This privacy policy explains how Vinted Resells Ltd collects, uses and protects your personal data when you use the Y2K Sells online store, buy from us or contact us. It also explains your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
Vinted Resells Ltd is the controller of your personal data. We are Vinted Resells Ltd, a company registered in England and Wales with company number 16344052. Our registered office is 66 Paul Street, London, EC2A 4NA, United Kingdom, and our VAT number is GB516424310. For any privacy question or request, email support@y2ksells.com.
2. The personal data we collect
- Identity and contact data: your name, email address, billing address and any phone number you give us.
- Order data: what you bought, when, the price, your refund history and the record that you asked us to start sending your supplier packs straight away, with the exact wording shown under the pay button and the date and time.
- Payment data: the payment method you used and whether your payment succeeded, failed or was refunded. Your card details are handled by our payment partner, and we never see or store your full card number.
- Support data: your emails to us and our replies.
- Marketing data: your choices about receiving marketing emails from us.
- Technical data: your IP address, device and browser type, approximate location based on your IP address, the pages you view and cookie identifiers.
To place an order you need to give your name, email address, country and payment details at checkout. Without them, we cannot complete your order.
3. How we use your data and our lawful basis
- To take your order, send your supplier packs, handle refunds and send order emails. Lawful basis: contract.
- To answer your questions. Lawful basis: contract, and our legitimate interests in answering enquiries properly.
- To keep a record of your request to start sending your packs before your 14 day cancellation period ends. Lawful basis: contract, and our legitimate interests in being able to show what you asked for.
- To prevent fraud, keep our store secure, deal with payment disputes and protect our content and legal rights. Lawful basis: our legitimate interests.
- To keep accounting, tax and VAT records. Lawful basis: legal obligation.
- To send you marketing emails about new packs and offers. Lawful basis: your consent or, for customers, our legitimate interests under the soft opt-in. You can say no at checkout and unsubscribe at any time.
- To set cookies that are not strictly necessary, such as advertising cookies. Lawful basis: your consent, which you give or refuse on our cookie banner.
4. Who we share your data with
- Netlify, which hosts our store and keeps our order records;
- Whop, which takes your payment as merchant of record, keeps your card or wallet details for one-tap offers after checkout, collects VAT on the sale and uses your data as an independent controller under its own privacy policy;
- our email provider, which sends our order emails;
- the providers that host the links to your packs;
- advertising partners such as TikTok, only if you accept advertising cookies;
- professional advisers, such as accountants and lawyers; and
- courts, regulators and other authorities, such as HMRC, where the law requires it.
We do not sell your personal data. If a payment is disputed, we may share the relevant order and support records with the bank or payment provider.
5. International transfers
Some of our providers are based outside the UK, including in the United States. When your data is transferred, it is protected by UK adequacy regulations, such as the UK-US data bridge, or by contracts approved under UK law. You can ask us which safeguard applies.
6. How long we keep your data
Order, payment and accounting records: 6 years from the end of the financial year they relate to. Support emails: up to 6 years in case of a dispute. Marketing data: until you opt out. Cookie data: for the period set for each cookie. When we no longer need data, we delete or anonymise it.
7. Your rights
You can object at any time to direct marketing, and we will stop. You also have the right to access, correct or delete your data, to restrict or object to how we use it, to data portability and to withdraw consent. Email support@y2ksells.com to use any of these rights. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to sort it out first.
8. Cookies
We use storage that is needed to run the store, such as your cart. Advertising and measurement cookies load only if you choose Accept on our cookie banner, and you can change your choice at any time with Cookie settings at the bottom of every page.
9. Changes to this policy
We may update this policy. The latest version is always on this page, with its last updated date.
10. Contact us
Email support@y2ksells.com, or write to Vinted Resells Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom.