Privacy Policy

1. Who is responsible for your data

REISLE LTD is the data controller for the personal data described here. We are a private company limited by shares registered in England and Wales under company number 17404472, with its registered office at 10 Alfreton Road, Newton, Derbyshire. We operate the Reisle marketplace, which serves Jersey.

For anything about this notice, or to exercise the rights in section 8, email hello@reisle.je.

As a UK controller we are subject to the UK GDPR and the Data Protection Act 2018, and supervised by the Information Commissioner’s Office (ICO).

2. What we collect

Account details: Your name or display name, email address, password (stored only as a hash — we never hold the password itself), and whether your email is verified. If you sign in with Google or Apple, we receive your name, email address and profile picture from them instead of a password.
Profile: Your parish, profile picture, and the short bio you write. All of this is shown on your public seller profile, so treat it as public.
Listings: Item titles, descriptions, categories, condition, price, photographs and delivery options. Listings are public.
Orders and delivery: What you bought or sold, when, for how much, the delivery method, tracking references, and the delivery or collection arrangements you agree with the other person.
Payment records: The amount, the fee, the status of the order, and references that identify the transaction at PayPal. We never receive or store your card number, and we never hold your money. Card details are entered with PayPal directly.
Messages: Messages you send to other users through the site, and the threads they belong to.
Ratings, reports and blocks: Ratings and reviews you leave or receive, reports you make about a listing, message or person, and who you have blocked.
Disputes: What you claimed, what you said about it, and any evidence — including photographs — that you or the other person filed.
Tax details (some sellers only): If you cross the thresholds in HMRC’s reporting rules for digital platforms: a legal name, date of birth, address and tax identification number. Almost nobody reaches this. See section 6.
Technical and security data: IP address and request metadata, used for rate limiting and abuse prevention; records of sign-ins, payment state changes, moderation actions and admin actions.

We do not ask for special category data (health, beliefs, biometrics and the like) and you should not put it into a listing, a message or a review.

3. Why we use it, and our lawful basis

Running your account: Creating it, signing you in, verifying your email, letting you reset a password.
Lawful basis: performance of a contract with you.
Running the marketplace: Publishing listings, handling offers, taking payment, instructing release of funds, arranging delivery, carrying messages, and running the dispute process.
Lawful basis: performance of a contract with you.
Service notifications: Telling you about your orders, offers, messages, ratings and claims. You can turn most of these off in notification settings. Ones carrying a deadline — disputes and moderation — stay on, because missing them costs you money or access.
Lawful basis: performance of a contract, and our legitimate interest in you not missing a deadline.
Safety, fraud and moderation: Screening listings for prohibited items, screening messages for attempts to move payment off the platform, acting on reports, suspending accounts, and rate limiting.
Lawful basis: our legitimate interest in a marketplace where people are not defrauded, and where illegal items are not for sale.
Security and record-keeping: Logging sign-ins, payment state transitions and admin actions so that a security incident can be investigated and a disputed transaction reconstructed.
Lawful basis: legitimate interest, and legal obligation.
Tax reporting: Reporting qualifying sellers and their sales to HMRC.
Lawful basis: compliance with a legal obligation.

We do not send marketing email, we do not profile you for advertising, and we do not sell or rent personal data to anyone. There is no advertising on Reisle.

4. Automated screening

Two automated checks run on things you write, and it is fairer to say so plainly.

Listings are checked against a list of prohibited terms when you publish. A match either blocks the listing — for categories where getting it wrong is a criminal offence — or lets it publish and flags it for a human to look at.
Messages are checked for attempts to move payment off the platform and for contact details being swapped. Messages are never blocked. A match sends the message, shows the sender a warning about the risk, and flags the thread for a moderator.

Neither check makes a decision with legal effect on its own. A blocked listing can be reworded or queried with us, and a flag is reviewed by a person before any account action follows. If you think a screen got it wrong, email hello@reisle.je.

5. Who else sees your data

Other users. Your display name, parish, bio, picture, ratings and listings are public. Someone you transact with sees what the order needs — your name and the delivery or collection arrangements. Your email address is never shown to another user.

Service providers. These process data on our instructions, under contract, and for no purpose of their own except where noted:

PayPal: Payment processing, holding funds and paying sellers. PayPal is an independent controller for what it does with your data — read PayPal’s privacy statement.
Vercel: Hosting the site and storing listing photographs.
Resend: Sending the emails the site sends you.
Upstash: Rate-limit counters, used to throttle abusive traffic.
Google and Apple: Only if you choose to sign in with them. They tell us your name, email and picture; we tell them nothing about what you do on Reisle.
Jersey Post: A tracking reference you enter is used to look up the parcel’s status. We do not buy postage on your behalf.

Authorities and advisers. HMRC, where the reporting rules require it. Law enforcement, a regulator or a court where we are legally required to disclose, or where it is necessary to investigate fraud. Our accountants and lawyers, under professional duties of confidence.

A buyer of the business. If Reisle is ever sold or merged, personal data would transfer with it, and we would tell you before that happened.

6. Where your data goes

Reisle serves Jerseyand is operated from the UK, but some of the providers above operate outside the UK. Where personal data is transferred out of the UK, we rely on the UK’s adequacy regulations for the destination country, or on the International Data Transfer Agreement (or the UK Addendum to the EU standard contractual clauses) where no adequacy decision applies.

You can ask us for details of the safeguards that apply to a particular provider at hello@reisle.je.

7. How long we keep it

Closing your account anonymisesit rather than erasing everything. Your name, email address, profile picture, parish and payout connection are removed, and your sign-ins and sessions are destroyed. The orders, messages and ratings you were part of stay, attributed to a deleted user — because they are also the other person’s record of a transaction they were in, and their purchase history has to keep making sense.

Account and profile: Until you close your account, then anonymised as above.
Orders, payments and disputes: Kept for as long as needed to handle claims, chargebacks and refunds, and after that for as long as tax and accounting law requires records of the transaction.
Messages: Kept while the account is open; retained in anonymised form afterwards, since the other side of the conversation is that person’s record too.
Seller tax details: Deleted when you close your account, unless we have already reported them to HMRC, in which case we keep what we reported for as long as those rules require.
Security and moderation logs: Kept long enough to investigate an incident and to make a pattern of abuse visible.

8. Your rights

You have the right to:

Get a copy of your data. You do not need to ask — download it yourself from your account page. It contains your data, not the other party’s: your own messages are included, theirs are not.
Correct it. Edit your profile directly, or email us for anything you cannot change yourself.
Have it erased. Close your account from the account page — see the retention note above for what that does and does not remove.
Object to, or restrict, processing we do on the basis of legitimate interests, and to have your data ported to another service.
Withdraw consent where we relied on it, without affecting what we did before you withdrew it.

Email hello@reisle.je to exercise any of these. We respond within one month, and will tell you if we need longer or cannot do what you asked — and why.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator.

9. How we protect it

Everything is served over HTTPS, with strict transport security enforced.
Passwords are stored hashed with bcrypt, never in a form we can reverse, and are checked against known-breached password lists when you set one.
Card details never reach our systems. Payments run entirely inside PayPal’s hosted flow.
Where a seller’s tax identification number is held, it is encrypted with a key kept outside the database.
Changing where your money is paid is treated as seriously as releasing funds: it requires re-authentication, notifies your account email, and is written to a security log.
Access to your data is checked on every request against who you are, not against what the page is showing.

No system is perfectly secure. If a breach happens that puts your rights at risk, we will tell the ICO and, where the risk is high, tell you.