Legal
Privacy Policy
How DropMarket Ltd collects, uses, shares and protects personal data under UK GDPR and the DPA 2018, including KYC data, the providers we use, how long we keep data, transfers and your rights.
- Effective
- 1 July 2026
- Last Updated
- 10 October 2026 · v1.3
- Governing Law
- England & Wales
Issued by DropMarket Ltd · Company No. 17309867 · support@dropmarket.gg
Who we are
Controller: DropMarket Ltd (Company No. 17309867), 82A James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom. Contact: support@dropmarket.gg or +44 7476 562276.
Categories of personal data
Identity and contact data (name, username, email address, phone number where given); account credentials (passwords are stored only in hashed form by our sign-in provider); KYC data (ID documents; selfie/liveness/biometric verification via provider; sanctions and PEP screening results); tax-identification data Sellers give for platform reporting; transaction, order and payout data (payout details are stored encrypted); device, cookie and usage data; on-platform communications and chat; dispute records.
Lawful bases (UK GDPR Art. 6) — mapped to purpose
- Performance of a contract — operating your account and the marketplace, processing Orders.
- Legal obligation — AML/KYC checks, sanctions screening, tax and platform reporting to HMRC, statutory record-keeping.
- Legitimate interests — fraud prevention, Platform security, service improvement, dispute handling (balanced against your rights).
- Consent — optional analytics cookies and session replay (only if you click Accept on the cookie bar; see the Cookie Policy) and any direct marketing (both withdrawable at any time).
Recipients
We share personal data only with the providers below, each for the job described, and only as much as that job needs. We do not sell personal data.
- What they do for us
- Database, sign-in and file storage for the Platform
- Data involved
- Account, Order, chat, dispute and verification-status data; uploaded files
- What they do for us
- Hosts the website and provides cookieless, aggregated page analytics
- Data involved
- Request data such as IP address, browser and pages visited
- What they do for us
- Sends account and Order emails
- Data involved
- Name, email address and the content of the email
- What they do for us
- Error monitoring
- Data involved
- Technical details of errors (page, browser and device type)
- What they do for us
- Product analytics: which pages, buttons and buying or selling steps people use; with your consent, also cookies and a masked replay of your visit
- Data involved
- Request data such as IP address and browser, pages visited (without personal details in the address), clicks and steps taken, your account ID if you are signed in, and, if you accepted, a replay of the page with everything you type masked
- What they do for us
- Identity verification and sanctions / PEP / adverse-media screening for Sellers
- Data involved
- ID document, selfie and liveness check, name, date of birth, address
- What they do for us
- Processes payments made with local payment methods (bank transfers, e-wallets, QR payments and vouchers) in the countries where they are offered
- Data involved
- Order reference, amount, payment method, and the details you enter on Payssion’s payment page
- What they do for us
- Open-source payment software that DropMarket hosts itself, used to receive crypto payments; no third-party processor handles these payments
- Data involved
- Order reference, amount, payment address and transaction ID
- What they do for us
- Hosts the server that runs BTCPay Server
- Data involved
- Order reference, amount, payment address and transaction ID
- What they do for us
- Carries Seller payouts to a Payoneer account
- Data involved
- Payoneer account email and payout amount
- What they do for us
- Invites you to review a completed Order
- Data involved
- Name, email address and Order reference
| Recipient | What they do for us | Data involved |
|---|---|---|
| Supabase | Database, sign-in and file storage for the Platform | Account, Order, chat, dispute and verification-status data; uploaded files |
| Vercel | Hosts the website and provides cookieless, aggregated page analytics | Request data such as IP address, browser and pages visited |
| Resend | Sends account and Order emails | Name, email address and the content of the email |
| Sentry | Error monitoring | Technical details of errors (page, browser and device type) |
| PostHog (EU hosting) | Product analytics: which pages, buttons and buying or selling steps people use; with your consent, also cookies and a masked replay of your visit | Request data such as IP address and browser, pages visited (without personal details in the address), clicks and steps taken, your account ID if you are signed in, and, if you accepted, a replay of the page with everything you type masked |
| Didit | Identity verification and sanctions / PEP / adverse-media screening for Sellers | ID document, selfie and liveness check, name, date of birth, address |
| Payssion | Processes payments made with local payment methods (bank transfers, e-wallets, QR payments and vouchers) in the countries where they are offered | Order reference, amount, payment method, and the details you enter on Payssion’s payment page |
| BTCPay Server | Open-source payment software that DropMarket hosts itself, used to receive crypto payments; no third-party processor handles these payments | Order reference, amount, payment address and transaction ID |
| Hetzner Online (Germany) | Hosts the server that runs BTCPay Server | Order reference, amount, payment address and transaction ID |
| Payoneer | Carries Seller payouts to a Payoneer account | Payoneer account email and payout amount |
| Trustpilot | Invites you to review a completed Order | Name, email address and Order reference |
We also share data with professional advisers (such as lawyers and accountants), and with regulators or authorities where the law requires it (HMRC, ICO, NCA, law enforcement).
