LotLoop legal

Privacy Notice

Version 2026-08-06 · Effective 6 August 2026

This notice explains what personal information LotLoop processes to run the business marketplace, why, on what lawful basis, who receives it and how long it is kept. LotLoop is a business-to-business marketplace, so most information concerns people acting for a business rather than consumers — it is still personal data and this notice still applies.

In short

• LotLoop processes account, business-identity, listing, order, transport and verification information, plus technical and security logs.
• It is used to run accounts and orders, verify who is trading, prevent fraud and abuse, keep statutory records and answer enquiries.
• It is shared with the other business on an order, and with the hosting, payment and email providers that operate the service. It is not sold, and it is not used for advertising profiling.
• Listings and orders are screened automatically against a prohibited terms list. No account is closed and no listing is finally rejected by that screening alone — a person decides.
• You can ask for a copy, a correction, deletion or a restriction, and you can complain to the Information Commissioner's Office.

1. Who is responsible

The data controller is LOTLOOP LTD, a company registered in England and Wales with company number 17374801, registered office UNIT 1-3 ARLEY INDUSTRIAL ESTATE COLLIERS WAY, ARLEY, COVENTRY, CV7 8HN, ENGLAND.

Privacy enquiries and rights requests: hello@lotloop.co.uk or 0330 133 5472. LotLoop is not required to appoint a Data Protection Officer and has not appointed one; privacy requests are handled at the address above.

A seller and a buyer each decide for themselves what they do with information the other gives them during a sale. For that information, each is an independent controller in its own right, and LotLoop is not responsible for what they do with it after an order.

2. What is collected

• Account and security: name, business email, telephone, password credentials held by the authentication provider, multi-factor enrolment, sign-in events, IP address and device information.
• Business identity: business name, entity type, company number, VAT number where given, business address and the result of a Companies House check.
• Marketplace activity: listings and their photographs, enquiries, wanted requests, offers, orders, prices, collection and delivery addresses, collection windows, site contacts, messages exchanged on an order and transport requests.
• Payments:order amounts, payment and payout status, refund and dispute records, and the seller's Stripe account identifiers. Card numbers are entered on Stripe's own pages and are never received or stored by LotLoop.
• Verification and evidence: ownership, authority and insolvency-membership evidence supplied for review, including appointment documents where the equipment is sold under an insolvency process.
• Records of agreement: which version of which legal document was accepted, by whom and when.
• Technical: service logs, error records, rate-limiting counters and moderation results.

3. Purposes and lawful bases

Each purpose below has one lawful basis. Where the basis is legitimate interests, the interest is named, and LotLoop has weighed it against the rights of the people concerned; you can object to any of those purposes using the contact address above.

• Creating and running your account — performance of a contract with you (the marketplace terms), or steps taken at your request before entering into it.
• Publishing listings and handling enquiries, offers, orders, collection and delivery — performance of a contract.
• Taking payment, releasing seller proceeds, refunds and disputes — performance of a contract, and legal obligation for the underlying financial records.
• Verifying that a business and the person acting for it are who they say they are — legitimate interests: preventing fraudulent and unauthorised sales of equipment, which protects buyers, sellers and LotLoop.
• Screening listings and messages for prohibited items, stolen goods and abuse; suspending accounts — legitimate interests: keeping the marketplace lawful and safe to trade on.
• Security, rate limiting, logging and investigating incidents — legitimate interests: protecting the service and its users from attack and misuse.
• Service messages about your listings and orders — performance of a contract. These are not marketing and cannot be turned off while an order is live.
• Answering enquiries and complaints — legitimate interests: responding to people who contact LotLoop.
• Keeping accounting, tax, company and dispute records — legal obligation, and legitimate interests in being able to defend a legal claim.
• Any marketing email you ask for — consent, withdrawn at any time using the unsubscribe link or by emailing LotLoop. No marketing email is sent without it.

LotLoop does not seek to process special category data or criminal offence data, and asks you not to include it in listings, messages or evidence.

