Privacy Policy

Last Updated: April 21st 2026

Effective: April 21st 2026

1. DATA CONTROLLER

Giveandtake Limited ("we", "us", "our") is the data controller responsible for your personal data under the UK General Data Protection Regulation ("UK GDPR") and Data Protection Act 2018.

Our Data Protection Officer can be contacted at: dpo@givaro.uk

2. Data we collected

A. Data You Provide:

  • Account Data: Name, email, phone number, profile photo.
  • Verification Data: (Optional) Photo ID for verified status.
  • Item Data: Photos, descriptions, condition, location/pickup address.
  • Transaction Data: Payment information (processed by Stripe), in-app chat messages, ratings.
  • Communications: Support queries, feedback.

B. Data Collected Automatically:

  • Device Data: IP address, device type, operating system, app version.
  • Usage Data: Pages viewed, items browsed, search queries, time spent.
  • Location Data: Approximate location (via IP/postcode) for local listings; precise location only with your explicit permission for features like "Near Me".

3. LEGAL BASES FOR PROCESSING (UK GDPR)

We process your data under these lawful bases:

  • Contract: To perform our service (facilitating exchanges).
  • Legitimate Interests: For security, fraud prevention, app improvement, and marketing our own similar services (with opt-out).
  • Consent: For optional features like push notifications, precise location, and third-party marketing.
  • Legal Obligation: To comply with UK law (e.g., fraud investigation).

4. HOW WE USE YOUR DATA

PurposeData usedLawful Basis
Provide & operate the PlatformAccount, Item, Transaction, LocationAccount
Process paymentTransaction Data (via Stripe)Account
Facilitate communication between usersChat messagesLegitimate Interests
Moderate content & ensure safetyAll data, especially messages, photos & ratingsLegitimate Interests, Legal Obligation
Send service updates & notificationsAccount Data, PreferencesContract, Legitimate Interests
Improve & personalise the ServiceUsage, Device DataLegitimate Interests
Marketing (Givaro services only)Email, Usage DataLegitimate Interests (opt-out available)
Comply with UK lawAs requiredLegal Obligation

5. DATA SHARING & DISCLOSURE

We share data only as necessary with:

Other Users:

Givers: Your name, profile photo, general location (e.g., "Manchester M1"), and listings are visible to all users.

Takers: If you collect an item, the Giver will receive your name only. Your full address is shared only with our courier partners for delivery, not with the Giver.

Service Providers:

  • Courier Partners: Delivery address, contact name, and phone number for delivery purposes only. We do not publicly name our specific courier partners.
  • Stripe: Payment information for processing.
  • AWS (UK): Secure cloud hosting.
  • Analytics Providers (e.g., Mixpanel): Anonymised usage data.

Legal Authorities: If required by UK law enforcement, courts, or regulators.

Business Transfers: In connection with a merger or sale of assets, with notice.

We do not sell your personal data.

6. Data retention

We retain your data only as long as necessary:

  • Account Data: Until you delete your account + 6 years for tax records (HMRC requirement).
  • Transaction Data: 7 years for financial record-keeping (HMRC requirement).
  • Chat Messages: 90 days after transaction completion.
  • Inactive Accounts: Deleted after 2 years of inactivity

7. YOUR UK DATA RIGHTS

Under UK data protection law, you have the right to:

  1. Access copies of your data.
  2. Rectify inaccurate data.
  3. Erasure ("right to be forgotten") in certain circumstances.
  4. Restrict processing in certain circumstances.
  5. Data portability.
  6. Object to processing based on legitimate interests.
  7. Withdraw consent at any time (where processing is based on consent).

To exercise these rights, contact dpo@givaro.uk. We have one month to respond. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

8. Data security

We implement appropriate technical and organisational measures including encryption (in transit and at rest), access controls, and regular security assessments. However, no internet transmission is 100% secure.

9. Cookies & tracking

We use necessary cookies for platform functionality. For analytical/marketing cookies, we obtain your consent via our cookie banner. You can manage preferences in your browser or app settings.

10. Children’s privacy

Our Service is not intended for individuals under 18. We do not knowingly collect data from children. If we become aware of such a collection, we will delete it promptly.

11. INTERNATIONAL TRANSFERS

Your data is stored and processed primarily in the UK and European Economic Area (EEA). Where we use US-based providers (e.g., Stripe, AWS), we ensure appropriate safeguards via UK International Data Transfer Agreements.

12. Changes to this policies

We will notify you of material changes via email or in-app notice at least 14 days in advance. Continued use constitutes acceptance.

13. Contact us

For privacy-specific inquiries:

Data Protection Officer

Giveandtake Limited

24, Heath Wood Drive, Maidstone, United Kingdom

Email: dpo@givaro.uk