Privacy Policy

1. Who We Are

The data controller responsible for your personal data is:

2. Personal Data We Collect

We collect the following categories of personal data:

We do not intentionally collect special category data. If you include such data voluntarily in listings or messages, you do so at your own discretion.

3. Legal Basis for Processing (UK GDPR Article 6)

Every processing activity we carry out has a documented legal basis:

Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) and are satisfied our interests are not overridden by your rights and freedoms. You may request a copy of any LIA via our contact form.

4. How We Use Your Personal Data

• To create and manage your Dukanoh account.
• To facilitate marketplace transactions between buyers and sellers.
• To hold payments securely in escrow and release them upon confirmed delivery.
• To communicate with you about your account, orders, listings, and messages.
• To send transactional push notifications (e.g. order updates, delivery status).
• To send marketing push notifications where you have opted in (section 6). We do not currently send marketing emails.
• To personalise your marketplace feed and surface relevant listings.
• To power Dukanoh Fit: when you photograph a piece, the image is analysed automatically to identify the garment type and colour so we can suggest pieces that go with it. A copy of the photo may be kept, with no link to your account, to improve how Dukanoh Fit recognises South Asian garments.
• To understand your searches: the text you type into search is analysed automatically to work out the garment, colour, occasion or size you mean. It is processed without any link to your account.
• To improve garment recognition: photos and details from your listings are used to train and evaluate the automated systems that recognise South Asian garments. They are used for this only while the listing exists. Dukanoh Fit photos are kept for this purpose only if no person is in the photo.
• To detect and prevent fraudulent listings, transactions, and account activity.
• To moderate content and ensure compliance with our Prohibited Items Policy and the Online Safety Act 2023.
• To resolve disputes between buyers and sellers.
• To comply with legal and regulatory obligations including HMRC, AML, and ICO requirements.
• To improve App performance, fix bugs, and develop new features.
• To manage your Dukanoh Pro subscription, including billing, renewal, and Founder tier tracking.
• To process in-app purchases (such as Story Boosts) and deliver purchased features.
• To provide Pro sellers with analytics dashboards showing boost and listing performance metrics.

5. Trust, Safety & Fraud Prevention

Dukanoh uses automated systems and human review to protect users and maintain a trustworthy marketplace. This processing includes:

• Listing screening: Automated analysis of listing titles, descriptions, and images to detect prohibited items, counterfeit goods, and misleading content.
• Transaction monitoring: Behavioural analysis of account and transaction patterns to detect fraud, money laundering, or suspicious activity.
• Account standing: We keep a record of each account’s verification status, ratings, dispute history, cancellation strikes and tax-information status. These records determine what an account can do, for example whether a seller can receive payouts or whether their listings are shown. See section 20 for how automated decisions are handled.
• Dispute evidence: We retain records of buyer/seller disputes, reports, and moderation decisions to ensure consistent enforcement and enable appeals.

This processing is carried out under legitimate interests (protecting our platform and users) and legal obligation (AML Regulations, Online Safety Act 2023). You have the right to object to profiling based on legitimate interests; see section 15.

Transparency note: We will not covertly restrict or shadow-ban accounts without notifying the affected user, except where doing so would compromise an active fraud investigation or is required by law.

6. Push Notifications

We send three groups of push notifications to your device:

Switching off Activity or Marketing notifications never affects Orders and messages. We do not send push notifications on behalf of anyone else.

7. Seller Verification

Before a seller can receive payouts, they set up a payout account with Stripe Connect from inside the App. Stripe Payments UK Limited is the regulated payments firm, so it is Stripe, not Dukanoh, that carries out whatever identity and anti-money-laundering checks the law requires of it.

• What we send Stripe: your name, email address, phone number and date of birth, to open the account. Anything else Stripe asks for, such as an identity document or bank details, you give directly to Stripe on its own pages; it does not pass through Dukanoh.
• What Stripe sends back: whether your account is ready to receive payouts, and later, payout status. Dukanoh never receives identity documents, selfies or biometric data.
• When it happens: once, when you set up payouts. Stripe may ask you for more information later under its own rules. If it does, Stripe contacts you directly, and you can complete it from Settings → Payout Account in the App, which opens your Stripe account.

Stripe’s processing of your data is governed by Stripe’s privacy policy. Our legal basis for sending Stripe your details is contract performance (Art. 6(1)(b)); the checks Stripe then performs rest on its own legal obligations under the Money Laundering Regulations 2017.

8. Platform Tax Reporting (UK PIRRR 2023 / DAC7)

Dukanoh is a Reporting Platform Operator under the UK Platform Information Reporting Regulations 2023 (UK PIRRR 2023), which implement the OECD DAC7 framework into UK law. Under these regulations we are required to collect, verify, and annually report certain information about sellers who use the platform to generate income.

8.1 Who is affected

These obligations apply to sellers who, in any calendar year, either:

• complete 30 or more sales, or
• receive €2,000 or more in gross proceeds from sales (approximately £1,690 at current rates; the authoritative threshold is the euro figure as set by UK PIRRR 2023).

