Last updated: 26 May 2026
Who we are
Regraded Ltd ("ReGraded", "we", "us") is the data controller for personal data processed through regraded.co.uk and the ReGraded platform. We are a company registered in England & Wales, company number 17241185. You can reach us at info@regraded.co.uk.
ReGraded is a business-to-business (B2B) platform: we provide trade-in management software to business customers ("Operators"). This policy covers the personal data we process as a controller — primarily about visitors to our website and the staff of our Operator customers. Where an Operator uses the platform to process data about their own end customers, the Operator is the controller of that data and ReGraded acts as a processor on their behalf.
What data we collect
- Account information — name, business name, email address and login credentials for Operator users.
- Contact details — information you give us when you request a demo, complete a contact form, or email us.
- Usage data — how you interact with the website and platform, including pages viewed and actions taken.
- Cookies and analytics — see our Cookie Policy. We use Google Analytics to understand site usage.
- Technical data — IP address, browser type and device information, collected automatically by our servers and analytics.
Why we collect it
- To provide, operate and maintain the platform and your account.
- To respond to enquiries and provide support.
- To send service-related communications.
- To improve and develop the platform.
- To keep the platform secure and prevent abuse.
Legal basis for processing
- Performance of a contract — to provide the service you have signed up for.
- Legitimate interests — to operate, secure and improve our business and platform, where those interests are not overridden by your rights.
- Consent — for non-essential cookies and analytics, which you can withdraw at any time.
- Legal obligation — where we must process data to comply with the law.
How we store and protect data
Sensitive data is encrypted at rest. Each Operator's data is isolated from every other Operator's data. Our infrastructure is hosted within the UK/EU, access is restricted to authorised personnel, and we apply appropriate technical and organisational safeguards.
Data retention
We keep personal data only for as long as necessary for the purposes above. Account data is retained for the life of the account and for a reasonable period afterwards to meet legal and accounting obligations. Enquiry and contact-form data is kept for up to 24 months. After an Operator terminates, their data is available for export for 30 days and is then deleted.
Third-party processors
We use a small number of trusted providers to deliver the service, each bound by data-processing terms:
- Google Analytics — website usage analytics.
- Stripe — payment processing.
- Mailgun — transactional email delivery.
- Royal Mail — postage labels and tracking.
- Our hosting provider — UK/EU-based infrastructure.
Data sharing
We never sell your personal data. We only share data with the processors above to deliver the service, or where we are required to by law.
International transfers
We aim to keep data within the UK and EU. Where a processor transfers data outside the UK/EU, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. To exercise these rights, email info@regraded.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
ICO registration
Our registration with the Information Commissioner's Office is pending.
Changes to this policy
We may update this policy from time to time. Changes will be posted here with a revised "last updated" date.
Contact
For any privacy question, or to exercise your rights, email info@regraded.co.uk.