Privacy notice.

1. Who we are

The controller is Preownedbullion Limited (company number 15861411), trading as Bullionex, registered in England and Wales, registered office 115 Merton Road, London SW19 1ED. We are registered with the Information Commissioner’s Office (ICO) under number ZC271900. For anything about your data, email hello@bullionex.co.uk with “data” in the subject line, call 020 4569 2010, or write to our registered office. We are not required to appoint a data protection officer (UK GDPR Art 37), and we have not done so.

2. What we collect

• Who you are: name, address, email, phone number, date of birth, and the declarations you make before your identity check (that you are 18 or over and live in the UK).
• Signing in with Google or Apple: If you choose Continue with Google or Continue with Apple, Google or Apple sends us: a unique ID for your account with them; your email address and whether they have verified it; and your first and last name, if they share it. Apple shares your name only the first time you use Sign in with Apple with us. If you use Apple’s Hide My Email, we get a private relay address that forwards to your inbox, not your own address. Google also sends a link to your profile photo, which we don’t keep. We never get your Google or Apple password, and we get no access to your Google or Apple account or anything else in it. We record which way you signed in.
• Identity check (through Sumsub’s Web SDK on your account page): photographs of your identity document (passport, driving licence or identity card) and the data read from it (name, date of birth, nationality, document number, expiry date, machine-readable zone); a selfie photo or short video used for a liveness check (that a real person is present) and a face match against your document photo; a proof-of-address document (for example a recent bank statement or utility bill) and the address read from it; and device and network data (IP address, device and browser details, approximate location) that Sumsub uses for fraud detection. The face match creates biometric data, which the law treats as special category data (UK GDPR Arts 4(14) and 9(1)). Sumsub holds these documents, images and biometric data as our processor. We never store them ourselves: we keep only the result (pass or fail), the date, Sumsub’s reference, and the name and date of birth the check confirmed.
• Screening results: whether you appear on UK sanctions lists, politically exposed person (PEP) lists or adverse-media sources, at the check and afterwards through Sumsub’s ongoing monitoring while you remain a customer. These results may include information about criminal allegations, proceedings or convictions (UK GDPR Art 10).
• Your deals: items, photos (including XRF test photos), weights, test results, offers, acceptances, payments and parcel tracking.
• Payment details: the UK bank account we pay into. If you pay by card, Apple Pay, Google Pay or Link, Stripe takes the payment for us. Stripe tells us whether the payment went through and shows us, in our Stripe account, the card brand, its last 4 digits and expiry date, whether you used Apple Pay, Google Pay or Link and, for Link, your Link email address. We never see your full card number or security code, or the card number that Apple Pay or Google Pay keeps on your device.
• Messages and bookings: emails, calls and messages with us, including any photos you send.
• Source of items or funds: what you tell us when we ask how you came by what you are selling, or where money for a large purchase came from.
• Technical data: IP address and browser details, used to run and secure the site. See our Cookies page.
• Business contacts: see section 9.

3. Why we use it, and our legal basis

• Making and carrying out our contract with you (tests, offers, payments, deliveries, returns, your account), including signing you in with Google or Apple if you choose to. UK GDPR Art 6(1)(b) contract. No extra condition.
• Identity check before your first deal, repeated when needed, and screening when you ask for a pack, liveness and face match, to prevent fraud, impersonation, stolen goods and money laundering. Art 6(1)(ea) recognised legitimate interest: detecting, investigating or preventing crime (Annex 1 para 5); otherwise Art 6(1)(f) legitimate interests. Biometrics: Art 9(2)(a) explicit consent, given on the identity-check screen. You can choose an in-person check instead (section 4).
• Sanctions, PEP and adverse-media screening. Art 6(1)(c) legal obligation, for sanctions reporting to HM Treasury (OFSI) as a “relevant firm” (a business selling or exchanging articles of gold, silver, platinum or palladium, whether or not it takes cash: Russia (Sanctions) (EU Exit) Regulations 2019 regs 70, 71(1)(g)); otherwise Art 6(1)(ea) or (f). Criminal-offence data: Art 10 with DPA 2018 s10(5) and Sch 1 para 10 (preventing or detecting unlawful acts).
• Reports to the National Crime Agency or the police, and answering lawful requests. Art 6(1)(c) legal obligation, or Art 6(1)(ea) (Annex 1 para 5). DPA 2018 Sch 1 para 10.
• Tax and accounting records. Art 6(1)(c) legal obligation. No extra condition.
• Complaints, claims and defending legal claims. Art 6(1)(f) legitimate interests. Art 9(2)(f) legal claims, where relevant.
• Site security and preventing misuse. Art 6(1)(f) legitimate interests. No extra condition.
• Weekly letter, price alerts and “new high” emails. Art 6(1)(a) consent; PECR reg 22(2). No extra condition.
• Business-to-business outreach (section 9). Art 6(1)(f) legitimate interests (direct marketing, Art 6(11)). No extra condition.

