Privacy Policy

Truelot (“Truelot”, “we”, “us”) is the data controller for the personal data described in this policy, in respect of your use of truelot.co.uk and its associated services (the “Platform”). This policy explains what we collect, why, and what rights you have under UK data protection law, including the UK GDPR and the Data Protection Act 2018.

• Account details: name, email address, phone number, password (stored as a salted hash, never in plain text), and your account role (buyer, seller, or agent).
• Listing information: property details, material information fields, and legal pack documents you upload if you are a seller or agent.
• Bidding activity: bids you place, and the auctions you win.
• Transaction and solicitor details: winning bid amounts, buyer fee payment status, and the solicitor firm, email, and reference you provide once a sale completes.
• Payment metadata: our payment processor, Stripe, shares limited transaction data with us (such as payment status and the last four digits of a card). We never receive or store your full card number.
• Security data: if you enable two-factor authentication, the authentication secret is encrypted before storage and is never visible to us or anyone else in plain text.
• Technical data: standard web request logs (IP address, browser type, timestamps) generated by using the Platform.

• To provide the Platform and perform our contract with you: creating your account, publishing listings, running auctions, processing payments, and compiling the solicitor hand-off bundle (contract performance).
• To meet our legal obligations, such as responding to lawful requests from authorities or complying with financial record-keeping requirements (legal obligation).
• To keep the Platform secure, prevent fraud, and enforce our Terms of Service (legitimate interests).
• To send you service emails, such as confirming a bid, a payment, or a hand-off package (contract performance and legitimate interests).

We do not use your data for third-party marketing, and we do not sell your personal data.

We share personal data only where necessary to run the Platform:

• Stripe, to process subscription payments, buyer fees, and other charges described in our Terms of Service;
• the buyer, seller, and their respective solicitors, once a sale completes, so the transaction can proceed. This is the core purpose of the solicitor hand-off feature and only happens for the parties directly involved in that specific sale;
• our email delivery provider, to send transactional emails such as bid confirmations and hand-off packages; and
• law enforcement or regulators, where we are legally required to disclose information.

Some of the providers listed in Section 4, including Stripe, may process data outside the UK. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as standard contractual clauses, to ensure your data remains protected.

We keep account and transaction data for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution requirements. Legal pack documents and solicitor hand-off bundles are retained for the same purpose and deleted when no longer required. You can ask us to delete your account at any time, subject to the retention we are legally required to keep.

Under UK data protection law, you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data, where we are not required to keep it for a legal or contractual reason;
• ask us to restrict or object to certain processing; and
• ask for your data in a portable format.

To exercise any of these rights, email [email protected]. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) if you think we have not handled your data properly.

We use only the cookies necessary to keep you signed in and to remember your session while using the Platform. We do not currently use third-party advertising or analytics cookies. If that changes, we will update this policy and ask for your consent where required.

Passwords are stored as salted hashes, never in plain text. Two-factor authentication secrets are encrypted at rest. Legal pack documents are stored privately and are only accessible to the parties entitled to see them. No method of storage or transmission is completely secure, but we take reasonable technical and organisational steps to protect your data.

The Platform is not directed at, and must not be used by, anyone under the age of 18.

We may update this policy from time to time. If we make a material change, we will let registered users know by email or by a notice on the Platform before it takes effect.

Questions about this policy, or requests relating to your personal data, can be sent to [email protected].