International transfers
Some of these providers process data outside the UK (for example in the EEA or the United States). Where they do, transfers rely on UK adequacy regulations where available, or the UK International Data Transfer Agreement (IDTA) / the UK Addendum to the EU SCCs, with appropriate safeguards; a copy of the safeguards can be requested at support@dropmarket.gg.
Retention
We keep personal data only for as long as we need it. Where a dispute, investigation or legal claim is open, we keep the related data until it is resolved.
| Data | How long we keep it |
|---|---|
| Account and profile data | While your account is open. After you close it, we delete or anonymise it within a reasonable period, except data we must keep under the rows below. |
| Identity verification (KYC) and AML records | 5 years after our relationship with you ends, in line with UK anti-money-laundering record-keeping rules (see the AML / KYC Policy). |
| Orders, payments, payouts and platform-reporting data | 6 years from the end of the financial year they relate to, as UK tax law requires. |
| Order chat and dispute records | As long as we keep the related Order record, because they are the evidence for disputes, refunds and chargebacks. |
| Support emails | As long as needed to deal with your request and any follow-up, unless they form part of an Order or complaint record. |
| Error and security logs | For the short periods set by our providers’ retention settings, after which they are deleted automatically. |
Your rights
Under UK data-protection law you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have data erased, where we have no lawful reason to keep it;
- restrict how we use your data;
- receive data you gave us in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- not be subject to a decision based solely on automated processing that significantly affects you, and to ask for a human review;
- withdraw consent at any time, where we rely on consent.
To use these rights, email support@dropmarket.gg from the email address on your account. We reply within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why. We may need to confirm your identity first. Using your rights is free unless a request is clearly unfounded or excessive.
Complaints
In line with the Data (Use and Access) Act 2025 (DPA 2018 s.164A, effective 19 June 2026), we acknowledge data-protection complaints within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the chance to deal with your concern first.
Children
The Platform is for adults: you must be 18 or over to use it. We do not knowingly collect children’s personal data; if we learn that we have, we delete it.
Cookies
Cookies: see the Cookie Policy. This policy reflects UK data-protection law as amended by the DUAA 2025, with all data-protection provisions in force as confirmed by the ICO on 19 June 2026.
Related Policies
- Cookie PolicyThe cookies and browser storage DropMarket uses, what each one is for and how long it lasts, and how to control them.
- AML / KYC PolicyAnti-money-laundering and know-your-customer arrangements: the payment providers’ role, DropMarket’s risk-based programme, record keeping and DropMarket’s regulatory position.
- Complaints Handling / Dispute ResolutionHow to raise a complaint, our response times, how to escalate, and your options if you are still not satisfied.
- Terms of UseThe master terms governing use of the DropMarket platform: our venue role, SafeDrop Protection and payments, eligibility, accounts, consumer rights, liability, and governing law.