Our legitimate-interests assessments are available on request. Giving identity details is a condition of trading with us: without them, we cannot buy from you, sell to you or pay you.

How we limit the use of identity data. We use the information from identity checks and screening only to prevent fraud, money laundering, terrorist financing and sanctions breaches, to meet our legal obligations, and to deal with claims. We do not use it for marketing. We follow this voluntarily, on the model of Money Laundering Regulations 2017 reg 41. Those Regulations do not apply to us: we are not a high value dealer and are not supervised by HMRC, because we never pay or accept cash.

4. Identity checks with Sumsub

4.1 Who Sumsub is. Our identity checks are run by Sumsub (Sum and Substance Ltd, company number 09688671, or its group company named in our contract). Sumsub’s published Notice names Raritex Trade Ltd (Cyprus) and its affiliates, including Sum and Substance Ltd (UK).

4.2 Sumsub as our processor. For identity verification, liveness and authentication checks, sanctions, PEP and adverse-media screening, age checks and fraud prevention within our own customer base, Sumsub acts on our behalf and on our instructions as our processor under a written data processing agreement (UK GDPR Art 28). The checks are: your identity document, a liveness check with face match, sanctions and PEP screening, ongoing monitoring against those lists, and proof of address.

4.3 Sumsub’s own purposes. Sumsub runs the check for us as our processor. Sumsub’s Notice of Personal Data Processing also says that it uses some applicant data, including document images, selfies and biometric data, as an independent controller, for its own purposes:

• fraud detection across all its clients (for biometric data it relies on substantial public interest);
• the security of its platform;
• its own legal compliance and legal claims;
• analytics;
• quality checks;
• developing its services, including AI model training, for up to 5 years from collection.

This currently applies to your data. We have asked Sumsub to stop using our customers’ data for its own purposes where it can, and we will update this notice when that is confirmed. For those purposes Sumsub decides how your data is used, relying on its own legal grounds, not on your consent to us. You can ask Sumsub about it or exercise your rights with Sumsub directly at privacy@sumsub.com. Its notice is at sumsub.com/notification-to-processing-of-personal-data. If you do not want this, you can choose an in-person check at our office instead (section 4.4); that uses no selfie, no face match and no Sumsub biometric processing.

4.4 How the check works. Checks are partly automated: Sumsub reads the document, checks it is genuine, carries out the liveness and face-match checks, and screens the name. If the check passes, you can trade. We never refuse to trade based solely on an automated result. Any failed or uncertain result is reviewed by a member of our staff before we make a decision. You can ask us to explain the decision, give us your side, ask a person to look at it again, or choose an in-person check (UK GDPR Arts 22A–22C, as inserted by the Data (Use and Access) Act 2025). This matters because, under Art 22B(4), a decision based solely on automated processing cannot rely on Art 6(1)(ea).

4.5 Choosing not to use the face match. If you prefer not to give biometric data, or a disability makes the online check difficult, call us to arrange a visit to our office at 34–35 Hatton Garden, London EC1N 8DX (by arrangement only). We will check your original photo ID in person, without a face match. If you cannot visit us, contact us and we will discuss a reasonable alternative with you.

4.6 What we keep. ID documents, proof-of-address documents, selfies, face images and biometric data stay with Sumsub, as our processor. We never download or store them. We keep only the result (pass or fail), the date, Sumsub’s reference for the check, and the name and date of birth that were confirmed.

4A. Google and Apple sign-in

Google and Apple run their own sign-in services. They are separate controllers, not our processors: Google LLC (USA) for UK users, and Apple Distribution International Limited (Ireland). How they use your data is set out in their own notices: policies.google.com/privacy and apple.com/uk/legal/privacy. Source: we get the details above from Google or Apple when you ask them to sign you in. You can remove our access in your Google or Apple account settings; this doesn’t close your Bullionex account (see our Terms, section 2.5).

5. Who we share it with

• Processors acting for us under contract: Sumsub (identity checks and screening); Stripe (card, Apple Pay, Google Pay and Link payments); Resend (email); Cloudflare (domain, security and photo storage); Fly.io (hosting and database). WhatsApp (Meta) is not used at launch.
• Others: Royal Mail (parcels); Google and Apple, for their sign-in services and their wallets (Google Pay, Apple Pay), and Stripe, for your Link account, each as a separate controller under its own privacy notice (section 4A; link.com/privacy). We don’t send Google or Apple your details to sign you in; they send us the details in section 2. Also our insurer and its loss adjusters (claims); our bank (payouts); our accountants and legal advisers; and HMRC, HM Treasury (OFSI), the National Crime Agency, the police and other authorities where the law requires or allows.
• We never sell your data.

