Privacy Policy

Privacy Policy Last updated: 20 October 2026 Who we are BuyPama is a UK online marketplace at buypama.com where approved independent sellers list products and shoppers buy them. BuyPama is a trading name of MASK10 Ltd, a company registered in England and Wales under company number 17444027. MASK10 Ltd is the data controller for the personal information described in this policy. This means we decide why and how your information is used. For any privacy question, or to use any of your rights, email us at mask10support@gmail.com. You can also use the Help page on our website. What we collect Google sign-in data If you choose "Continue with Google", we use Google OAuth to sign you in. We request only the openid, email and profile scopes. From Google we receive: - your name - your email address - your profile picture - a Google account identifier that lets us recognise you next time you sign in We do not receive your Google password, and we do not request access to your Gmail, contacts, calendar, Drive files or any other Google data. Email and password accounts If you create an account with an email address and password, we store your email address and a securely hashed version of your password. We never see or store your password in readable form. If you turn on two-step verification, we store the information needed to check your codes. Profile and account information We store the details you add to your account, such as your name, display name, profile picture, saved sizes and shopping preferences, saved and wishlisted items, followed sellers, reviews and review photos you post, reward points and BuyPama credit, and your notification and email preferences. Orders When you buy something we record what you ordered, from which seller, the price, discounts, delivery charges, order status, delivery tracking events, returns, refunds and any buyer protection claims. Delivery addresses and phone number We store the delivery addresses you enter or save at checkout, and a phone number if you give one. We use these to deliver your order and to contact you about it. Couriers may use your phone number to arrange delivery. Payments Card payments are processed by Stripe. Your card details are entered directly into Stripe's secure payment form and are held by Stripe. We never receive or store your full card number or security code. Stripe tells us whether a payment succeeded, and gives us limited details such as the card brand and last four digits so we can show your payment and handle refunds. Seller onboarding data If you apply to sell on BuyPama, we collect your shop and business details, contact details, product information and the answers in your application. Identity checks, business verification and bank account details for payouts are handled by Stripe through Stripe Connect. Stripe collects and holds your identity documents and bank details. We store only the results we need, such as whether your account is verified and able to receive payouts, and limited bank details such as the bank name and last four digits so you can recognise your payout account. Messages and support We keep messages you send to sellers or to us, help requests, and conversations with our AI shopping and help assistant, so we can answer you and resolve problems. Search and browsing We record searches and the products you view and click so we can show relevant results, recently viewed items and recommendations. Our site search is powered by Algolia, which receives your search terms and the results you click. Technical and security information When you use the site we collect technical information such as your IP address, browser type, device type and the pages you visit. We use Cloudflare Turnstile on some forms to check that a real person, not an automated bot, is signing in or submitting the form. Cookies and local storage We use cookies and your browser's local storage for things the site needs to work, including: - keeping you signed in - remembering your basket - remembering your cookie choices - remembering light or dark mode, recent searches, recently viewed products and saved size or fit preferences - saving draft listings for sellers We also record page visits in our own first party analytics so we can understand which pages are used and fix problems. This information is stored in our own database and is not shared with advertising networks. Our site can load advertising measurement tags from Meta, TikTok or Google if we switch them on. These are non-essential, and we will only use them with your consent. You can change your choices at any time using "Manage cookies" in the website footer. More detail is in our Cookie Policy. How we use Google user data We use the information we receive from Google (your name, email address and profile picture) only to: - create your BuyPama account and sign you in to it - show your name and profile picture in your account and on content you choose to post, such as reviews We do not sell Google user data. We do not use Google user data for advertising, including personalised or retargeted advertising. We do not use it to build profiles for advertising, credit or lending decisions. We do not transfer Google user data to anyone except service providers that we need to run BuyPama, such as our hosting and database provider, and only so they can provide that service to us, or where the law requires it. People at BuyPama do not read your Google user data unless you ask us to help with your account, it is needed for security or to investigate abuse, or the law requires it. BuyPama's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove BuyPama's access to your Google account at any time from your Google Account settings. You can also delete your BuyPama account as explained below. Purposes and lawful bases Under UK GDPR we must have a lawful basis for each use of your information. We rely on the following: - Creating and running your account, including Google sign-in. Lawful basis: contract. - Taking payment, processing and delivering orders, returns and refunds. Lawful basis: contract. - Onboarding sellers, verifying them through Stripe and paying them. Lawful basis: contract, and legal obligation for anti money laundering and marketplace reporting duties. - Sending order confirmations, delivery updates and account security emails. Lawful basis: contract. - Customer support, buyer protection and resolving disputes. Lawful basis: contract and legitimate interests. - Keeping the site secure, preventing fraud, spam and abuse, and bot checks. Lawful basis: legitimate interests in running a safe marketplace. - Site search, recommendations and recently viewed items. Lawful basis: legitimate interests in showing relevant products. - First party page visit analytics to improve the site. Lawful basis: legitimate interests. - Keeping tax, accounting and order records. Lawful basis: legal obligation. - Optional marketing emails. Lawful basis: consent, which you can withdraw at any time. - Non-essential cookies and advertising measurement tags. Lawful basis: consent, which you can withdraw at any time. Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time, as explained below. Who we share your information with We do not sell your personal information. We share it only with: - Sellers on BuyPama. When you order, the seller receives your name, delivery address, the items ordered and, where needed for delivery, your phone number, so they can send your order. - Couriers and Parcel2Go. Delivery labels and tracking are arranged through Parcel2Go and the couriers it uses, which receive the name, address and contact details needed to deliver your parcel. - Stripe. Stripe processes card payments and, for sellers, handles identity verification, business checks and payouts through Stripe Connect. - Supabase. Our database, user accounts, file storage and server functions are hosted by Supabase. - Lovable. Our website is built and hosted through the Lovable platform. - Brevo. We send transactional emails such as order confirmations and account emails through Brevo. - Algolia. Algolia provides our product search and receives search terms and clicks. - Cloudflare. Cloudflare Turnstile helps us block automated bots. - Google. Google provides Google sign-in if you choose to use it. - AI service providers. Our AI assistant and some moderation tools use AI models through our hosting platform to answer questions and review listings and reviews. - Advertising partners, only if you consent to advertising measurement tags. - Professional advisers, authorities and law enforcement, where the law requires it or it is needed to protect our rights, customers or sellers. These providers act on our instructions, or under their own privacy notice where they act as a separate controller, such as Stripe for its own legal checks. International transfers Some of our providers, including Stripe, Supabase, Brevo, Algolia, Cloudflare and Google, may process information outside the UK, for example in the European Economic Area or the United States. When information is transferred outside the UK, we make sure it is protected by an approved safeguard, such as a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Email us if you would like more information about these safeguards. How long we keep your information - Account and profile information, including Google sign-in data: while your account is open, and deleted when you delete your account, apart from the records below. - Order, invoice, payment and refund records: 6 years after the end of the financial year in which the order took place, to meet UK tax and accounting law. - Seller onboarding and verification results: while the seller account is open and for 6 years after it closes, to meet legal and tax duties. - Support messages and dispute records: up to 2 years after the matter is closed, or longer if needed for a legal claim. - Security logs and bot check records: normally up to 90 days. - First party page visit analytics: up to 2 years. - Marketing consent records: while your consent is active and for a short evidential period after you withdraw it. - Cookies and local storage: until they expire or you clear them in your browser. When we no longer need information, we delete it or anonymise it so it can no longer identify you. Your rights under UK GDPR You have the right to: - Access: ask for a copy of the personal information we hold about you. - Rectification: ask us to correct information that is wrong or incomplete. You can update most details yourself in your account. - Erasure: ask us to delete your information. - Restriction: ask us to limit how we use your information. - Portability: ask for information you gave us in a commonly used, machine readable format. - Objection: object to us using your information on the basis of legitimate interests, and to direct marketing at any time. - Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it. To use any of these rights, email mask10support@gmail.com. We may ask you to confirm your identity. We normally reply within one month. There is usually no charge. How to delete your account You can ask us to delete your account in either of these ways: 1. Sign in, open your Account, choose Security, and select Delete account. Confirm your request. 2. Visit buypama.com/account/delete. You do not need to be signed in. Enter the email address on your account and send the request. We will confirm the request by email before deleting anything. We normally complete deletion within one month. Your profile, Google sign-in data, saved items, rewards and preferences are deleted. Order, invoice and payment records are kept for 6 years where the law requires it. You can also email mask10support@gmail.com to ask for deletion. Children BuyPama is not intended for children. You must be 18 or over to create an account, buy or sell on BuyPama. We do not knowingly collect information from anyone under 18. If you believe a child has given us personal information, email us and we will delete it. Security We protect your information with encryption in transit (HTTPS), hashed passwords, access controls that limit each user and staff member to the information they are allowed to see, optional two-step verification, and bot protection on sign-in. Card and bank details are handled by Stripe, which is certified to PCI DSS Level 1. No system is completely secure, so please keep your password private and tell us straight away if you think your account has been misused. Complaints If you are unhappy with how we have used your information, please contact us first at mask10support@gmail.com so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: - Website: https://ico.org.uk - Phone: 0303 123 1113 Changes to this policy We may update this policy when our services or the law change. We will show the new date at the top of this page, and if a change is significant we will tell you by email or on the site before it takes effect. Last updated: 20 October 2026

BuyPama