So that we hold your details before you cross the threshold, the App asks for them once you reach 29 sales or £1,690 in the calendar year, and warns you from 25 sales or £1,500. Until they are provided, your listings are hidden (section 8.5).

8.2 Data we collect for PIRRR reporting

This processing is carried out under legal obligation (Art. 6(1)(c) UK GDPR), because compliance with the UK Platform Information Reporting Regulations 2023 is not optional for Dukanoh.

8.3 How we use and share this data

• Tax reporting data is used solely to compile the annual PIRRR report submitted to HMRC by 31 January each year for the preceding calendar year.
• We share the required data elements directly with HMRC as the UK competent authority for DAC7 purposes.
• HMRC may further share this data with other tax authorities under international exchange-of-information agreements where the seller is tax-resident outside the UK.
• We do not use your tax identification data for any commercial purpose.

8.4 Seller notification

We will notify you by in-app notice when your transaction count or gross proceeds approach the reporting threshold. Once the threshold is met, you will receive a separate notice confirming that your details have been (or will be) included in the annual HMRC report. You may request a copy of the data reported about you via our contact form.

8.5 Listing suspension

Where a seller has reached the reporting threshold but has not provided their tax identification details, Dukanoh is required under UK PIRRR 2023 to suspend that seller’s listings until the details are provided. This is a legal requirement and not a discretionary enforcement measure. Listings will be reinstated promptly upon receipt of the required information.

9. Marketplace Transactions & Payment Escrow

When a buyer completes a purchase on Dukanoh, the following data processing occurs in connection with our escrow payment model:

• Payment is collected from the buyer and held securely by our payment processor on behalf of Dukanoh until the transaction is confirmed.
• Seller bank account details (provided during seller onboarding) are stored in encrypted form by our payment processor to facilitate payouts.
• Transaction metadata (amount, timestamp, item reference, buyer and seller identifiers) is retained for 7 years to satisfy HMRC obligations.
• If a dispute is raised, payment may be held beyond the standard release window for the duration of the dispute. A legal hold may extend this further if proceedings are initiated.

Our payment processor acts as a separate data controller for payment fraud prevention purposes. Their privacy policy governs that processing.

10. In-App Messaging

Dukanoh provides an in-app messaging feature allowing buyers and sellers to communicate about listings. In connection with this:

• Messages are kept while the conversation exists for either party. If you delete your account, the other person still sees the thread with your name replaced by “Deleted member”, because they may need the record for an order or dispute. Messages linked to an order are deleted two years after that order completes or is cancelled. A conversation that both people delete is removed within a week.
• Messages may be reviewed by our Trust & Safety team where a report of abuse, prohibited content, or fraud has been made.
• We do not read messages for commercial purposes or use them to serve advertising.
• To keep purchases inside Dukanoh Safe Checkout, messages, listing text and bios are checked automatically before they are saved. Email addresses, phone numbers, social-media handles and references to other payment or messaging services are replaced with “[hidden]”. For messages, the original text is kept for 90 days so our team can review misuse, then deleted. Listing text and bios are stored only in their edited form.
• Automated checks also run to detect illegal content as required under the Online Safety Act 2023.
• End-to-end encryption is not currently applied to in-app messages. Do not share sensitive personal or financial information via messages.

11. Cookies and Tracking Technologies

11.1 Website (dukanoh.com)

The website uses only strictly necessary cookies, set on the staff admin console: admin_session (auth) and csrf_token (CSRF protection). Both expire after 8 hours or on sign-out, whichever comes first. The website does not use analytics, advertising, marketing, or any third-party tracking cookies, and does not require a consent banner under PECR.

11.2 Mobile App

The Dukanoh mobile app uses no analytics, advertising or tracking SDKs and does not read your device’s advertising identifier. It stores only what it needs to work:

Because nothing is used for analytics or advertising, no consent banner is needed under PECR. Your notification choices, including the consent-based Marketing group, are at Settings → Notifications in the App. Full detail is in our Cookie Policy at www.dukanoh.com/cookie-policy.

12. Sharing Your Personal Data

We do not sell your personal data. We share it only as follows:

• Supabase (our database, sign-in, file storage and server functions): everything the App stores, hosted in the EU (Ireland).
• Vercel (hosts dukanoh.com and the staff console): website requests and the support and account-deletion forms.
• Stripe Payments UK Limited: payment amounts and order references for purchases; name, email, phone number and date of birth for sellers setting up payouts (section 7). Stripe is an independent controller for its own fraud prevention.
• RevenueCat: manages Dukanoh Pro subscriptions and Boost purchases; receives your Dukanoh user id and the purchase receipts issued by Apple or Google.
• Apple and Google: sign-in if you use Sign in with Apple or Google, in-app purchases, and delivery of push notifications to your device.
• Expo (push notification service): your device’s push token and the text of each notification.
• Resend (email): your email address and the content of the emails we send: order emails, which include the item, the order reference and, in the seller’s copy, the buyer’s first name and delivery address; notices that your selling has been paused; and replies to support requests.
• Anthropic: photos you submit for garment recognition or listing screening, and the text of searches you type, are analysed by Anthropic’s Claude API on our instructions, with no account identifier attached. Anthropic does not use them to train its models.
• Your seller: your first name and delivery address, so they can post the piece. Dukanoh does not share your details with couriers itself; the seller books postage directly.
• Buyer and seller (each other): to complete a transaction we share what is needed to fulfil it: the delivery address with the seller, and the seller’s username and rating with the buyer. Full contact details are not shared.
• HMRC (UK Platform Tax Reporting): seller name, date of birth, address, tax identification number and annual gross proceeds, as required by the UK Platform Information Reporting Regulations 2023 (UK PIRRR / DAC7). This disclosure is mandatory where the reporting threshold is met. See section 8.
• Legal and regulatory authorities: where required by law, court order, or to protect our legal rights or the safety of members.
• Dispute resolution: where a dispute is escalated, relevant transaction and communication records may be shared with the other party or a mediator to the extent necessary to resolve it.
• Business transfers: in the event of a merger or acquisition, under equivalent data protection obligations.

