Privacy Policy

Effective Date: 23/09/25

Swapauto Ltd, operating as Trust Toucan ("we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal data when you use our website, applications, and services (together, the "Platform").

We are the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

1. Purpose of This Policy

This policy is designed to ensure you understand:

What personal data we collect and why;
How we obtain and process it;
With whom we share it;
The safeguards we apply;
Your rights under data protection law.

We only process your personal data when necessary to:

Provide and improve our services;
Fulfil legal and regulatory obligations;
Protect against fraud and unlawful activity;
Pursue our legitimate interests in operating the Platform.

2. Scope and Applicability

• This policy applies to all personal data we handle, whether collected digitally or in physical form.

• It applies to individuals (not companies as entities, but may include individuals in companies).

• The Platform is not intended for individuals under 18.

If you provide us with information about another person, you confirm you have their consent to share it for the purposes described here.

3. Data Controller Contact

Swapauto Ltd Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE Email: hello@trusttoucan.com

4. Personal Data We Collect

4.1 Data You Provide

Identity & Contact Information: name, address, date of birth, email, and phone number provided during registration.
Transaction Information: details of the item or vehicle, price, condition, delivery/collection arrangements.
Communications: correspondence with us (support requests, feedback).

4.2 Data Collected Automatically

Technical Information: IP address, browser type, operating system, device identifiers.
Usage Data: pages visited, time spent, actions on the Platform.
Cookies & Tracking: see Section 10.

4.3 Data from Third Parties

Stripe (Payment & Verification Partner):

Stripe collects, processes, and securely stores all identity documents (such as passports or driving licences) and all financial details (such as bank accounts and card numbers).
Trust Toucan does not directly hold or store this sensitive information.
We may receive limited confirmation data from Stripe (e.g., “identity verified,” “account linked,” or the last 4 digits of a bank account) to operate the Platform.

Fraud Prevention Agencies & Public Sources: verification, AML, and KYC checks.
Analytics Providers & Service Partners: performance, security, and service improvement.

4.4 Statistical, Analytical & Behavioural Data

We may collect information about patterns, behaviours, and preferences (e.g., transaction frequency, error logs, service usage) for security and business analytics.

5. How We Collect Data

When you register or transact on the Platform.
Through Stripe (payments and ID verification).
From public records and credit/fraud agencies (for verification).
From cookies, pixel tags, and analytics.
When you contact us directly.
Through partner integrations and third-party services.

6. How We Use Data

We use your personal data to:

Provide our services (facilitating secure conditional payouts).
Verify your identity and perform AML checks (via Stripe and fraud prevention agencies).
Process and record payments via Stripe.
Prevent and detect fraud, money laundering, or other unlawful activity.
Comply with legal and regulatory requirements.
Communicate important service updates (transactional messages, policy changes).
Improve, personalise, and secure the Platform.
Provide marketing (only with your consent).
Prepare anonymised reports and analytics (never identifying you personally).

7. Sharing Your Data

We share your personal data only when necessary:

With Other Users: limited contact details to complete a transaction.
With Stripe: for payment processing and ID verification. Stripe acts as an independent controller for this data. Their processing is governed by the Stripe Privacy Policy.
With Service Providers: e.g., hosting, analytics, customer support.
With Fraud Prevention & Credit Agencies: to verify identity, prevent fraud, and comply with AML.
With Regulators & Law Enforcement: where legally required.
With Business Successors: in mergers, acquisitions, insolvency, or sale of assets.
We do not collect, hold, or store copies of your ID documents or financial details — these remain solely with Stripe.

8. International Data Transfers

Your data may be transferred outside the UK, including to the EEA or the United States. Where this occurs, we ensure safeguards are in place, such as:

Standard Contractual Clauses approved by the UK Government;
Transfers to providers in jurisdictions with adequate data protection laws;
Contractual obligations on third parties to protect data.

Where identity verification or payments are required, Stripe may transfer your data outside the UK. Stripe manages these transfers in accordance with its own policies and safeguards.

9. Data Retention

We retain personal data only for as long as necessary:

Transaction and AML data: up to 6 years (legal requirement).
Account and communication data: until your account is closed, plus a retention period for regulatory obligations.
Cookies: as per Section 10.

10. Cookies & Tracking

We use cookies and similar technologies to improve the Platform. These include:

Essential Cookies: enable core functionality (cannot be disabled).
Analytics Cookies: track usage for service improvement.
Functionality Cookies: remember preferences.
Advertising Cookies: show relevant ads (e.g., via Google, Meta, LinkedIn).

You can manage your cookie preferences through our cookie banner or your browser settings.

11. Marketing Communications

We will only send marketing emails if you have given consent.
You can withdraw consent or unsubscribe at any time.
Transactional communications (service updates, verification requests) are not considered marketing.

12. Security

We use technical and organisational safeguards to protect your data, including encryption and secure servers. However, no online transmission or storage system is 100% secure. You are responsible for keeping login credentials confidential.

13. Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion ("right to be forgotten").
•Restrict or object to processing.
•Request data portability.
Withdraw consent (where processing is based on consent).

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) (www.ico.org.uk).

14. Children’s Privacy

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children.

15. Business Transfers

If Trust Toucan is sold, merged, liquidated, or enters insolvency, your data may be transferred to a successor company. We will notify you if this occurs.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our Platform, and continued use means acceptance of the updated terms.

17. Contact Us

For questions, data requests, or complaints:

Swapauto Ltd Unit A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE Email: hello@trusttoucan.com