Privacy policy

01 Who controls your data

We are the controller of the personal data described in this policy. In plain terms: we decide what is collected and why, and we are answerable for it.

This policy is written to align with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its implementing regulations.

02 What we collect

When you request a price or book a pickup

• Identity: your name; the type of identification you present (Emirates ID, passport, UAE driving licence or GCC national ID) and the number on it.
• Contact: mobile number, and email address if you give one.
• Collection address: street address and PIN code, where you ask us to collect.
• Device information: brand, model, storage, IMEI or serial number, and the nine condition answers you provide. Our inspection staff record the confirmed condition, a grade, and any notes.
• Transaction information: the offer, the amount paid, the payment method, receipt and certificate numbers, and the staff member who handled it.

If you pay or are paid by bank transfer

We record the transaction reference your bank provides. We do not collect or store card numbers, CVVs or bank passwords.

03 The contents of your device

We do not read, copy, index, back up or retain the contents of your device — photographs, messages, contacts, documents or accounts are not accessed by us.

The only thing we do with your data is erase or destroy it, using the method you choose, and record that we did so on a certificate. Where a device cannot be erased successfully, its storage media is destroyed instead.

Because of this, we cannot recover data for you after handover. Back up anything you want to keep before we collect the device.

04 Why we collect it

• To price and buy your device — quoting, inspecting, and paying you.
• To verify identity and ownership — used-device trading is a known route for stolen property and fraud; checking who is selling, and that the device is not blocked, protects you and us.
• To prevent duplicate and fraudulent sales — IMEI and serial numbers are checked against our purchase records.
• To meet our legal obligations — tax, VAT invoicing, accounting and record-keeping requirements, and responding to lawful requests from authorities.
• To issue your documents — the purchase receipt, and the certificate of data sanitisation.
• To handle complaints and disputes — an audit trail of what was agreed, by whom, and when.

We do not use your data for automated decision-making that produces legal effects, and we do not sell it.

05 Our legal bases

Under the PDPL we rely on:

• Performance of a contract — the sale of your device, and everything needed to complete it.
• Compliance with a legal obligation — tax, invoicing and record-keeping.
• Legitimate interests — preventing fraud and handling stolen goods, keeping an audit trail, and defending legal claims. We balance these against your rights and keep the data we use for them to a minimum.
• Consent — only where we ask for it specifically (for example, if you opt in to marketing, which you are not required to do to sell a device).

06 Cookies and local storage

This website sets no advertising or analytics cookies, and we do not embed third-party trackers, pixels or social plug-ins. Fonts are loaded from Google Fonts, which receives the request for the font file.

Two things are stored in your browser's local storage, on your own device:

• the reference of the most recent order you booked, so the tracking page can find it;
• on the staff console only, a session token that keeps a signed-in member of staff signed in.

You can clear both at any time by clearing site data in your browser. Doing so does not affect any order you have already placed.

07 Who we share it with

We share personal data only where it is necessary, and never as a commercial product:

• Banks and payment providers — to pay you.
• Our licensed recycling and ITAD partner — where a device is sent for material recovery. They receive device identifiers, not your identity, unless a certificate or manifest requires otherwise.
• Our accountants, auditors and professional advisers — under confidentiality.
• Our hosting provider — which stores the order database on our behalf.
• Courts, police and regulators — where the law requires it, or to establish or defend a legal claim, or where we have reasonable grounds to believe a device was stolen.

Where a processor handles data on our behalf, we require it to act only on our instructions and to keep it secure.

Transfers outside the UAE: our hosting and email providers may store data on servers located outside the UAE. Where that happens, we rely on the transfer mechanisms permitted by the PDPL and keep the data set to what is necessary.

08 How long we keep it

• Order, payment and invoice records — 5 years from the end of the relevant tax year, as required for accounting and VAT purposes.
• Identity records tied to an order — 5 years, for the same period, because they support the ownership declaration behind a purchase.
• Data sanitisation certificates — 5 years, tied to the order they belong to.
• Audit logs — 5 years; these record staff actions such as price changes and payment approvals.
• Enquiries that never became an order — the details are not retained beyond the quote's 48-hour validity period.

When the retention period ends, records are deleted or irreversibly anonymised.

09 How we protect it

• Access to the order system is through individual staff accounts with role-based permissions — an inspector cannot see the price master or change currency; finance handles payments.
• Every price change, payment, override and certificate issuance is written to an audit log with the user, the timestamp and the reason.
• Data is transmitted over HTTPS, and passwords are stored as salted hashes rather than plain text.
• Physical documents — receipts and certificates — are kept at our registered premises.

If a breach affects your personal data, we will notify you and the relevant UAE authority as required by the PDPL.

10 Your rights

Subject to the conditions in the PDPL, you may ask us to:

• confirm whether we hold your personal data, and give you a copy;
• correct anything inaccurate;
• erase data we no longer have a lawful reason to keep — note that tax and audit records cannot be erased before their retention period ends;
• restrict or object to certain processing, including processing based on our legitimate interests;
• port the data you gave us, in a structured, machine-readable format;
• withdraw consent where processing is based on it, without affecting what was done before.

To exercise any of these, contact us using the details in section 14. We will respond within the period the PDPL allows and may ask you to verify your identity first, so that we do not disclose data to the wrong person.

If you are not satisfied with our response, you may complain to the UAE Data Office (the authority established under the PDPL) or to the relevant authority in your emirate.

11 Marketing

We contact you about the order you placed — confirmation, pickup, the final offer, payment, and your certificate. We do not add you to a marketing list for selling a device, and we do not pass your details to anyone else for their marketing. If we ever introduce marketing messages, they will be opt-in and you will be able to stop them at any time.

12 Children

This service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover that we have, we will delete it.

13 Changes to this policy

We may update this policy as the service or the law changes. The date at the top of the page tells you which version you are reading. If a change materially affects how we use data we already hold, we will tell you before it takes effect.

14 Contact

For any question about this policy, or to exercise a right described above:

Please include the order number from your receipt or certificate if your question relates to a specific sale — it lets us find the record without asking you for more information.