Privacy policy

HoloBay is the data controller for the account, shop, listing and order data described in this policy. That means we decide how and why it is used. You can contact us at privacy@holobay.co.uk.

When an order is placed, we share the details the seller needs to fulfil it. The seller then acts as an independent data controller for their own records and customer service. Their shop and privacy practices apply to how they use that information. We have not appointed a statutory Data Protection Officer.

• Account data: your name, email address, password hash, account role and the date you joined. We never store your password in plain text.
• Shop data: shop name, bio, policies, banner and avatar images, shipping settings, payment gateway preferences, Stripe publishable key, PayPal client ID, and encrypted Stripe/PayPal secret credentials. Secret keys are encrypted at rest.
• Listing data: the cards you list, printing variant, condition or grade, price, quantity, photos and descriptions.
• Order data: buyer name and email, the shipping name and address collected at checkout, the items and amounts, payment provider, provider reference, order status and timestamps.
• Payment data: card details are entered with Stripe or PayPal and are not stored by HoloBay. We receive confirmation that a payment succeeded and a provider reference, not your full card number.
• Technical data: our web server keeps standard logs such as IP address, browser type, requested page and time of request. We also use the cookies and browser storage described below.
• Support data: any information you send us by email when you ask for help.

We do not currently use advertising cookies, cross-site trackers or third-party analytics. We do not send marketing emails. If that changes, we will update this policy and ask for consent where the law requires it.

• You give it to us when you sign up, open a shop, list a card or contact support.
• It is created when you use the marketplace — for example, when an order is placed or a shop is reviewed.
• Payment providers return order and shipping details to us after checkout so we can create your order record and show it to you and the seller.
• Our server automatically records technical information when your browser requests a page.

• To provide the service (contract): creating and securing your account, running your shop, publishing listings, taking and recording orders, connecting seller payment accounts, and answering support requests.
• To keep the marketplace safe (legitimate interests): preventing fraud, counterfeit listings, abuse and security threats; reviewing shops; enforcing our Terms & conditions; and understanding how the site is used so we can improve it.
• To meet legal duties (legal obligation): keeping records for tax, accounting, consumer protection and lawful requests from public authorities.
• To establish or defend legal claims (legitimate interests): retaining order records if a dispute, chargeback or legal claim arises.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You can object — see section 9.

• The seller: when you buy, we share the buyer name, email, shipping name and address, items purchased and order details with that shop so it can fulfil the order and handle customer service.
• Stripe and PayPal: payments are processed on the seller’s own account. The provider receives the information needed to take payment and may collect your card and address details directly. See the Stripe privacy policy and the PayPal privacy policy.
• Hosting and service providers: our hosting, database, backup and email providers process data on our instructions and under confidentiality and data protection terms.
• Legal and safety: we may share information if required by law, to investigate fraud or abuse, to protect someone’s safety, or to establish or defend legal claims.
• A business transfer: if HoloBay is sold or merged, data may transfer to the successor, subject to this policy and applicable law.

We do not sell your personal data.

We use a small number of essential cookies and one browser storage preference. We do not use advertising or analytics cookies, so there is no cookie consent banner.

You can clear these through your browser settings. Clearing the session cookie logs you out, and clearing the cart cookie empties your cart on that device.

HoloBay is based in the UK and aims to keep its core hosting and database in the UK. Some providers — particularly Stripe and PayPal — may process data in the United States or other countries. Where data leaves the UK, we rely on an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Addendum or standard contractual clauses. You can ask us for more information about the safeguards used.

• Account and shop data: while your account is open. If you ask us to close it, we will delete or anonymise it within 30 days, except where we need to keep records for legal reasons.
• Sessions: up to 30 days from login, or until you log out.
• Password reset links: stored as a hash; unusable after 60 minutes and deleted when used or replaced, or within 7 days of expiry.
• Cart: up to 30 days, or until you clear it or complete checkout.
• Order records: up to six years after the order, to meet accounting, consumer protection and dispute needs. Sellers may keep their own copies for the same reasons.
• Server logs: for a short period, normally no more than 30 days, unless needed to investigate a security incident.
• Support emails: for as long as needed to resolve the issue and keep a record of our dealings.

Under the UK GDPR, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete data where there is no good reason for us to keep it;
• ask us to restrict how we use it while a concern is investigated;
• receive data you gave us in a portable format, where applicable;
• object to processing based on legitimate interests, including profiling;
• withdraw consent at any time, where we relied on consent;
• complain to the Information Commissioner’s Office (ICO), the UK regulator.

To exercise a right, email privacy@holobay.co.uk. We may ask for proof of identity, and we will normally respond within one month. The right to object to legitimate interests is not absolute; we may continue if we have compelling grounds that override your rights. You can contact the ICO at ico.org.uk or on 0303 123 1113, although we would appreciate the chance to address your concern first.

We use HTTPS across the site, hash passwords, encrypt seller payment secrets, restrict access to production systems, and keep backups. No online service can be completely secure. If you believe your account or a seller’s credentials have been compromised, email support@holobay.co.uk straight away.

HoloBay is intended for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will investigate and remove the data where appropriate.

We may update this policy as the marketplace or the law changes. The revised version will be posted here with a new “last updated” date. If a change is significant, we will take reasonable steps to let account holders know.

For any privacy question or request, email privacy@holobay.co.uk. For general marketplace support, use support@holobay.co.uk.