01. Who we are
Richbury.com is a trading name of Zagran Ltd, a company registered in England under company number 16334360. For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Zagran Ltd is the controller of personal information processed through Richbury.com unless another organisation is identified as acting independently in relation to a particular service.
Questions about this policy, the use of personal information or the exercise of data protection rights may be submitted through the Contact page.
02. Scope
This policy applies to visitors to Richbury.com, registered Retailers and Suppliers, prospective account holders, authorised representatives of businesses using the platform, people who contact Richbury for support, and other individuals whose personal information is processed in connection with the Richbury marketplace and associated services.
Much of the information handled by Richbury concerns companies, products and commercial transactions rather than identifiable individuals. Information about a company is not necessarily personal information. However, information relating to a sole trader, director, employee, account user, contact person or other identifiable individual is personal information and is protected accordingly.
03. Information we collect
The information Richbury processes depends on the way in which the service is used. It may include:
- Account information: user name, account email address, authentication and security information, account status, role and account activity.
- Business and representative information: business name, company number, VAT number, registered or trading address, warehouse or return address, website, telephone number, business email address, contact person and role.
- Business profile information: logos, business links, social and review-service links, profile media and other information submitted for an approved Supplier or Retailer profile.
- Marketplace information: Supplier and Retailer connections, catalogue and listing activity, products sourced, stock-related information, commercial terms and marketplace status information.
- Order and fulfilment information: order references, products, quantities, transaction values, delivery or despatch information, carrier and tracking information, order status, returns, cancellations and operational exceptions.
- Financial information: account balances, deposits or top-ups, settlement information, withdrawal requests, transaction references, charges, credits, adjustments, VAT information and other records required to administer marketplace payments and financial accounts.
- Support and communications: support-ticket content, correspondence, administrative notes and records of communications with Richbury.
- Technical and security information: IP address, browser and device information, session identifiers, security events, log information and information required to protect accounts, transactions and the platform.
Richbury generally receives information directly from the individual or from the business for which that individual acts. Where appropriate, information may also be obtained from another Richbury user involved in a transaction, from a payment or technical service provider, from a connected commerce service, or from a publicly available business source used to verify information supplied to Richbury.
04. How we use personal information
Richbury may use personal information to:
- create, verify, administer and secure Supplier and Retailer accounts;
- assess and approve applications for access to the marketplace;
- maintain business profiles and review proposed changes before publication;
- enable approved Suppliers and Retailers to establish and manage trading relationships;
- administer catalogue, product, listing and sourcing activity;
- process and record orders, fulfilment, despatch, returns and operational exceptions;
- administer balances, top-ups, settlements, withdrawals, charges and financial records;
- provide support, investigate problems and respond to complaints;
- protect accounts, transactions and the platform against misuse, fraud and security threats;
- maintain audit trails and records of administrative decisions;
- comply with accounting, tax, regulatory and other legal obligations;
- establish, exercise or defend legal claims; and
- improve, maintain and develop the service where this can lawfully be done.
05. Lawful bases
Richbury identifies an appropriate lawful basis before using personal information. The basis depends on the purpose of the processing and the relationship between the individual, Richbury and the business for which the individual acts.
| Purpose | Principal lawful basis |
|---|---|
| Creating and administering an account or taking steps requested before an individual enters into a contract | Contract |
| Administering an account held by a company through its employees or authorised representatives | Legitimate interests in operating the marketplace and administering the commercial relationship with that organisation |
| Marketplace relationships, product sourcing, orders, fulfilment and support | Contract where the individual is a contracting party; otherwise legitimate interests in providing and administering the requested business service |
| Account, profile and product review or moderation | Legitimate interests in maintaining accurate marketplace information, appropriate access and reliable trading records |
| Payments, settlements, balances and transaction administration | Contract, legitimate interests and, where applicable, legal obligation |
| Accounting, taxation and statutory record keeping | Legal obligation |
| Platform, account and transaction security; prevention of misuse and fraud | Legitimate interests in protecting Richbury, its users and transactions; legal obligation where applicable |
| Establishing, exercising or defending legal claims | Legitimate interests and legal obligation where applicable |
| Optional direct marketing where consent is required | Consent |
Where Richbury relies on legitimate interests, those interests are considered against the rights and interests of the affected individual. Richbury will not rely on legitimate interests where the impact on the individual overrides the relevant business interest.
06. Business profile visibility
Richbury is a business-to-business marketplace. Certain information submitted as part of an approved business profile is intended to be made available to approved trading counterparties so that they can assess products, businesses and proposed commercial relationships.
Depending on the account type and the information supplied, an approved profile may include a business name, company number, business address, website, business contact details, contact person, business links, logo, profile media and marketplace status. Where any of those details identify an individual, they are personal information.
Supplier profile information may be made available to approved Retailers, and Retailer profile information may be made available to approved Suppliers, where this is necessary for marketplace functionality and the relevant trading context. Technical account credentials, passwords and private account-security information are not intended to form part of a published business profile.
07. Payments & financial information
Richbury uses Viva.com for supported payment services. Where a payment is made through a Viva.com-hosted payment environment, payment details entered into that environment are processed by Viva.com for the purposes of providing the payment service. Richbury receives and records the transaction information necessary to identify, reconcile and administer the payment, such as transaction status, amount and payment reference.
Viva.com acts in accordance with its own legal responsibilities for personal information processed through its payment services. Its current privacy information is available here: Viva.com Privacy Notice .
Richbury may also retain financial and transaction records where necessary to manage balances, settlements, withdrawals, refunds, disputes, accounting, taxation and other legal or contractual obligations.
