Privacy Policy

1. Who is the data controller

The Only Phones Limited (company number 09454707), 7 Moulton Street, Manchester, M8 8FQ, is the data controller for personal data collected through this website. You can reach us at hello@theonlyphones.co.uk.

2. What we collect

• Account details (name, email, phone, password, hashed)
• Business details for trade applications (company name, VAT, registration number)
• Orders, addresses, and payment metadata (no card details, handled by Stripe)
• Buyback submissions, including device details and photos you upload
• Basic site analytics (anonymised page views, no cross-site tracking)

3. Why we collect it

• To process orders and deliver goods (contractual necessity)
• To handle buyback offers, payments and returns (contractual necessity)
• To approve and manage trade accounts (legitimate interest)
• To meet HMRC, accounting and consumer-law obligations (legal obligation)
• To send order updates and, only with your opt-in, marketing emails (consent)

4. Who we share it with

We share the minimum personal data necessary with: Stripe (payment processing), Royal Mail and other carriers (delivery), email providers (transactional and marketing email), and Supabase (cloud hosting, EU region). Each of these processors handles data under GDPR-compliant terms. We do not sell your data.

5. How long we keep it

Order and accounting records: 7 years (HMRC). Buyback records: 6 years. Marketing preferences: until you withdraw consent. Account data: while your account is active, then anonymised within 12 months of closure. Buyback photos: removed from public access 90 days after the request closes.

6. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct or delete inaccurate data
• Restrict or object to processing in certain circumstances
• Withdraw consent for marketing at any time
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

Email hello@theonlyphones.co.uk with the subject "Data request" and we'll respond within 30 days.

7. Cookies

We use a small number of strictly necessary cookies (cart, login session) and, with your consent, anonymised analytics cookies. No third-party advertising cookies. You can clear or block cookies in your browser settings; strictly necessary cookies are needed for the cart and checkout to work.

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes. Material changes will also be flagged at the top of the site for 30 days.

This is a starter privacy policy for the demo. Before commercial launch, get it reviewed against your specific data flows by a UK data-protection adviser.