Privacy policy

Last updated: 26 September 2026

This policy explains what personal data marketcity.co.uk ("marketcity", "we", "us") collects, why we collect it, how we keep it safe and the choices you have. We have written it in plain English. If anything is unclear, email us at [email protected].

1. The short version

• We collect only the data we need to run a marketplace: your account details, what you list, buy, sell and send, and basic technical data that keeps the site secure.
• We never sell your personal data and we never share it with advertisers or data brokers.
• We show no third party advertising and we use no tracking or advertising cookies.
• If you sign in with Google or Facebook we receive only your name, email address and profile picture. We never post to your accounts.
• You can download a copy of your data or permanently delete your account and data yourself, at any time, from Account, then Data and privacy.

2. Who we are

marketcity.co.uk is operated under the marketcity name (referred to in this policy as "marketcity", "we", "us" and "our"). We are responsible for the personal data described in this policy and we follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. We are an online venue: members buy and sell with each other, and we are not a party to those dealings.

Privacy contact: [email protected], or open a support ticket.

3. What we collect

• Account details: your name, email address, password (stored only as a salted one way hash that cannot be reversed), date of birth (to confirm you are 18 or over), phone number and town or postcode area.
• Sign in with Google or Facebook: if you choose this, Google or Meta sends us your name, email address and profile picture link. See section 5.
• Listings and activity: the goods, property, vehicles, jobs and services you list, your photos and descriptions, bids, offers, questions, messages, feedback, watchlist, saved searches, forum posts and support tickets.
• Orders: delivery address, delivery method, order history and payment status. Payments are made directly between buyer and seller (bank transfer, PayPal or cash). We never see or store card numbers.
• Job seekers: if you apply for a job through the site, the CV, cover letter and answers you upload are stored and sent to the employer you apply to.
• Business accounts: trading name, company number, VAT number and any licence or membership details you choose to show on your listings.
• Technical data: IP address, approximate country, browser type, the pages you request and security logs such as sign in attempts. If you allow notifications, we store the push subscription your browser gives us.

We do not collect special category data (such as health, religion or political views) and we ask you not to put it in listings or messages.

4. Why we use it and our lawful basis

Purpose	Lawful basis (UK GDPR Article 6)
Running your account and the marketplace: showing your listings, passing bids, offers, messages and orders between buyers and sellers, sending account and order emails and notifications you have asked for.	Performance of a contract (our terms of use)
Keeping the site safe: preventing fraud, spam and abuse, rate limits, moderation, enforcing our terms and protecting other members.	Our legitimate interests, and yours, in a safe marketplace
Meeting our legal duties: tax and accounting records, responding to lawful requests from authorities, and our duties under the Online Safety Act 2023.	Legal obligation
Optional emails such as saved search alerts, forum replies and store news.	Consent, which you can withdraw at any time in Account, then Notifications
Improving the site using aggregated statistics that do not identify you.	Legitimate interests

We do not make decisions about you by automated means that have a legal or similarly significant effect. We do not use your data for profiling or targeted advertising.

5. Who can see your data

• Other members see what you publish: your listings, public profile name, feedback and the town you list from. When a deal is made, the buyer and seller receive the details needed to complete it, such as name, delivery address and contact details. Employers receive the applications you send them.
• Service providers who process data only on our instructions and under written contracts: Contabo GmbH (server hosting in the United Kingdom), Cloudflare, Inc. (network security, content delivery and email forwarding) and Brevo (Sendinblue SAS, sending our emails). Google LLC and Meta Platforms Ireland Limited are involved only if you choose to sign in with them.
• Authorities where the law requires it, for example a court order or a lawful request from the police or a regulator.
• A buyer of our business if marketcity is ever sold or merged. We would tell you first, and this policy would continue to apply.

We never sell, rent or trade your personal data. We do not share it with advertising networks, data brokers or social media companies for their own purposes.

6. Sign in with Google or Facebook

You can create an account or sign in with your Google or Facebook account instead of a password. When you do:

• Google or Meta confirms who you are and sends us your name, email address and profile picture link. Facebook also sends the identifier of your Facebook account. That is all we ask for.
• We use this only to create your marketcity account and sign you in. The email address becomes your account email and the name fills in your profile, which you can change.
• We never post to your Google or Facebook account, never read your contacts, friends, photos or messages, and never use the data for advertising.
• Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
• You can disconnect marketcity at any time in your Google account permissions or in Facebook under Settings, then Apps and websites. Disconnecting stops future sign ins with that provider. To delete your marketcity account and data as well, see section 9.

7. Cookies

We use only cookies that are strictly necessary for the site to work, so no consent banner choices are needed. We use no advertising, analytics or tracking cookies.

Cookie	Purpose	Lasts
mnz_s	Keeps you signed in and remembers your session	Until you sign out or close the browser
remember_token	Keeps you signed in when you tick "Remember me"	Up to 30 days
.AspNetCore.Mvc.CookieTempData	Shows one time messages such as "Listing saved"	Until the message is shown
gdpr_ack	Remembers that you have seen the cookie notice	1 year

Cloudflare may set a security cookie (such as __cf_bm) to tell people from bots. Your browser may also keep recent searches on your own device.

8. How we keep your data safe

• All traffic between your browser and marketcity is encrypted (HTTPS), and Cloudflare filters attacks before they reach our servers.
• Passwords are stored only as salted bcrypt hashes. We cannot read them and we never email them.
• Sign in attempts are rate limited and logged, and unusual activity is reviewed.
• Access to personal data is limited to the people who need it to run the service, and our servers and databases are protected by firewalls and access controls.
• If a breach ever put your rights at risk we would tell you and the Information Commissioner's Office without undue delay, as the law requires.

9. How long we keep it

Data	Kept for
Account and profile	While your account is open, then deleted when you delete your account or within 90 days of closing it
Listings and photos	While the listing is live, then archived in your account until you delete it or your account
Order records	6 years after the order, as required by tax and accounting law, then deleted
Messages and feedback	While either party keeps an account. When you delete your account they stay visible to the other member without your name or contact details
Job applications	Until you withdraw them or delete your account
Security and sign in logs	Up to 12 months
Support tickets	2 years after the ticket is closed

10. Your rights and how to use them

Under the UK GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Portability: receive that copy in a structured, machine readable format.
• Rectification: correct data that is wrong or incomplete.
• Erasure: have your data deleted ("the right to be forgotten").
• Restriction: ask us to pause using your data while a question is sorted out.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time where consent is the basis, for example optional emails.
• Complain to the Information Commissioner's Office (see below).

You can use the most important rights yourself, at once, without asking us:

• Download my data: sign in, open Account, then Data and privacy, and click Download my data. You receive a JSON file with your profile, addresses, listings, orders, offers, bids, messages you sent, feedback, saved searches, job profile and more.
• Correct my data: edit your profile, addresses and listings at any time in your account.
• Delete all my data: in Account, then Data and privacy, click Delete my account and data. Your profile, contact details, addresses, listings and photos, saved searches, watchlist, job profile, CV, devices and sign in history are deleted straight away. See how to delete your data for details and for what we keep by law.

For anything else, or if you cannot sign in, email [email protected] from the email address on your account, or open a support ticket. We may ask you to confirm your identity. We reply within one month, and there is no charge.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would be grateful for the chance to resolve the matter first.

11. International transfers

marketcity.co.uk is hosted on servers in the United Kingdom. Our support team is based in New Zealand, which the UK Government has found to provide an adequate level of data protection, so no further safeguards are needed for that access. Where a service provider processes data outside the UK we rely on UK adequacy regulations or the International Data Transfer Agreement approved by the Information Commissioner.

12. Information from other sources and the checks we run

• Country and network checks: every request to the site carries the visitor's approximate country. When you sign up or sign in we look up your IP address with a network intelligence service to see whether it belongs to a VPN, proxy, Tor exit or hosting company, and we compare it with published block lists. Sign-ups from outside the United Kingdom are held for review by an admin, and addresses that belong to anonymising services are refused. These checks protect members from fraud and are done automatically; you can ask us to review any decision.
• Sign-in providers: if you use Google or Facebook we receive your name, email address and profile picture link from them, as described above.
• Public records: for business accounts we may check publicly available registers to confirm a company or licence exists.
• Other members: reports, feedback and messages from other members about you are kept with your account so we can act on them.

13. Marketing and notifications

We send account and transaction emails that are needed to run the service, such as activation, messages, offers, orders and security notices. Optional emails (saved search alerts, forum replies, store news) are sent only if you turn them on, and you can turn each one off in Account, then Notifications, or with the link in the email. Browser notifications are sent only if you allow them on your device and can be switched off there at any time. We do not send marketing on behalf of third parties, and we never sell or rent your details to anyone.

14. Other members and your safety

When you list, bid, buy or message, the other member sees the details needed for the deal, such as your public name, the town you list from and, once you agree a deal, your contact details or delivery address. Those members are responsible for how they use that information; our terms require them to use it only for the deal. Never share bank passwords, one time codes or copies of identity documents with another member, and report anyone who asks for them.

15. Links to other websites

Listings, messages and our pages may contain links to other websites and services. We do not control them and this policy does not cover them. Check their own privacy policies before sharing personal information with them.

16. Your account security

You are responsible for keeping your password secret and your devices secure, and for everything done through your account until you tell us it has been compromised. Use a password you do not use anywhere else. If you think someone else has used your account, change your password and contact us straight away.

17. If something goes wrong

We keep records of security events and review them. If a personal data breach ever puts your rights at risk we will tell you and the Information Commissioner's Office without undue delay, explain what happened and what we are doing about it. To report a security problem, email [email protected].

18. Children

marketcity is for adults. You must be 18 or over to open an account. We do not knowingly collect data from anyone under 18, and we delete any such account when we become aware of it.

19. Changes to this policy

If we make an important change we will tell you by email or with a notice on the site before it takes effect. The date at the top shows when this policy was last updated.

20. Contact

Email: [email protected]
Support: marketcity.co.uk/support