Privacy Policy

Effective Date: 28 September 2026
Last Updated: 28 September 2026

1. Who we are

SustaPlates is operated by:

SustaPlates Ltd
Company number: 17165401
64 Rooley Lane
Bradford
BD5 8LX
United Kingdom

Email: info@sustaplates.com

For applicable UK data-protection purposes, SustaPlates Ltd acts as a controller for personal information it processes to operate its platform and services.

2. Information we collect

Buyers

We may process:

• email address;
• hashed password;
• optional display name;
• optional telephone number;
• optional home postcode;
• optional device location;
• order and transaction history.

Sellers

We may additionally process:

• business/trading name;
• business address;
• store addresses;
• store coordinates;
• KYC documents;
• business-registration information;
• listing information;
• listing images.

Charities

We may additionally process:

• charity registration information;
• collection postcode;
• collection-point information;
• catchment radius;
• service-area information;
• mission/service information;
• verification documents.

3. Verification documents

Depending on the type of account, verification documents may include:

• identity documents;
• proof of address;
• Companies House documentation;
• sole-trader UTR information;
• food-hygiene certificates;
• Charity Commission documentation;
• certificate of incorporation;
• responsible-person identification;
• governing documents;
• other verification documents reasonably required.

Uploaded identity documents may contain information such as photographs or dates of birth.

SustaPlates does not require a separate date-of-birth field simply for registration.

4. How we use personal information

We use personal information to:

• create and administer accounts;
• authenticate users;
• facilitate marketplace transactions;
• process subscriptions;
• verify Sellers and Charities;
• provide transactional communications;
• provide customer support;
• maintain security;
• prevent fraud and abuse;
• investigate incidents;
• maintain audit records;
• resolve disputes;
• comply with legal obligations;
• protect our rights;
• send marketing where permitted.

5. Lawful bases

Depending on the circumstances, SustaPlates relies on:

Contract

To provide requested services and perform transactions.

Legal obligation

Where processing is required by law.

Legitimate interests

For security, fraud prevention, platform administration, dispute management and other legitimate business purposes where our interests are not overridden by the individual's rights.

Consent

Where consent is legally required, including certain optional cookies and marketing.

6. KYC and verification

KYC information is used to verify participating Sellers and Charities and support marketplace safety, fraud prevention and related legal/business requirements.

KYC documents are stored privately.

Access is restricted to authorised personnel with a legitimate need to access the information.

KYC documents are normally retained for 5 years after the relevant Seller or Charity relationship ends, unless a documented lawful reason requires longer retention.

7. Location

SustaPlates uses UK postcode information and postcode-to-coordinate functionality.

The current postcode-to-coordinate service is postcodes.io.

SustaPlates may also use browser/device Geolocation for optional "Near me" functionality.

Device geolocation requires the user's browser permission.

SustaPlates does not currently use Google Maps API as a server-side location-processing service.

An optional "Verify on Google Maps" link may open Google Maps directly in a separate browser tab.

8. Payment processing

SustaPlates uses Stripe Checkout for applicable payment and subscription services.

SustaPlates does not store complete card details.

Stripe may receive necessary information including email address, order reference, amount and subscription information.

SustaPlates stores limited Stripe identifiers and subscription information.

9. Email

Transactional emails are sent using Microsoft Graph/Microsoft 365 from SustaPlates email accounts.

Postmark and AWS SES are not currently active SustaPlates email providers.

10. Hosting and infrastructure

SustaPlates uses:

• DigitalOcean London hosting;
• self-hosted PostgreSQL;
• DigitalOcean Spaces London;
• Cloudflare DNS;
• Cloudflare Turnstile;
• Microsoft 365;
• Stripe;
• postcodes.io;
• Sentry.

DigitalOcean Spaces is used for KYC documents, listing images and branding assets and is configured as private storage.

11. Cloudflare

Cloudflare is currently used for DNS and Turnstile security.

SustaPlates does not currently use Cloudflare proxy/CDN/WAF functionality for the application.

Turnstile may process IP address, standard request headers and challenge information for security purposes.

12. Error monitoring

Sentry is used for technical error monitoring.

Sentry is consent-gated behind applicable analytics consent.

PII minimisation and scrubbing are applied.

Sentry data is currently processed in the EU/Germany region.

13. AI assistant

The SustaPlates help assistant currently operates using deterministic/rule-based functionality.

The configured OpenAI/Anthropic fallback is disabled.

No chat content is currently sent to those providers while the fallback remains disabled.

14. Cookies

SustaPlates uses essential and functional cookies and may use optional analytics/error-monitoring technology where legally permitted.

Full details are provided in the SustaPlates Cookie Policy.

15. Who we share information with

Information may be shared with:

• DigitalOcean;
• DigitalOcean Spaces;
• Stripe;
• Cloudflare;
• Microsoft 365/Microsoft Graph;
• postcodes.io;
• Sentry;
• authorised SustaPlates administrators;
• transaction participants where necessary;
• professional advisers;
• regulators or law enforcement where legally required.

We do not sell personal data to advertisers.

16. International transfers

Primary SustaPlates application and database infrastructure is located in London, UK.

Certain service providers may process information internationally.

Where restricted international transfers occur, SustaPlates will use an appropriate lawful transfer mechanism and safeguards.

The Microsoft 365 tenant region should be confirmed and recorded in the internal Subprocessor Register.

17. Retention

Our current retention schedule is:

Backups are governed by a separate internal backup policy.

18. Account deletion

Users may request account deletion.

Where appropriate:

• sessions are revoked;
• account information is anonymised;
• unnecessary personal information is deleted.

Transaction, security, audit, legal and other records may be retained where there is a lawful reason.

19. Your rights

Subject to applicable law, you may have rights to:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability;
• withdrawal of consent;
• objection to direct marketing.

Requests should be sent to:

info@sustaplates.com

20. Complaints

You may contact SustaPlates first.

You may also contact the Information Commissioner's Office where you believe your data-protection rights have not been properly addressed.

21. Security

SustaPlates uses measures including:

• HTTPS/TLS;
• HSTS;
• CSP/security headers;
• Argon2id password hashing;
• administrator TOTP 2FA;
• role-based access controls;
• firewall controls;
• private object storage;
• encryption;
• audit logging;
• rate limiting;
• security monitoring.

No internet service can be guaranteed completely secure.

22. Changes

This Privacy Policy may be updated where necessary to reflect legal, technical or operational changes.

23. Contact

SustaPlates Ltd
64 Rooley Lane
Bradford
BD5 8LX
United Kingdom

Email: info@sustaplates.com