Legal
Privacy policy
What personal data Copper Supply collects, why, who processes it for us, how long we keep it, and your rights under UK GDPR.
CSS International Ltd · Version of
Draft – pending solicitor review. This text is a working draft and may change before launch.
This policy explains how CSS International Ltd, trading as Copper Supply ("we", "us"), uses personal data when you use our website and app. We are the controller of that data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Company number 16110027. Registered office: 167–169 Great Portland Street, London W1W 5PF, United Kingdom. Our ICO registration number will be shown here once registration is confirmed.
For anything about your data, email sales@copper.supply with "Privacy" in the subject.
1. The data we collect
Account and profile. Your email address, name, role, country and city, company details, job title, bio, photo, the products you trade, language preference and, if you choose to give them, phone and WhatsApp numbers and a LinkedIn link.
Verification. Depending on the level you apply for: images of your identity document, a live selfie, company registration documents, proof of address, director information, past shipping and inspection documents, and the results and notes of our review. Selfies may be compared with your identity document to confirm they show the same person.
Listings, messages and deals. What you post, the messages you send, introductions you request or accept, deal rooms you join, offers, and documents you upload or share.
Electronic signatures. Your signature image or typed name, and the time, IP address and device information recorded when you sign, which go into the document's audit certificate.
Document checks and reports. The documents you submit for checking, the text and fields extracted from them, and the results. For due-diligence reports, the information you give us about the subject and what we find.
Fraud reports and warnings. Reports you make, including information about the people or companies you report, and any evidence you attach. Our blacklist may contain names, companies, phone numbers, emails, websites and warehouses linked to suspected fraud.
Payments. Your plan, payment history and a customer reference from our payment provider. We do not see or store your full card number.
Search requests. If you tell us what you are looking for without an account, the product, quantity, location and email address you give us.
Technical data. IP address, device and browser type, pages visited, and security and error logs.
2. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, listings, messages and deal rooms | Contract with you |
| Providing paid services: verification, document checks, reports | Contract with you |
| Comparing a selfie with an ID document to confirm identity | Your explicit consent, which you give when you submit them |
| Sanctions screening and preventing fraud on the platform | Legitimate interests in keeping the marketplace safe, and legal obligations |
| Reviewing fraud reports and publishing public warnings | Legitimate interests of members and the public in avoiding fraud |
| Taking payment and keeping financial records | Contract and legal obligation |
| Replying to search requests and enquiries | Legitimate interests, or steps before a contract at your request |
| Security, debugging and improving the service | Legitimate interests |
| Service emails, such as new messages and verification results | Contract with you; you can change notification settings |
We do not sell personal data, and we do not use it for advertising.
3. Who can see your data
Other members see your public profile: name, role, country and city, company, bio, photo, the products you trade, and your verification level and date. They see your listings once live, and the messages and documents you choose to share with them. They do not see your email address, phone number, verification documents or private notes unless you share them.
Our team sees what it needs to run the service: for example, reviewers see verification documents, and moderators see listings and fraud reports.
Service providers process data for us under contracts that require them to protect it and use it only on our instructions:
- Supabase: database, sign-in and private file storage
- Vercel: website and app hosting
- Stripe: payments and billing
- Resend: sending email
- Anthropic: the AI model that reads documents submitted for document checks. Under its commercial terms, Anthropic does not use the content we send to train its models.
- Didit: automated identity and company checks, when we switch these on. Until then, verification is reviewed by our own team.
We may also share data where the law requires it, to respond to lawful requests from authorities, to protect members from fraud, or as part of a sale or reorganisation of our business.
4. International transfers
Some of our providers store or process data outside the UK, including in the European Economic Area and the United States. Where data leaves the UK we rely on UK adequacy regulations, or on safeguards approved under UK law such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
5. How we protect it
Verification and trade documents are kept in private storage and opened only through links that expire after a few minutes. Access rules are enforced in the database itself. Data is encrypted in transit. Only people who need access to do their job have it. No system is perfectly secure, so please keep your sign-in details safe and tell us at once if you think your account has been misused.
6. How long we keep it
| Data | How long |
|---|---|
| Account, profile and listings | While your account is open, then up to 6 years for legal claims |
| Identity documents and selfies | Until 12 months after your verification expires or your account closes, whichever is sooner, unless needed for an open fraud investigation |
| Verification results and review notes | 6 years after your account closes |
| Messages and deal-room records | While your account is open, then up to 6 years for legal claims |
| Signed documents and audit certificates | As long as any party to the document has an account, then up to 6 years |
| Payment and tax records | 6 years, as required by UK law |
| Fraud reports and blacklist entries | Up to 6 years after the last related activity, reviewed yearly |
| Search requests | 2 years |
| Security logs | Up to 12 months |
7. Your rights
You have the right to ask for a copy of your data, to correct it, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on consent. Some rights have limits: for example, we may need to keep records to meet legal obligations or to deal with fraud.
To use your rights, email sales@copper.supply. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, but we would appreciate the chance to put things right first.
8. Children
Copper Supply is for business use by adults. We do not knowingly collect data from anyone under 18.
9. Changes
We will update this policy when our use of data changes, and tell you about significant changes by email or in the app.
Questions about this document? Email sales@copper.supply.