Privacy notice

Evanchick Processing Ltd, a company registered in England and Wales with company number 15658899, whose registered office is 32 Byron Hill Road, Harrow, HA2 0HY. We trade as Evanchic. We are the data controller for the information described here.

For anything to do with your information, write to daniel@evanchic.com. There is no separate data protection officer, and we are not required to appoint one.

We are registered with the Information Commissioner's Office, registration number ZC254815.

We sell to businesses, not to the public, so most of what we hold is business information. But a business is run by people, and a sole trader or a partner is a person in law, so their details are personal data and this notice applies to them.

It covers three groups: people who apply for or hold a trade account with us, people at businesses we deal with, and the customers of our trade buyers whose delivery details we are given in order to send a parcel.

We only collect what the account and the order actually need.

1. When you apply for a trade account: your business name, your name, your email address, your telephone number, what you sell, a link to where you sell it, where the business is based (country, and if you give them, town and postcode), where else you sell, how you heard about us, and, if you give them, your company number and VAT number. We use this to decide whether you are trading, because trade prices and unseen stock are not for retail buyers. Our lawful basis is our legitimate interest in verifying that the people we give trade access to are genuine businesses, and taking steps at your request before entering a contract.
2. When you order: your invoice email and invoice address, what you bought, what you paid, any notes you leave us, and the invoice itself. Our lawful basis is performing our contract with you, and complying with our legal obligations on tax records.
3. When you use the catalogue: which pieces you open, what you search for (including searches that find nothing), and what you add to or take out of an order. We use it to understand what the trade wants, so that we buy and restore the right stock, and we read it mostly in totals: which stones, sizes and eras are asked for, and where our buyers are. It is recorded only while you are signed in to the catalogue, and it never includes your device, your location or your IP address. Our lawful basis is our legitimate interest in stocking the business well.
4. When you sign in: your email address, and the sign-in links we send you. Our lawful basis is performing our contract with you.
5. When you ask us to find something: what you are looking for and roughly what you want to pay. Our lawful basis is performing our contract with you, and our legitimate interest in buying stock our buyers actually want.
6. When we decline or revoke an account: we keep the record, including the reason. We do not delete it, because a fresh application from the same business under a different email address needs to match the record we already have. Our lawful basis is our legitimate interest in running the account checks consistently and in preventing people from working around a decision.
7. New stock emails: your email address and your choice, with the date you made it. When you apply, the box for them is ticked to start with, and you can untick it. If we set up your account for you, they start switched on. You can also switch them on or off at any time in the book, or stop them by replying to any of them, and they stop straight away. They are only ever about our own stock. Our lawful basis is our legitimate interest in telling trade customers about stock like the stock they applied to buy, which the rules on marketing emails allow as long as you can say no at the start and in every email.
8. If you ask to hear about listing your own items: that you asked, and when. We use it only to tell you when that service opens. Our lawful basis is your request.

We do not use your information to make automated decisions about you. Applications are scored to help us look at the right things, but a person reads every one and a person makes the decision.

We do not send marketing email to people who have not asked for it, and we do not sell or rent anyone's details to anybody.

On any order you can ask us to send the parcel straight to your own customer instead of to you. When you do, you give us that person's name and delivery address.

1. We use those details for one thing: getting that parcel delivered. We do not market to them, we do not add them to any list, and we do not contact them at all unless there is a problem with the delivery.
2. We hold them against the order, so they are kept for as long as the order record is kept. See clause 8.
3. As between you and us, those details remain yours. You confirm, when you give them to us, that you are entitled to pass them to us so that we can deliver on your behalf. Your own privacy notice is what covers that person, because they are your customer, not ours.
4. We pass the name and address to the carrier, because a parcel cannot be delivered without them.

1. If you write us a testimonial, we publish it on our website with your business name against it. We do not publish your own name, your photograph, your email address or anything else about you.
2. Nothing is published automatically. We read every one first, and we can edit an obvious typo but we do not change what you said.
3. Our lawful basis is your consent, given by writing and sending it. You can withdraw that consent whenever you like, from your account or by emailing us, and we take it down.

A short list, and nobody on it gets your details for their own purposes.

