JoyBuy Trade-In Privacy Notice

Summary
Recommerce uses personal data to receive, transport, inspect, value and purchase your Trade-In Device, arrange shipping, prevent fraud, make payment and handle trade-in complaints.
Joybuy uses personal data to provide the Joybuy customer interface, authenticate accounts, transmit Trade-In Requests, operate Instant Discount and related payment adjustments, provide first-line customer support, and operate its own website, app and security systems.
Before dispatch, you should back up any information you wish to keep, sign out of accounts, remove SIM and memory cards, disable device locks and erase personal data from the Trade-In Device.

1. Who we are and our roles
1.1 Recommerce Solutions SA, registered in France under number 513 969 402 and having its registered office at 54 Avenue Lénine, 94250 Gentilly, France, is the controller for personal data used to receive, transport, inspect, value and purchase the Trade-In Device, make bank-transfer payments, prevent fraud, comply with legal obligations and handle specialist trade-in complaints (“Recommerce”).
1.2 Jingdong Retail (UK) Limited, company number 15830555, whose registered office is at Floor 3, 20 King Street, London, United Kingdom, SW1Y 6QY (“Joybuy”), is the controller for personal data used for its own Joybuy account, customer interface, Instant Discount and payment-adjustment functions, customer support, website, app, security, cookies and platform-operation purposes.
1.3 Recommerce and Joybuy act as separate controllers for the processing purposes they each determine. If they jointly determine the purposes and essential means of a specific processing activity, they will document their respective responsibilities and make the essence of that arrangement available to Customers where required by law.
1.4 Recommerce UK representative under Article 27 UK GDPR : UK representative under Article 27 of the UK GDPR: REP27 LTD (company number 17385889), Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Data subjects in the United Kingdom may contact the representative at info@gdprrepresentative.com.
1.5 This Notice applies to processing subject to the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and other applicable UK data-protection law, in each case as amended. As an organization established in France, Recommerce may also be subject to the EU GDPR and applicable French law in relation to its processing activities.

2. Personal data we collect
Depending on how you use the Trade-In Service, we may collect:
• identity and contact data, including name, postal address, email address, telephone number and date of birth where required;
• identity-verification and ownership data, including verification results, document type, limited document details, proof of purchase and evidence of ownership;
• Joybuy account and interface data, including account identifiers and authentication data;
• Trade-In Device data, including brand, model, storage capacity, condition, functionality, IMEI or serial number, activation-lock status, photographs, diagnostic results and accessories;
• transaction and valuation data, including the Trade-In Request, Estimated Trade-In Value, Final Trade-In Value, valuation reasons, acceptance or rejection, Payment Method and transaction status;
• payment data, including bank details where bank transfer is used;
• shipping and claim data, including collection or delivery address, tracking information, proof of dispatch, transport incidents, photographs and claim documents;
• communications and support data, including emails, calls, chat records, complaints and information supplied during a human review;
• fraud, security and compliance data, including risk indicators, blocked or stolen-device check results, identity mismatch and regulatory-reporting information; where such information constitutes criminal-offence data, it will be processed only where authorised by applicable law and with appropriate safeguards;
• technical and cookie data, including IP address, device and browser information, log data, security events, cookie identifiers and consent choices.
The Trade-In Device may still contain personal data when received. Recommerce will access only what is reasonably necessary to inspect, erase, repair, refurbish or otherwise process the Trade-In Device. You have to erase personal data and remove SIM and memory cards before dispatch.

3. How we collect personal data
We collect personal data directly from you through the Joybuy interface, customer support, documents you provide and the Trade-In Device. We may also receive relevant data from Joybuy, Recommerce, carriers, identity-verification providers, payment providers, fraud-prevention providers, stolen-property databases and public authorities, where lawful.

4. Purposes, lawful bases and retention

Purpose	Data	Controller	Lawful basis	Retention
Create and manage the Trade-In Request	Identity, contact, account, Trade-In Device and transaction data	Recommerce; Joybuy for its interface	Steps requested before contract; performance of contract	Incomplete Requests are retained until they expire or are abandoned, plus a reasonable period needed for fraud prevention and dispute handling. Completed transaction records are retained for 10 years where required by applicable French law, or otherwise for the applicable statutory or limitation period.
Arrange shipping and investigate transport claims	Contact, shipping, Trade-In Device and claim data; customer-service correspondence	Recommerce	Performance of contract; legitimate interests in preventing fraud and resolving claims	For as long as necessary to complete shipping and resolve claims. Records relating to an active dispute may be retained for the duration of the dispute plus the applicable limitation period.
Inspect, value and purchase the Trade-In Device	Trade-In Device, transaction, technical and support data	Recommerce	Performance of contract; legitimate interests in quality control and fraud prevention	Transaction and appraisal records are retained for 10 years where required by applicable French law, or otherwise for the applicable statutory or limitation period. Diagnostic results that remain linked or reasonably linkable to a Customer, Trade-In Request, IMEI, serial number or other identifier are retained only as long as necessary for appraisal, dispute handling and legal claims. Irreversibly anonymised diagnostic data is not personal data and falls outside this Notice.
Make payment	Identity, bank/card and transaction data	Recommerce or Joybuy, depending on the payment route; relevant payment provider	Performance of contract; legal obligation where applicable	Payment and accounting records are retained for 10 years where required by applicable French law, or otherwise for the applicable statutory period. Bank or card details are retained only as necessary for payment, reconciliation, fraud prevention and applicable legal obligations.
Verify identity and ownership; prevent fraud or theft	Identity, Trade-In Device, technical, fraud and compliance data	Recommerce; relevant verification providers	Legitimate interests; legal obligation where a specific rule applies	Identity-document images are deleted promptly after verification unless longer retention is required by law or necessary for an active fraud, claim or regulatory investigation. Verification results and fraud records are retained only for as long as reasonably necessary, taking account of fraud risk and applicable limitation periods.
Customer service, complaints and human review	Contact, transaction, communications and claim data	Recommerce or Joybuy, depending on the issue	Performance of contract; legitimate interests in resolving disputes and improving service; legal claims	For as long as necessary to resolve the request or complaint and, where needed, for the applicable limitation period. Records may be kept longer while a dispute or legal claim remains active.
Tax, accounting and regulatory compliance	Identity, transaction, payment and reporting data	Recommerce, Joybuy or the relevant platform operator, depending on the obligation	Legal obligation	For the statutory retention period applicable to the relevant obligation under UK, EU or French law.
Security and service operation	Technical, account and security data	Each controller for its own systems	Legitimate interests in operating secure services; legal obligation where applicable	For as long as reasonably necessary for security monitoring, incident response, investigations and legal claims, in accordance with the relevant controller’s retention schedule.
Marketing, analytics and non-essential cookies	Contact, preference, technical and cookie data	The entity operating the relevant website, app or campaign	Consent; or another lawful PECR basis where available	Until consent is withdrawn, the relevant cookie expires, or the retention period stated in the applicable cookie or marketing notice ends.

5. Automated processing and valuation
5.1 Recommerce may use rules, diagnostic tools and pricing models to support Appraisal, fraud checks and determination of the Final Trade-In Value.
5.2 Recommerce does not make a Final Trade-In Value or fraud decision solely by automated means without meaningful human involvement.
5.3 Where applicable law grants additional rights in relation to significant automated decisions, the relevant controller will provide the safeguards required by law.

6. Who receives personal data
Where necessary for the purposes described in this Notice, personal data may be disclosed to:
• Joybuy and Recommerce group companies involved in operating the Trade-In Service;
• carriers, logistics providers, repair and refurbishment providers;
• payment providers and banks;
• identity-verification, fraud-prevention and stolen-property-check providers;
• cloud hosting, IT support, cybersecurity, customer-service and analytics providers;
• professional advisers, insurers, auditors and prospective purchasers of a business or assets;
• HM Revenue & Customs, courts, law-enforcement bodies and other competent authorities where required or permitted by law.
A provider acting only on a controller’s instructions must be bound by appropriate data-protection terms. A provider that determines its own purposes acts as an independent controller for that processing and is responsible for providing its own privacy information.

7. International transfers
7.1 Recommerce is established in France and personal data may be transferred between the United Kingdom and the European Economic Area where covered by applicable UK adequacy regulations.
7.2 Personal data may also be processed in other countries by approved providers. Where a restricted transfer is not covered by UK adequacy regulations, the exporting controller will use an appropriate safeguard or other permitted transfer mechanism under UK data-protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard, and will complete any required transfer risk assessment or data-protection test.
7.3 For the Joybuy UK Trade-In Service, personal data may be stored in or accessed from the following countries outside the UK/EEA: United States (as part of the management of social networks and digital commercial communication) and Morocco (for customer service call centre).
Where a restricted transfer is made, the relevant controller will ensure that an applicable UK transfer mechanism is in place. You may request information about the safeguards used by contacting the relevant controller using the details in section 11.

8. Cookies and similar technologies
8.1 Joybuy will provide a separate cookie notice and consent tool for cookies and similar technologies used on the Joybuy website or app.
8.2 Strictly necessary technologies may be used without consent where permitted by law. Non-essential analytics, advertising and personalisation technologies will be used only where the applicable consent or other legal requirements are met.
8.3 Where consent is required, the consent interface will provide a genuine choice and a clear way to withdraw or change consent.

9. Security and data incidents
9.1 Each controller will implement appropriate technical and organisational measures proportionate to the risk, including access controls, secure transmission, vendor controls, logging, staff confidentiality and incident-response procedures.
9.2 If a personal data breach occurs, the relevant controller will assess and document it and will notify the Information Commissioner’s Office and affected individuals where required by applicable law.

10. Your rights
Subject to applicable conditions and exemptions, you may have the right to:
• access personal data and receive information about its use;
• correct inaccurate or incomplete personal data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting processing already carried out;
• request safeguards relating to significant automated decisions where applicable;
• complain to the Information Commissioner’s Office.
You may exercise your rights by contacting the controller responsible for the relevant activity. We may request proportionate information to verify identity. We normally respond within one month, subject to any lawful extension or other period applicable under data-protection law.

11. Contact and complaints
Recommerce privacy contact: dataprivacy@recommerce.com, Recommerce Solutions SA, 54 Avenue Lénine, 94250 Gentilly, France.
UK representative under Article 27 of the UK GDPR: REP27 LTD (company number 17385889), Unit 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Data subjects in the United Kingdom may contact the representative at
info@gdprrepresentative.com.
Recommerce Data Protection Officer: Gael Donat
Joybuy privacy contact: Jingdong Retail (UK) Limited, Floor 3, 20 King Street, London, United Kingdom, SW1Y 6QY. Privacy email / rights-request channel: dpo@jd.com
Joybuy Data Protection Officer (if appointed): Robert Cooper
You may complain to the Information Commissioner’s Office (ICO). Current contact details are available on the ICO website.

12. Changes to this Notice
We may update this Notice to reflect changes in the Trade-In Service, law or processing practices. The current version will be published on Joybuy with the updated date. We will provide additional notice where a change materially affects Customers.