08. When we share personal information
Richbury does not sell personal information. Personal information may be disclosed only where there is an appropriate purpose and lawful basis, including to:
- approved Suppliers or Retailers where information is required for a marketplace relationship, order, fulfilment activity or approved business profile;
- payment providers, including Viva.com, where required to initiate, process, reconcile or investigate a payment;
- hosting, infrastructure, security, email, communications and other technical service providers acting on Richbury's behalf;
- accountants, auditors, insurers, legal advisers and other professional advisers where reasonably necessary;
- government departments, regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law; and
- a purchaser, investor or professional adviser involved in a genuine corporate transaction, subject to appropriate confidentiality and data protection measures.
Service providers processing personal information on Richbury's behalf are required to handle it only in accordance with the relevant instructions, contractual obligations and applicable data protection law.
09. International transfers
Some service providers may process personal information outside the United Kingdom. Where Richbury makes a restricted transfer of personal information, it will use a transfer mechanism permitted by UK data protection law.
This may include transferring information to a country covered by UK adequacy regulations or putting in place appropriate safeguards, such as the United Kingdom International Data Transfer Agreement or the United Kingdom Addendum to approved standard contractual clauses, together with the required assessment of the protection afforded to the information.
Information about the safeguards applicable to a particular restricted transfer may be requested through the Contact page.
10. How long we keep personal information
Richbury keeps personal information only for as long as it is reasonably required for the purpose for which it was collected, together with any further period required by law or reasonably necessary for security, dispute resolution or the establishment, exercise or defence of legal claims.
| Record | Retention approach |
|---|---|
| Active account and business-profile information | For the duration of the account or commercial relationship, followed by the period reasonably required to complete closure, resolve disputes and meet legal obligations. |
| Orders, payments, settlements and accounting records | Normally retained for at least six years from the end of the company financial year to which the relevant records relate, and longer where required by tax, accounting, regulatory or legal requirements. |
| Support and complaint records | For as long as necessary to resolve the matter and thereafter for the period reasonably required to evidence the handling of the issue or meet applicable legal requirements. |
| Approval, moderation and administrative audit records | For as long as required to maintain the integrity of the marketplace, explain administrative decisions, resolve disputes and meet legal or accountability obligations. |
| Security and technical logs | For the period reasonably necessary to maintain platform security, investigate incidents and prevent misuse; relevant records may be retained for longer where they relate to an actual incident or legal claim. |
| Marketing preferences | Until consent is withdrawn or an objection is made, together with the minimum suppression information reasonably required to ensure that the preference continues to be respected. |
Retention periods are reviewed periodically. Information that is no longer required is deleted, anonymised or otherwise disposed of securely, subject to any continuing legal obligation to retain it.
11. Security
Richbury applies technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Measures are selected according to the nature of the information, the way in which it is used and the risks presented by the processing.
Access to administrative functions and personal information is restricted according to operational need. Richbury also maintains records of significant administrative actions and reviews account, transaction and security events where appropriate.
No online service can guarantee absolute security. Users are responsible for keeping their account credentials confidential and should notify Richbury promptly if they believe an account or credential has been compromised.
12. Your data protection rights
Depending on the circumstances and the lawful basis on which information is processed, individuals may have the right to:
- be informed about the collection and use of their personal information;
- request access to their personal information;
- request correction of inaccurate or incomplete personal information;
- request erasure of personal information in circumstances where the right applies;
- request restriction of processing in circumstances where the right applies;
- receive certain personal information in a portable format where the right to data portability applies;
- object to processing based on legitimate interests in circumstances where the right applies; and
- withdraw consent at any time where processing is based on consent.
A request may be submitted through the Contact page. Richbury may need to verify identity before acting on a request. Rights are not absolute and may be subject to statutory conditions, restrictions or exemptions.
If you are dissatisfied with the way Richbury has handled your personal information, you may raise a data protection complaint with Richbury. You also have the right to complain to the Information Commissioner's Office (“ICO”), the United Kingdom supervisory authority for data protection.
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
ico.org.uk
13. Direct marketing
Service messages concerning an account, transaction, security matter, support issue or material change to the Richbury service are not marketing communications.
Where Richbury sends direct marketing, it will do so only where permitted by the UK GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), as amended. Consent will be obtained where the law requires it. Where another lawful route is available, Richbury will respect the individual's right to object and any applicable PECR requirements.
Marketing preferences may be changed at any time using the unsubscribe facility provided with the communication or by contacting Richbury.
14. Cookies & similar technologies
Richbury uses cookies and comparable storage and access technologies for purposes including authentication, essential session functionality, transaction continuity and other functions described in the Cookie Policy.
Where consent is required for a cookie or similar technology, it will be requested in accordance with PECR and applicable data protection requirements.
15. Automated decision-making
Richbury does not currently make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals.
Account approvals, material profile changes and product moderation are intended to involve administrative review. If Richbury introduces solely automated decision-making of the kind regulated by the UK GDPR, this policy will be updated and the required information and safeguards will be provided before that processing is introduced.
16. Children
Richbury is a business-to-business service intended for businesses and adults acting in a business or professional capacity. It is not directed at children, and Richbury does not knowingly seek to establish marketplace accounts for children.
17. Changes to this policy & contact
Richbury will review this policy periodically and when there is a material change to the platform, the purposes for which personal information is used, the categories of recipient, payment arrangements or applicable legal requirements.
Where a change results in a new use of personal information that requires additional notice or consent, the relevant information will be provided before that new use begins.
Questions, requests or complaints concerning privacy may be submitted through the Contact page.