Privacy Policy

Data Collection

Charm collects personal data to provide, improve, and secure our platform. We collect data in the following ways:

Information you provide directly:

• Account registration data: name, email address, password, profile photo
• Identity verification: government-issued ID, proof of address (for verified sellers)
• Listing data: equipment descriptions, photos, pricing, location
• Payment information: bank details, card numbers (processed securely via Stripe)
• Communications: messages, reviews, support tickets, and feedback

Information collected automatically:

• Device information: browser type, operating system, screen resolution
• Usage data: pages visited, features used, search queries, session duration
• Location data: approximate location based on IP address (precise location only with consent)
• Cookies and tracking technologies (see Section 4 for details)

How We Use Data

We process your personal data based on one or more of the following legal bases under GDPR: contractual necessity, legitimate interest, consent, or legal obligation.

Specifically, we use your data to:

• Operate and maintain your account and provide the core platform services
• Process transactions, payments, and payouts between users
• Verify user identities and prevent fraud, abuse, and security threats
• Personalise your experience with relevant recommendations and search results
• Send transactional communications (booking confirmations, payment receipts, etc.)
• Send marketing communications (with your consent, which you can withdraw at any time)
• Improve our platform through analytics, A/B testing, and user research
• Comply with legal obligations and respond to lawful requests from authorities

Data Sharing

Charm does not sell your personal data. We share data only in the following circumstances:

• With other users: When you book or list equipment, relevant profile information is shared with the other party (name, profile photo, reviews, general location)
• Service providers: We work with trusted third parties for payment processing (Stripe), cloud hosting (AWS), email delivery (Postmark), analytics (Mixpanel), and identity verification (Onfido)
• Insurance partners: When you opt into our equipment protection programme, necessary transaction details are shared with our insurance underwriter
• Legal requirements: We may disclose data when required by law, court order, or to protect the rights, safety, or property of Charm, our users, or the public
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction

All third-party service providers are bound by data processing agreements that require them to protect your data in accordance with GDPR and this Privacy Policy.

Cookies

Charm uses cookies and similar tracking technologies to enhance your experience, analyse usage, and support our marketing efforts.

Essential cookies: Required for the platform to function (authentication, security, preferences). These cannot be disabled.

Analytics cookies: Help us understand how users interact with the platform (Mixpanel, Google Analytics). These are activated only with your consent.

Marketing cookies: Used to deliver relevant advertisements and track campaign performance. These are activated only with your consent.

You can manage your cookie preferences at any time through our cookie banner or by adjusting your browser settings. Disabling non-essential cookies will not affect your ability to use the platform's core features.

Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under GDPR:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to data processing based on legitimate interest or direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact our Data Protection Officer at dpo@charm.space. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.

Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Regular security audits and penetration testing by independent third parties
• Strict access controls with role-based permissions and multi-factor authentication
• 24/7 infrastructure monitoring and automated threat detection
• Employee security training and confidentiality agreements

While we strive to protect your data, no system is completely secure. If you discover a security vulnerability, please report it responsibly to security@charm.space.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, plus any period required by law. Specific retention periods include:

• Active accounts: Data is retained for the lifetime of your account plus 30 days after deletion
• Transaction records: Retained for 7 years to comply with UK financial regulations
• Identity verification documents: Retained for 5 years after account closure
• Support tickets: Retained for 3 years after resolution
• Analytics data: Aggregated and anonymised after 26 months

When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

Contact the DPO

Charm has appointed a Data Protection Officer (DPO) to oversee our data protection practices and ensure compliance with GDPR and UK data protection law.

You can contact our DPO for any privacy-related questions, concerns, or to exercise your data rights:

• Email: dpo@charm.space
• Post: Data Protection Officer, Charm Ltd, 10 Shoreditch High Street, London, E1 6JJ, United Kingdom
• Response time: We aim to respond to all data protection inquiries within 30 calendar days

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or your local data protection authority.