As a Data Processor of Ebay customer information when you buy from Ebay, we are responsible for fulfilling your order and providing it to a shipping company to get it to you. We also process information when you raise a customer services query, and when you return goods.
What data do we collect?
Ebay provides us with your username, basic payment details, your shipping details, and the contents of the order that we are expected to fulfil. This is the recipient name and address, a phone number and an email address to communicate with you.
What is the legal basis for collecting this data?
In order to meet Contractual Obligations we record information:
- About the recipient.
- About the contents of the order.
- About customer service interactions.
- About returns.
- Shipping information and tracking data to customer location.
The carrier firms we use for delivering your orders are Sub Processors and in order to fulfil their part of the contract with us we transfer the recipient, phone number and delivery address, in order to generate a label to stick on the parcel to send out.
The three carrier firms used are Royal Mail, Palletways and UKMail.
Where your products are covered by a warranty, we will maintain record keeping that allows us to validate your warranty rights until the end of the warranty, and if there is a claim we may need to verify this with the product manufacturer where the liability is on them to replace or repair.
In order to pursue a Legitimate Interest as a business
We will store in our internal Customer Relationship Manager database your name, address, account identifier so that if you contact us for Customer Services purposes we can meet your expectations as a customer.
If you contact us on Ebay then your details are automatically recorded in our Customer Services system, Zendesk so that we may reply to your customer services query. Once your query is closed, after 30 days it is automatically deleted except where it has a material effect on our relationship with you as a customer, in which case a note will be placed on our internal CRM against your account so that our agents know what has been previously actioned on your behalf.
In order to meet our Legal Obligations
In some cases we have an obligation to comply with common law and statutory obligations and we have to either retain records and/or disclose records to relevant authorities.
We need to retain a record of financial information for compliance with HMRC guidelines for a minimum of 6 years, longer may be required if a compliance check is required.
Law enforcement may demand information from us in relation to fraud prevention and/or criminal activity.
You may exercise any of your rights in writing to:
Ebay as Data Controller
You have the right to be informed:
We have provided this policy as a full and transparent disclosure of how we process your information and why. If you have further questions please write to us and we will endeavour to clarify.
You have the right to request:
- Access to the personal data we hold about you, free of change in most cases.
- To make corrections to personal data when incorrect, out of date, or incomplete.
- That you withdraw consent and no overriding interest applies (legal, contractual, legitimate) that your information is deleted.
- That we stop any processing based on consent.
- That we erase any data we hold about you, unless an overriding legal basis applies.
- That we archive your information so that whilst it is retained for an overriding legal basis it is not processed.
There are additional rights that you have, which govern uses of data that we have evaluated does not apply to us (we do not use your data in that way, or it is overridden by a legal basis to perform a contract or comply with a law).
To learn more, please take a look at the ICO guide:
To ask for any of these actions to be taken, you must message a subject access request to Ebay.
If your request relates to an individual order that has not been shipped yet, please use your Ebay account to message us.
If for any reason we cannot action your request in part, or in full we will write to you explaining our reasons.
Making a request to our DPO
This must be made through Ebay as Data Controller.
Problems and issues
If we have not actioned your request in a way you deem correct or appropriate, you may contact the Information Commissioner’s Office. In the wider EEA you must refer your matter to the ICO equivalent in your country.