Larket Privacy Notice
Last updated: 27 October 2026
1. Who we are
Larket is operated by Callum Jackson, a sole trader trading as Arrow Development ("Larket", "we"). We are the controller of personal data processed through larket.co.uk. ICO registration: pending. Contact: support@larket.co.uk, or by post to 39 Kestrel Drive, Rossington, Doncaster, DN11 0ET. Callum Jackson is responsible for data protection at Larket. We have not appointed a Data Protection Officer because the law does not require us to.
2. What we collect
| Who | Data | Source |
|---|---|---|
| All users | Name, email, password (hashed), account settings, IP address, device and log data, cookies (see Cookie Policy) | You, your device |
| Buyers | Delivery and billing address, phone number, order history, messages, reviews, reports you make | You |
| Buyers | Payment card details | Collected and held by Stripe, not Larket. We receive limited details (e.g. card brand, last 4 digits) |
| Sellers | Shop details, entity type, trader status, listings, sales, payouts, fees | You, Stripe |
| Sellers (HMRC reporting) | Full legal name, date of birth, residential/registered address, National Insurance number or other TIN, company/charity number, VAT number, partnership UTR, tax residence, verification outcomes | You, Stripe, verification sources |
| Anyone reporting content | Contact details, report content, evidence; for IP reports, rights-owner details | You |
3. Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account | Contract |
| Processing orders and payments; passing order data to Sellers | Contract |
| Seller onboarding, fees and payouts | Contract |
| Collecting, verifying and reporting Seller data to HMRC under the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 | Legal obligation |
| Keeping financial and tax records | Legal obligation |
| Fraud prevention, security and anti-fake-review controls | Legitimate interests (keeping the marketplace safe and trustworthy) |
| Moderating content, handling reports and complaints, enforcing our policies | Legitimate interests; legal obligation where the Online Safety Act 2023 applies |
| Recording which version of our terms and policies you accepted | Legitimate interests; contract |
| Service emails | Contract / legitimate interests |
| Marketing emails (only if you opt in) | Consent (you can withdraw at any time) |
4. Who we share it with
- Sellers: the details needed to fulfil your order (name, delivery address, order contents, and contact details where needed for delivery).
- Stripe: to process payments, onboard and verify Sellers, and pay out.
- HMRC (and, through HMRC, other tax authorities): reportable Seller information.
- Service providers: website hosting and email delivery (20i Ltd, UK), acting as our processor under contract.
- Professional advisers, law enforcement and regulators, where required by law or to protect rights and safety.
- Rights owners: when you submit or are the subject of an IP report, limited details may be shared with the other party, as explained in the IP Policy.
5. International transfers
Our website and database are hosted in the UK. Stripe may process payment and verification data in the United States and other countries. Where it does, Stripe protects the data using the safeguards UK law requires, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum. You can ask us for more information about these safeguards.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | While the account is open + 2 years |
| Order and financial records | 6 years from the end of the financial year |
| HMRC reporting records | At least 6 years from the end of the reporting period, as required by the Regulations |
| Moderation and report records | 3 years from case closure, longer if needed for legal claims |
| Policy acceptance records | For the life of the account + 6 years |
| Reviews | While published; moderation history 3 years |
7. How we protect it
Tax identifiers, dates of birth and residential addresses are encrypted at rest, masked in routine screens and logs, and accessible only to authorised staff with two-factor authentication. Access is logged.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent. Some rights are limited where we must keep data by law (for example HMRC records). Contact support@larket.co.uk. You can complain to the Information Commissioner's Office (ico.org.uk).
9. Automated decisions
We use automated checks to flag possible fake reviews, prohibited listings and fraud. Most of these checks only flag items for a person to review. Listings that clearly match a prohibited item (for example a controlled drug) are blocked automatically; if you think this is a mistake, edit the listing or contact us and a person will review it. These checks do not on their own produce legal or similarly significant effects on you.
10. Changes
We will update this notice when our processing changes and tell you about significant changes.