1. Supabase, our hosting and database provider, which stores the account and order records, the stock photographs, and runs the sign-in.
2. Resend, our email provider, which delivers sign-in links, account emails and invoices.
3. Cloudflare, which hosts the website and counts visits to it (clause 10).
4. Carriers, who get the delivery name and address and nothing else.
5. Laurence Ian Jewellers, who authenticate and restore the pieces. They see what is being sold, not who is buying it, unless a piece is going direct to a named customer.
6. Our accountant, and HMRC, for the tax records we are required to keep.
7. Professional advisers, and anyone we are legally obliged to tell.

1. The database and the stock photographs stay in the United Kingdom. Supabase holds them in its London region. Your account, your orders, your invoices and any delivery address you give us do not leave the country.
2. Email does go to the United States. Resend stores message content, delivery logs and account records there, whichever region a message is routed through. So the text of an email we send you, and the fact we sent it, sit on servers in the US for as long as Resend keeps it, which is 30 days.
3. That transfer is covered. Resend's data processing addendum is in force on every account and incorporates the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, and Resend participates in the UK Extension to the EU-US Data Privacy Framework. Those are the safeguards UK law asks for.
4. In practice the personal data that reaches the US is small: an email address, a business name, an invoice. The stock book, the cost prices and everything behind the sign-in stay in London.
5. Cloudflare serves the website from its worldwide network, so a request for a page may be handled outside the UK. Its data processing addendum carries the same safeguards as above.

1. Orders, invoices and the stock book: 6 years after the end of the accounting period they fall in, because VAT law requires it. The second-hand margin scheme requires a stock book recording what we paid for each piece, what we sold it for, to whom, and under which invoice number. We cannot delete a sale record inside that period even if you ask us to.
2. Delivery details for your own customers: kept with the order, so the same period. We do not hold them anywhere else.
3. Trade accounts: for as long as the account is open, and then for 6 years after the last transaction.
4. Declined and revoked applications: kept, with the reason, for as long as we are trading, for the reason given in clause 3.6. If you want yours removed, ask us, and we will weigh your request against that reason and tell you the answer either way.
5. Sourcing requests: 2 years, or until you ask us to remove them.
6. Your choice about new stock emails: kept with your account, including when you made or changed it, so we can show what you asked for.
7. Asking to hear about listing your own items: until we have told you the service is open, or until you ask us to remove it.
8. Catalogue activity (pieces opened, searches, holds): 24 months, then deleted automatically. Totals worked out from it carry no names and are kept.
9. Testimonials: until you withdraw them.
10. Emails and their delivery logs: 30 days at our email provider. Our own copy of what an email said lives in the order record, and follows the rule above it.

You can ask us to give you a copy of what we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or send it to someone else in a machine-readable form. You can object to anything we do on the basis of a legitimate interest, and we then have to show a compelling reason to carry on or stop.

Two honest limits. We cannot delete a transaction record inside the 6-year period above, because keeping it is a legal obligation. And a request to delete a declined application is weighed against clause 3.6 rather than granted automatically.

You can stop new stock emails at any time, in the book or by replying to any of them. It changes nothing else about your account.

Email daniel@evanchic.com. We answer within one month, and we do not charge for it.

1. The public website sets nothing on your device. We count visits with Cloudflare Web Analytics, which uses no cookies and no local storage and does not identify you. It tells us how many visits a page had, from which country, and which website sent them.
2. The trade catalogue keeps your sign-in token in your browser's own storage, so that you stay signed in between visits. It is strictly necessary for a service you asked for, so it does not need your consent. Signing out removes it.
3. We do not use advertising or analytics cookies.

The trade catalogue and its prices are closed by default: an unapproved or signed-out visitor can read nothing at all. Access is granted per account, at the database itself rather than only in the website, so a missing check in a page cannot expose stock or prices. Stock photographs sit in private storage and are served through short-lived links. Administrator rights are held in their own table that no buyer can write to.

The single exception is published testimonials, which are public by design: a visitor can read the business name, the words and the date, and nothing else.

No system is perfect. If there is ever a breach that is likely to put anyone at risk, we will tell the Information Commissioner within 72 hours and tell the people affected without undue delay.

If we change this notice we will change the version and date at the top, and tell account holders if the change is significant.

If you are unhappy with how we have handled your information, tell us first and give us a chance to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. Complaining to us first does not take away your right to go to them.