6. How long we keep it

• Identity check results (pass or fail and Sumsub reference), screening results and deal records, held by us. Up to 5 years after our last deal with you. Our voluntary financial-crime controls (fraud, stolen goods, money laundering and sanctions), on the basis of our legitimate interests (UK GDPR Art 6(1)(f)). The Money Laundering Regulations do not apply to us, so this period is our own choice, not a legal requirement. It sits within the 6-year period in which a contract claim can be brought (Limitation Act 1980 s5) and lets us meet our duty to report sanctions concerns to HM Treasury (OFSI) about past dealings (Russia (Sanctions) (EU Exit) Regulations 2019 reg 70).
• ID documents, proof of address, selfies and biometric data, held by Sumsub as our processor. Up to 5 years after our last deal with you, as set in our Sumsub account. As above. Sumsub deletes them on our instruction; we keep only the result and reference.
• Invoices, payments and accounts. 6 years from the end of the financial year. Tax law.
• Complaints. 6 years from closing. Limitation period for claims.
• Booking and contact-form details. 12 months, unless you become a customer.
• A quick screening check when you ask for a pack, if you don’t go on to trade: 12 months after the check.
• A completed identity check with no deal: 12 months after the check, by us and by Sumsub.
• A booking at the counter: your name, email, phone and note, for twelve months after the visit, then deleted, unless you become a customer.
• Marketing preferences. Until you unsubscribe; then a suppression record, so we never email you again.
• Business contacts (section 9). Up to 2 years after our last contact, or until you object; then a suppression record. Business contact under our legitimate interests.
• Google or Apple sign-in link (which provider, your ID with them and the email they gave): while your account is open; deleted when you close it. Sign-in requests: deleted when used, and within 10 minutes.

After that, we delete or anonymise the data. Sumsub keeps data it holds for its own purposes for the periods in its Notice (section 4.3), including up to 5 years for developing its services.

7. Data outside the UK

Some of our providers process data outside the UK:

• Sumsub: its notice says data may be transferred to or accessed from the UK, the USA, Germany, Singapore, Brazil and the UAE, protected where required by adequacy decisions, standard contractual clauses (with the UK Addendum or the ICO’s International Data Transfer Agreement), binding corporate rules or the UK Extension to the EU–US Data Privacy Framework.
• Stripe, Resend, Cloudflare, Fly.io: the USA, under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) where the provider is certified, or otherwise the ICO’s International Data Transfer Agreement or UK Addendum.
• Google and Apple sign-in: we make no transfer to Google or Apple to sign you in. They handle your data under their own notices (section 4A).

(UK GDPR Chapter V, as amended by DUAA 2025.) You can ask us for details of the safeguards for any transfer.

8. Your rights

You can ask for a copy of your data, correction, deletion, restriction or a portable copy; object to our use of legitimate interests; withdraw consent at any time (including consent to the face match); and ask for human review of an automated decision. You have an absolute right to object to direct marketing (Art 21(2)–(3)). Some rights are limited while we must keep records. We reply within one month, extendable by two months for complex requests, and we may ask for proof of identity.

9. Business contacts and trade outreach

If you work for, or run, a business we deal with or would like to deal with (for example a jeweller, pawnbroker or refiner), we hold your name, role, business email, phone and address. We collect these from you, from your business’s website, from Companies House or from trade directories. We use them for business-to-business contact under our legitimate interests (Art 6(1)(f); Art 6(11)).

• Email: we send marketing emails without prior consent only to companies, LLPs and other corporate bodies, and every email gives our identity and a working unsubscribe address (PECR reg 23; ICO B2B marketing guidance). We email sole traders and ordinary partnerships only if they have consented, or if the soft opt-in applies (PECR reg 22(2)–(3)).
• Post: we may write to any business by post.
• Calls: we screen against the TPS and CTPS before any marketing call (PECR reg 21).
• We use no tracking pixels in marketing emails.
• If we did not collect your details from you, we will send you this notice within one month (UK GDPR Art 14(3)).
• If you object or unsubscribe, we stop and keep only a suppression record so that we don’t contact you again.

10. Security

We use encrypted connections. ID documents stay with Sumsub, and card details with Stripe, not on our systems. Passwords are hashed, and we use appropriate technical and organisational measures to protect your data (UK GDPR Art 32). We will tell you and the ICO about a breach where the law requires.

11. Complaints about your data

Please tell us first, using the contact details in section 1 or our Complaints page. We acknowledge data complaints within 30 days and tell you the outcome (DPA 2018 s164A). You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.