4. Where information comes from

Almost all of it comes from you or from your use of the service. In addition, LotLoop receives payment, payout and dispute information from Stripe, company records from the Companies House public register when a company number is checked, and delivery information from a transport provider arranged through the marketplace. Where you are named as a site contact on someone else's order, LotLoop received your details from that business. LotLoop does not buy personal data, and does not build profiles from data brokers or scraped sources.

5. Who receives it

• The other business on an order. A buyer and seller see the information each needs to complete the sale, including contact and collection details once an order exists. Private contact details are not published in public listing records.
• Processors acting on LotLoop's instructions: Vercel (application hosting), Supabase (database, authentication and file storage), and LotLoop's email delivery provider. Each is engaged under a written contract meeting UK GDPR Article 28.
• Stripe, for payments, seller payouts and membership subscriptions. Stripe is an independent controller for its own payment, fraud-prevention and regulatory purposes as well as a processor for LotLoop.
• Companies House, which receives only the company number being checked.
• Professional advisers, insurers, auditors, and law enforcement or regulators where LotLoop is required or legally entitled to disclose.
• A buyer of the business or its assets, if LotLoop is ever sold, under the same protections as this notice.

LotLoop does not sell personal information and does not share it with advertising networks.

6. Transfers outside the UK

LotLoop's hosting and database are configured in a UK or European region. Some providers — including payment and email providers — are established outside the UK or support their services from outside it. Where personal information is transferred outside the UK, LotLoop relies on UK adequacy regulations where they cover the destination, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with the provider's technical and organisational measures. A current list of providers and the countries involved is available on request from hello@lotloop.co.uk.

7. How long it is kept

• Account records: while the account is open, then up to 12 months after closure so a re-registration, chargeback or dispute can be dealt with.
• Orders, payments, invoices and accounting records: at least six years after the end of the financial year they fall in, as UK company and tax law requires.
• Records of accepted legal documents: six years after the related contract ends, so LotLoop can show which wording applied.
• Verification and insolvency evidence: six years after the account closes or the last related order completes.
• Unpublished listings, expired enquiries and wanted requests: up to 12 months after they were last active.
• Security, sign-in and moderation logs: up to 12 months, except where a record is preserved for an open investigation or claim.
• Marketing consent records: for as long as the consent stands, plus two years after it is withdrawn, as evidence that it was given and withdrawn.

Where information must be kept for a statutory or evidential reason but is no longer needed to identify you, LotLoop removes the identifying parts and keeps the record.

8. Automated screening and decisions

Listings, wanted requests and messages are checked automatically against a maintained list of prohibited and restricted terms, and orders are subject to automated compliance and rate-limit checks. A check can hold a listing back from publication, flag it for review, or stop a transaction from starting.

These are not decisions producing legal effects taken solely by automated means. Anything held back goes to a LotLoop reviewer, and suspending or closing an account is always a human decision. If an automated check has held something of yours back, you can ask for the reason, put your case and have a person look at it — email hello@lotloop.co.uk. Stripe operates its own automated fraud checks on payments under its own privacy policy.

9. Your rights

Under UK GDPR you may ask for: a copy of your information; correction of anything inaccurate; erasure; restriction of processing; portability of information you supplied by contract or consent; and you may object to processing based on legitimate interests, including profiling. Where processing rests on consent, you may withdraw it at any time without affecting what was done beforehand.

Some information cannot be deleted on request — order, accounting and legal-acceptance records LotLoop must keep by law, or needs to defend a claim. Where that applies, LotLoop will say so and explain why. Requests are answered within one month; that can be extended by two further months for complex requests, and LotLoop will tell you if it is. There is no charge unless a request is manifestly unfounded or excessive.

Email hello@lotloop.co.uk to exercise any of these. LotLoop may ask for enough information to confirm who you are before acting.

10. Complaints

Please raise a concern with LotLoop first — it is usually the quickest route. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to LotLoop first is not a condition of complaining to the ICO.

11. Cookies

LotLoop uses only strictly necessary cookies. The cookie policy explains what they are and how to control them.

12. Changes

This notice is versioned and dated at the top of the page. A change that affects how your information is used will be notified before it takes effect where LotLoop is required to do so.