1. About This Policy
This Privacy Policy applies to all personal data we process about you in connection with our services. By using our website at chartersgold.co.uk (the "Site") or by submitting a valuation request, you acknowledge that you have read and understood this Policy. Where consent is required by law, we will request it separately.
This Policy should be read alongside our Terms & Conditions and our Cookie Policy.
2. Data Controller
For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, the data controller is Charters Gold, trading from Avalon House, Unit 7A, Egham Business Village, Crabtree Road, Egham, Surrey, TW20 8RB. Where required, we are or will be registered with the Information Commissioner's Office ("ICO").
Any questions about this Policy or your personal data should be sent to info@goldcharters.com or by telephone to 07951999999.
3. Personal Data We Collect
We only collect personal data that is necessary for the purposes set out in this Policy. The categories of data we collect include:
3.1 Information You Provide Directly
- Identification: your full name, date of birth (where applicable for anti-money laundering compliance), residential address, copy of government-issued photo identification (such as passport or driving licence), and proof of address.
- Contact details: email address, telephone number, and (where provided) WhatsApp number.
- Transaction details: a description of the items you wish us to value, weights, carat, hallmarks, brand, condition, estimated value, photographs of the items and any supporting documents such as certificates, receipts, valuations or boxes.
- Bank details: for processing payment of an accepted offer (account holder name, sort code, account number).
- Communications: the content of any correspondence with us, including email, telephone notes, WhatsApp messages and in-person meeting notes.
3.2 Information We Collect Automatically
- Technical data: IP address, browser type and version, time zone, device type, operating system and approximate location derived from IP.
- Usage data: pages visited, time on page, referring source, and similar analytical information.
- Cookies and similar technologies: see our Cookie Policy for full detail.
3.3 Information From Third Parties
We may receive identity verification results, sanctions and politically-exposed-person ("PEP") screening data, and credit-reference enquiry results from regulated third-party identity verification and anti-money laundering service providers.
4. Lawful Bases For Processing
Under the UK GDPR we rely on one or more of the following lawful bases when processing your personal data:
- Contract: processing necessary to take steps prior to entering into, and to perform, our contract with you (e.g. valuing your items, paying you).
- Legal obligation: processing required by UK anti-money laundering ("AML"), counter-terrorist financing, tax, and other legislation applicable to dealers in high-value goods.
- Legitimate interests: processing necessary for our legitimate interests of running and growing our business, preventing fraud, recovering debts, defending claims and maintaining the security of our systems, except where overridden by your rights.
- Consent: where you have expressly agreed (e.g. to marketing communications or non-essential cookies). You may withdraw consent at any time.
5. How We Use Your Personal Data
We use your personal data only for specific, lawful and proportionate purposes:
- To respond to your valuation enquiry and provide you with an offer.
- To inspect, test, authenticate, photograph and value items you submit.
- To verify your identity and conduct anti-money laundering due diligence.
- To pay you the agreed price upon acceptance of our offer.
- To return items where an offer is not accepted, subject to our Terms & Conditions.
- To keep records as required by law and to defend ourselves against claims.
- To prevent, detect and investigate fraud, theft and other unlawful conduct.
- To improve our website, services and customer experience.
- To send service communications (e.g. confirmations, valuations, payment notifications).
- To send marketing communications, where you have opted in. You may unsubscribe at any time.
6. Anti-Money Laundering & Regulatory Reporting
As a dealer in high-value goods, we are required under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended) to carry out customer due diligence in certain circumstances. This may include collecting and verifying your identification documents and source of funds or source of items.
We are legally obliged to report any suspicious activity to the National Crime Agency ("NCA") and/or HM Revenue & Customs ("HMRC"), and we are prohibited by law from notifying you of such a report ("tipping off"). We may also be required to disclose data to police, courts, regulators or other authorities with appropriate legal authority.
7. Who We Share Your Data With
We never sell your personal data. We share it only with parties listed below:
- Service providers: trusted suppliers we engage to provide services on our behalf, including secure hosting (Supabase, Vercel), email and communications providers, identity verification platforms, postal and courier carriers (e.g. Royal Mail Special Delivery, secure couriers), refining partners, payment processors, accountants and professional advisers. All such providers are bound by confidentiality and data processing agreements.
- Regulatory authorities and law enforcement: where required by law, including (but not limited to) the NCA, HMRC, ICO, police and the courts.
- Professional advisers: our solicitors, auditors and insurers, on a strictly need-to-know basis.
- Successors in title: if our business is reorganised, sold or transferred, your data may be transferred to the relevant acquirer or successor entity.
8. International Transfers
Some of our service providers are located outside the United Kingdom. Where this is the case, we ensure appropriate safeguards are in place, including:
- UK adequacy decisions where they exist;
- The UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum;
- Where applicable, supplementary technical and organisational measures such as encryption in transit and at rest.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting or reporting requirements. Indicative retention periods are:
- AML records: a minimum of five years after the end of the business relationship (statutory requirement).
- Transaction records: a minimum of six years for tax and accounting purposes.
- Enquiry data where no transaction completes: up to twenty-four months from last contact.
- Marketing data: until you withdraw consent or for a maximum of three years from your last interaction with us.
- CCTV and security footage (in-person visits): up to thirty days, unless retained for ongoing investigation.
After applicable retention periods expire, data is securely deleted, anonymised or destroyed.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful access, accidental loss, alteration or disclosure, including encryption in transit (TLS), encryption at rest, access controls, audit logs and secure storage. However, no transmission over the internet or method of electronic storage is one hundred per cent secure, and we cannot guarantee absolute security.
11. Your Rights
Under the UK GDPR you have the following rights, subject to certain conditions:
- Right of access: to obtain a copy of the personal data we hold about you.
- Right to rectification: to have inaccurate or incomplete data corrected.
- Right to erasure ("right to be forgotten"): to request deletion of your data, except where we are legally required to retain it.
- Right to restrict processing: to limit how we use your data.
- Right to data portability: to receive your data in a structured, commonly-used, machine-readable format.
- Right to object: to processing based on legitimate interests, or to direct marketing.
- Right to withdraw consent at any time, where processing is based on consent.
- Right not to be subject to automated decision-making that produces legal or similarly significant effects. We do not currently use such decision-making.
To exercise any of these rights, contact us at info@goldcharters.com. We will respond within one calendar month. We may require proof of identity before processing certain requests.
12. Complaints
If you believe we have processed your personal data unlawfully, we encourage you to contact us first so we can address the issue. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or by telephone on 0303 123 1113.
13. Children
Our services are intended for adults aged eighteen (18) years or over. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately so we can take appropriate action.
14. Third-Party Links
Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before sharing personal data.
15. Changes To This Policy
We may update this Policy from time to time. The "Last updated" date at the top of this page reflects when the current version came into effect. Material changes will be notified to you by email where you have provided one, or by prominent notice on the Site.
16. Contact
Questions, requests or complaints should be addressed to:
Charters Gold
Avalon House, Unit 7A, Egham Business Village, Crabtree Road, Egham, Surrey, TW20 8RB
Email: info@goldcharters.com
Telephone: 07951999999