1. Legal Bases for Processing (UK GDPR Article 6)

Under UK data protection law, we must have a lawful basis to process your personal information. We rely on the following bases:

• Contractual Necessity: processing required to fulfil orders, provide marketplace services, manage seller accounts, and complete transactions.
• Legitimate Interests: improving platform security, preventing fraud, personalising your experience, and direct marketing (where balanced with your rights).
• Legal Obligation: compliance with UK laws, tax reporting, anti-fraud regulations, and court orders.
• Consent: for optional marketing communications, cookies (where required), and certain data sharing preferences.

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) to ensure your rights are not overridden.

2. Your Statutory Rights Under UK GDPR

As a UK resident, you have the following rights regarding your personal data. These rights can be exercised free of charge.

Right to Access (Subject Access Request)

You can request confirmation of whether we process your data and obtain a copy of the personal information we hold about you.

Right to Rectification

You can request correction of inaccurate or incomplete personal data.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data where there is no compelling lawful reason for continued processing (subject to exceptions such as legal obligations or fraud prevention).

Right to Restriction of Processing

You can request that we restrict how we use your data while we verify accuracy or lawful grounds.

Right to Data Portability

You can request a machine-readable copy of your data and have it transferred to another controller where technically feasible.

Right to Object

You can object to processing based on legitimate interests, direct marketing (including profiling for marketing), and processing for research/statistical purposes.

Rights Related to Automated Decision-Making

We do not make solely automated decisions with legal or significant effects. Any automated processing for fraud prevention includes human oversight.

3. How to Exercise Your UK Rights

To submit a request under UK GDPR, you can:

• Access and update your personal data via your Xaysi account settings (where available).
• Email our UK Data Protection team at: privacy@xaysi.co.uk
• Write to us at the address listed in the “Contact Us” section below.

We will respond within one calendar month (extendable by two months for complex requests). We may request proof of identity before processing your request.

4. UK GDPR: Data Transfers Outside the UK

Xaysi operates globally. Your personal data may be transferred to and processed in countries outside the United Kingdom, including Canada and the United States.

Where we transfer data internationally, we ensure adequate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTA) or Addendum to the EU Standard Contractual Clauses.
• Transfer to countries with adequacy decisions (e.g., EU/EEA where UK adequacy applies).
• Binding Corporate Rules (BCRs) where applicable.

You can request a copy of our transfer safeguards by contacting our Data Protection Officer.

5. Retention of Personal Data (UK Requirements)

We retain personal data only as long as necessary to fulfil purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

• Account data: retained until account closure, plus a limited period for legal/regulatory purposes (typically 6 years for tax-related records).
• Transaction data: kept for up to 7 years as required by UK financial regulations.
• Marketing preferences: retained until you opt out or withdraw consent.

6. ICO Supervision and Complaints

The UK data protection supervisory authority is the Information Commissioner’s Office (ICO).

If you believe we have infringed your data protection rights, you have the right to lodge a complaint with the ICO. We encourage you to contact us first so we can resolve your concerns.

• ICO website: https://ico.org.uk
• ICO helpline: 0303 123 1113

7. Cookies and Tracking Technologies (UK PECR)

Under the Privacy and Electronic Communications Regulations (PECR), we obtain your consent for non-essential cookies and similar tracking technologies. You can manage cookie preferences via our cookie banner and browser settings.

Essential cookies (necessary for service operation) do not require consent but are still disclosed in our Cookie Policy.

8. Direct Marketing (UK Specific)

We will only send electronic marketing communications (email, SMS) to UK residents if:

• You have provided explicit consent (where required), or
• You are an existing customer and we market similar products/services (soft opt-in), and you have not opted out.

You can unsubscribe at any time using the “unsubscribe” link in any marketing email or by updating your account preferences.

9. Data Protection Officer (DPO)

Xaysi has appointed a Data Protection Officer (DPO) to oversee UK GDPR compliance. You can contact our DPO directly at:

• Email: dpo@xaysi.co.uk
• Post: Data Protection Officer, Xaysi Marketplace, Privacy Team (UK), 25 Hill Street, London, W1J 5LW, United Kingdom

10. Contact Us (UK Queries)

For any questions regarding this UK Privacy Policy or to exercise your rights, please contact us:

• Email (UK privacy): privacy@xaysi.co.uk
• Support form: Access our Help Centre and select “Privacy Request”

This UK Notice was last updated: June 2025. We may revise it from time to time; material changes will be notified via our website or email.