13. International Data Transfers

Our database and files are hosted in the EU (Ireland), which the UK treats as adequate. Some providers process data in the United States: Anthropic, RevenueCat, Resend, Expo, Vercel, Apple and Google. For those transfers we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Use our contact form to request a copy of the safeguards that apply.

14. Data Retention

We retain data only as long as necessary:

Where data cannot be deleted due to a live legal hold or ongoing dispute, we will inform you of the hold and its expected duration. Where possible, we will anonymise data rather than delete it where anonymisation satisfies the underlying retention purpose, since anonymised data is no longer personal data under UK GDPR.

What happens when you delete your account

Deleting your account removes your personal identity from Dukanoh: your name, profile photo, bio, phone, address, payment account, saved items, push tokens, and active listings (which are archived). Your username is permanently retired, so no one else can take it.

We keep an anonymised stub of your profile attached to records we are legally required to retain (orders, transactions, tax data, dispute history). Any review you wrote or received, and any conversation you took part in, remains visible to the other party labelled as “Deleted member”, because we cannot remove these without distorting the record for that person. Once the retention period for the related record expires, the stub is fully purged.

15. Your Rights Under UK GDPR

You have the following rights. We respond within one calendar month. You may exercise any of these rights by:

• submitting our contact form with the “Privacy or data request” category selected;
• emailing privacy@dukanoh.com; or
• writing to TAFSI LTD, 29 Chapel Street, Hyde, SK14 1JB.

16. Right to Complain

You have the right to complain to the Information Commissioner’s Office (ICO):

We ask that you contact us first via our contact form to try to resolve any concern before escalating to the ICO.

17. Online Safety Act 2023 & Content Moderation

As an online marketplace that hosts user-generated content, TAFSI LTD is subject to duties under the Online Safety Act 2023 (OSA). In fulfilling these duties we:

• Maintain and publish a Prohibited Items Policy setting out content and listings that are not permitted on the platform.
• Operate systems to identify, remove, and report illegal content, including listings for prohibited goods, in a timely manner.
• Process user reports of illegal or harmful content and action them promptly.
• Conduct regular illegal content risk assessments and maintain a record of our safety measures.
• Provide accessible mechanisms for users to report content and to appeal moderation decisions.

Processing of content for moderation purposes is carried out under legal obligation (Art. 6(1)(c)). Automated screening may be used as a first step, but removal decisions on disputed content involve human review.

18. Data Security

• Encryption of all data in transit (TLS 1.2+) and at rest.
• Tokenisation of payment card data by our PCI-DSS compliant processor.
• Role-based access controls, with staff accessing data on a strict need-to-know basis.
• Regular penetration testing and vulnerability assessments.
• ICO breach notification within 72 hours where required under UK GDPR Article 33.
• Internal incident response plan and post-incident review procedures.

Notifying you of a breach: Where a personal data breach is likely to result in a high risk to your rights and freedoms (for example, exposure of payment data, tax identification numbers, or account credentials), we will notify you directly without undue delay in accordance with UK GDPR Article 34. Notification will be sent to the email address associated with your account and will describe the nature of the breach, the data affected, the likely consequences, and the steps we are taking to address it.

You are responsible for keeping your login credentials secure. Report any suspected unauthorised access via our contact form immediately.

19. Children’s Privacy

Dukanoh is for users aged 18 and over only. We do not knowingly collect data from under-18s. If you believe a minor has registered, contact us via our contact form and we will delete the account without undue delay.

20. Automated Decision-Making

We use automated processes for listing screening, recommendation ranking, the tax-information hold described in section 8, and seller cancellation strikes. One of these produces a decision with a significant effect without a person being involved: when a seller reaches five cancellation strikes in 12 months, their selling is paused automatically (listings hidden, no new sales or listings), as set out in clause 4.7 of the Terms. We tell the seller the reason and the strike count straight away. You have the right to ask a person to review that decision, to give your side, and to contest it: use our contact form and a member of our team who did not set the rule will look at it. The same route is open for any other automated decision that affects you.

21. Changes to This Policy

We will notify you of material changes via the App or email at least 14 days before they take effect. The Effective Date above indicates the current version.

22. Contact Us

For all privacy and data protection enquiries: