse. When checkout launches, we will request only the contact and fulfilment details needed for the particular order.
- Marketplace activity: listing descriptions, prices, condition, delivery or collection options, uploaded photos, favourites, messages, offers, counteroffers and their history.
- Eligibility and agreement records: your declaration that you are 18 or older, the Terms and Privacy versions presented, and the server-recorded agreement time. This declaration is not independent age verification; we do not collect a date of birth just for the declaration.
- Business sellers: seller status and the business identity, contact, company/VAT details where applicable, fulfilment and return information you supply for publication on listings. These details are seller-declared, not independently verified.
- Service records: notification and message read status, support correspondence, technical request information such as IP addresses and diagnostic logs.
3. Why we use your information
We use account and marketplace information to provide the features you request: signing in, managing your profile, publishing listings, saving favourites, communicating with other users and managing offers. Without the relevant account or listing details, we cannot provide those features.
For account access and the marketplace features you request, we rely on performance of our service contract or steps you request before entering it, where the processing is necessary for that purpose. For optional saved profile details, we rely on our legitimate interest in letting you maintain a reusable profile; you can leave these fields empty or remove them. We also rely on legitimate interests in securing the service, preventing abuse, answering general enquiries and preserving proportionate evidence for complaints and legal claims. We limit these records and access to them, and you can object as explained below. We rely on legal obligation where processing is necessary to comply with a specific legal duty, including applicable data-protection rights.
We do not currently operate a marketing mailing list or advertising-personalisation system. If we introduce an activity that requires consent, we will explain it and obtain consent before starting it.
5. Processing locations and international transfers
The Firestore database and marketplace backend functions are configured in London (europe-west2). Listing-image storage is configured in Belgium (europe-west1). Website delivery and some supporting services use global infrastructure. Google states that Firebase Authentication processes data in the United States; UK database hosting does not mean every service processes information only in the UK.
Google and IONOS provide services under their standard online business and data-processing terms. For Google’s transfers of UK personal information to certified US entities, Google identifies the UK Extension to the EU–US Data Privacy Framework as its transfer mechanism. Its processing terms also provide for applicable contractual safeguards for other restricted transfers. IONOS’s standard agreement includes a data-processing agreement governing support-mail handling and its use of service providers. Overseas access or onward processing by providers is subject to the applicable adequacy arrangements or contractual safeguards required by UK law. You can contact support@fairwayx.co.uk for details or copies of the applicable safeguards, with confidential information removed where necessary.
6. How long we keep information
Account and marketplace information is kept while needed to provide the service, subject to the deletion process below. Accounts without sign-in or token-refresh activity for 24 months are flagged for review. That review does not automatically delete an account; any proposed removal requires prior contact with its owner.
- Other participants’ private archives after account deletion: 12 calendar months, followed by daily checks for recursive deletion, including archived messages.
- Completed deletion safety markers: 60 days after cleanup completes. Incomplete cleanup markers remain for investigation.
- Database backups: a 30-day schedule, with daily checks to remove older backups created under the previous longer schedule.
- Deleted listing photos: a seven-day recoverability period in Cloud Storage after removal from active storage.
- Routine application logs: 30 days. Provider-required security and audit logs can have separate retention.
- Support email: manual review and removal 12 months after an enquiry is resolved, unless relevant evidence is needed longer for a documented complaint or legal obligation. Mail-provider recovery copies can persist separately.
7. Deleting your account and associated data
The app’s Delete account option asks you to reauthenticate before deleting your sign-in account. That starts background cleanup of associated profiles, username claims, listings, listing images, messages, offers and cached marketplace records. Cleanup is not instantaneous and temporary failures are retried. Contact support if you need help or believe data remains.
Other participants retain private archives of their own messages and structured offer facts, with the departing account’s details removed. These are de-identified records, not a guarantee of irreversible anonymity: another person’s own message may still mention you. Relevant records can be held for a documented complaint or legal obligation and reviewed separately.
A minimal account-identifier marker helps prevent stale sessions and delayed events from recreating data. Backups and recoverable photos expire separately. Our recovery procedure requires checks against current accounts and deletion requests before restored data is returned to use. Copies held independently by another user are outside our direct control.
8. Your information rights
Depending on the circumstances and lawful basis, you can request access, correction, erasure, restriction of processing or a portable copy of information. You can withdraw consent where processing relies on consent, without affecting earlier lawful processing. These rights can be subject to legal conditions and exceptions.
Contact support@fairwayx.co.uk to exercise your rights. We may request proportionate information to verify your identity. We normally respond within one month; if a permitted extension or clarification is needed, we will explain the applicable timing.
9. Your right to object
You can object to processing based on legitimate interests because of your particular circumstances. We must consider that objection and stop unless a lawful reason permits continued processing. You can object to direct marketing at any time, although FairwayX does not currently operate a marketing mailing list.
11. Questions, complaints and changes
Contact John Rawlings trading as FairwayX at support@fairwayx.co.uk or the correspondence address above about privacy concerns. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. The official complaint link is below.
We will update this notice when our processing changes and make the revision date clear. If a new purpose requires additional information or consent, we will address that before starting the new processing.