Privacy policy
Last updated September 2026
This policy explains what personal data we collect when you sell to us or use this website, why we need it, who we share it with, how long we keep it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
Shellbark Trading is the trading name of Jac Jones, a sole trader, who is the “controller” responsible for your personal data. Our address is 60 Dunraven Road, Sketty, Swansea, SA2 9LQ. For anything about your data, email support@shellbarktrading.com.
We are registered with the Information Commissioner's Office. ICO registration number: ZC248138 (view our entry on the ICO register).
What we collect, why, and our legal basis
| Information | Why we use it | Legal basis |
|---|---|---|
| Name, email address, phone number and postal address | To send your offer, provide your postage label, pay you, and contact you about your submission. The email confirming your payment also invites you to review us | Contract (steps you ask us to take before, and to perform, the agreement); legitimate interests for the review invitation |
| Descriptions and photographs of your items, your parcel’s size and approximate weight, and the photographs and video we take when your parcel is opened | To value your items, check them on arrival, settle any question about their condition and, once bought, resell them | Contract; legitimate interests for resale and resolving disputes |
| Bank sort code, account number and account holder name | To pay you once your items are verified. We only ask for them when you accept an offer | Contract |
| Offer, purchase and payment records, purchase receipts, and our emails with you | To keep accounts and tax records, and to deal with questions, complaints and claims | Legal obligation; legitimate interests |
| Identity checks, device serial or IMEI numbers, and information about suspected stolen goods or fraud | To avoid buying stolen goods, prevent fraud and help the police | Legitimate interests; for information about possible offences, the Data Protection Act 2018 condition for preventing or detecting unlawful acts |
| Details of sellers we have decided not to buy from: email address, phone number, postal address, and a scrambled fingerprint of their bank account | To stop blocked sellers making new submissions, and to prevent fraud | Legitimate interests |
| A scrambled (hashed) version of your IP address, your browser type, and our host’s server logs | To protect the website and our sellers from misuse | Legitimate interests |
| If you accept advertising cookies: a Google Ads cookie and details of your visit, such as the pages you view and whether you send us the sell form | To measure which of our Google adverts bring sellers to us. We do not use it to show you adverts elsewhere | Consent, which you can withdraw at any time using Cookie settings at the bottom of every page |
| Your marketing preference | To email you occasionally about items we are looking to buy, if you ticked the box | Consent, which you can withdraw at any time |
Most of this comes from you. We also receive delivery and tracking information from the carrier, and, if we check an item, the result from the register we checked it against.
You do not have to give us your data, but without your contact details and photographs we cannot make you an offer, and without your bank details we cannot pay you. We do not make decisions about you by automated means alone.
Identity checks
For higher-value sales, or if something does not look right, we may ask to see photographic identification and proof of address (see our terms of sale). We record the type of document we saw, when we checked it and who checked it. We delete any copies you send us once the check is complete.
How we protect your bank details
Your sort code and account number are encrypted (AES-256-GCM) before they are stored, using a key kept separately from the database. Staff see only the last four digits of your account number until a payment is being made, and every time the full details are unlocked it is recorded in an audit log. We also keep a scrambled fingerprint of your account, which cannot be turned back into your account details, so that we can recognise an account we have blocked. We never ask for card numbers, PINs or online banking passwords.
Who we share it with
We only share your data where we need to. We do not sell it, and we never share it to show you adverts.
- Render Services, Inc.: Hosts this website and its database. Your data is stored in Frankfurt, Germany.
- Google (Google Workspace): Provides our business email.
- Google (Google Ads): Only if you accept advertising cookies: receives details of your visit to measure our adverts, never your name, email, bank details or submission reference. Google may also use this information for its own purposes, as its privacy policy explains.
- Royal Mail Group and Parcelforce Worldwide: Produce postage labels and deliver parcels. They receive the names, addresses and contact details needed for delivery.
- Our bank: Makes payments to you. It receives your account details and the payment reference.
- Stolen-property and device registers: Where we check an item, we share its serial or IMEI number, never your bank details.
- The police and other authorities: Where the law requires it, or where we need to report suspected stolen goods or fraud.
- Our professional advisers: Such as our accountant, solicitor or insurer, when they need it to advise us.
If we ever sell or transfer our business, your data would pass to the new owner, who would have to protect it in the same way.
Data stored or accessed outside the UK
Our website data is stored in the European Union, which UK law recognises as protecting personal data adequately. Some of our providers are based in the United States and may access data from there, for example for support. Where that happens we rely on UK adequacy regulations (including the UK–US data bridge for certified companies) or on the ICO's approved international data transfer agreement or addendum.
How long we keep it
- Bank details: erased automatically as soon as a submission closes, whether it was paid, declined, expired, returned or cancelled.
- Photographs, unpacking videos and postage labels: deleted 12 months after a submission closes, which gives time to deal with any question about condition or delivery.
- Blocked-seller details: kept for as long as the block is in place. We review blocks and remove those that are no longer needed.
- Submission, offer and payment records, and our emails with you: kept for six years after a submission closes, to meet tax record-keeping rules and the time limit for legal claims, then deleted.
- Marketing preference: kept with your submission record, or until you withdraw your consent if that is sooner.
- Your draft on the sell form: kept only in your own browser, until you submit it, start again, or clear your browser data.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we no longer have a good reason to keep it;
- ask us to restrict how we use it;
- object to us using it on the basis of our legitimate interests, and to any marketing at any time;
- receive data you gave us in a portable format; and
- withdraw your consent, where we rely on it.
Email support@shellbarktrading.com to use any of these rights. It is free. We may need to confirm your identity first. We will respond within one month, or tell you within that month if a complex request needs up to two months more.
Complaints about your data
Please tell us first, and we will try to put things right. You also have the right to complain to the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113.
Children
Our service is only for people aged 18 or over, and we do not knowingly collect children's data.
Cookies
We only use advertising cookies, from Google Ads, if you accept them on our cookie banner, and we never use them to show you adverts elsewhere. You can change your choice at any time using Cookie settings at the bottom of every page. Our cookie policy lists everything we store in your browser, and why.
Changes to this policy
If we change this policy we will update this page and the date at the top. If a change affects a submission you have in progress, we will email you about it.