Privacy Policy

1. Introduction

Welcome to MobileStock (operated by MobileStock Technologies Ltd, registered in England & Wales). We respect your privacy and are committed to protecting your personal and commercial data. This privacy policy informs you how we safeguard your data when using our software platform and website, and outlines your statutory rights under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

2. Data We Collect

We collect only the data necessary to provide and operate the MobileStock operating system:

• Identity & Account Data: First name, last name, business email address, role in company, and authentication identifiers.
• Business & Inventory Data: Stock inventories, IMEI and serial numbers, condition grades, buy prices, sale prices, repair logs, and supplier details entered by you.
• Financial & VAT Telemetry: Purchase invoices, sales transaction receipts, and calculated HMRC Notice 718 Margin VAT figures necessary to automate compliance.
• Integration Tokens: Encrypted OAuth tokens for authorized third-party channels (such as eBay or Back Market) to perform real-time inventory synchronization.
• Technical Data: IP address, browser type, operating system, and system activity logs for security monitoring and audit integrity.

3. How We Use Your Data

We process your data strictly under lawful bases (contract performance, legal compliance, and legitimate interests):

• To provision, authenticate, and maintain your private business tenant.
• To execute multi-channel inventory synchronization, barcode generation, and counter sales.
• To compute landed device cost absorption, technician repair labor, and HMRC Notice 718 VAT calculations.
• To maintain statutory records required under UK second-hand margin scheme regulations.
• To provide customer support and technical troubleshooting.

4. No Selling or Commercial Exploitation of Data

We uphold a strict policy against commercializing customer information:

• We do not sell your personal or commercial data to advertising brokers, market research firms, or data vendors.
• We do not aggregate your IMEI inventory or pricing data to trade or compete in secondary mobile electronics markets.
• Your supplier relationships and cost of goods are strictly isolated to your verified company profile.

5. Data Isolation & Security Controls

We implement technical safeguards to ensure multi-tenant isolation and security:

• Database Partitioning: Records are isolated with PostgreSQL Row-Level Security (RLS) linked strictly to your company ID.
• Role-Based Access: Customizable staff permissions prevent non-administrative counter staff from viewing cost prices or business balance sheets.
• Encryption Standards: Data in transit is protected via TLS 1.3 encryption. Data at rest and snapshot backups are encrypted using AES-256.
• Payment Security: Card payments and billing are managed directly through Stripe under PCI-DSS Level 1 certification. We never store payment card numbers.

For a comprehensive technical overview, please see our dedicated Data & Security Architecture page.

6. Data Portability & Your Legal Rights

Under UK GDPR, you have strong rights regarding your data:

• Right of Portability: You may download your entire active inventory, IMEI history, repair logs, and VAT calculations in standard CSV format at any time directly through your dashboard.
• Right of Access & Rectification: You may inspect and correct any personal account information stored in your user profile.
• Right of Erasure ("Right to be Forgotten"): Upon termination of your account, you may request the full deletion of your company records, subject only to statutory UK HMRC record retention obligations (HMRC Notice 718 requires 6 years of VAT margin records).

7. Contact the Data Protection Officer

If you have questions about this policy or wish to exercise your statutory data rights, please contact our Data Protection Team at: