Privacy Policy

Introduction

Device Services is a trading name of Spotbuyer Ltd, part of the Spotbuyer Group ("we", "us", "our"). We respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, ask us for a quote or use our services.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Spotbuyer Ltd is the controller of the personal information described in this policy.

1. Who we are and how to contact us

Spotbuyer Ltd, Bay 2, Block D (next to Toolstation), Mill Race Lane, Stourbridge Industrial Estate, Stourbridge, West Midlands DY8 1JN.

Spotbuyer Ltd is registered in England and Wales under company number 06661097.

Email: simon@spotbuyer.co.uk
Telephone: 01384 396197

If you have any questions about this policy or how we handle your information, please contact us using the details above.

2. Information we collect

We may collect the following information:

• Enquiry information: your name, email address, company name and details of the devices you would like us to handle, when you complete our quote form or contact us.

• Business contact information: names, job titles, email addresses, telephone numbers and site addresses of the people we deal with at your organisation, so we can arrange collections and provide our services.

• Service records: device details such as make, model, serial number or IMEI, grading results, erasure certificates and collection and payment records.

• Website information: technical information such as your IP address, browser type and the pages you visit, collected automatically when you use our website.

3. How we use your information

We use your information to:

• respond to your enquiries and prepare quotes

• arrange collections and provide our data erasure, testing, grading, buy-back and recycling services

• issue erasure, recycling and WEEE certificates and reports

• process payments and keep business and accounting records

• keep our website secure and understand how it is used

• meet our legal and regulatory obligations

We rely on the following lawful bases: performing a contract with you or taking steps at your request before entering into one; our legitimate interests in running and improving our business and responding to business enquiries; and compliance with our legal obligations, for example tax, accounting and environmental record-keeping.

4. Data held on devices you send us

Our purpose is to make sure data on your devices is securely and permanently removed. We do not access, copy, use or keep data stored on the devices we collect. Devices are erased using certified data erasure methods, or physically destroyed where erasure is not possible, and we can provide a certificate for each device.

Where we handle devices that may contain personal data on your behalf, we act as a processor for that data and only process it to erase or destroy it in line with your instructions and our written agreement with you. Our processes are certified to ISO 27001.

5. Who we share information with

We do not sell or rent your personal information. We only share it where necessary with:

• couriers and logistics partners who collect and deliver devices

• IT, website hosting, email and form providers who help us run our business

• our professional advisers, such as accountants and insurers

• other companies in the Spotbuyer Group, where needed to provide our services

• regulators, law enforcement or other authorities where we are required to by law

Devices we resell are always erased first, so buyers of refurbished devices do not receive any of your data.

6. International transfers

Some of our service providers, such as our website host, may store or process information outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or approved contractual clauses.

7. How long we keep information

We keep personal information only for as long as we need it. Enquiries that do not lead to work are normally deleted within two years. Customer, service and financial records are kept for six years after the end of the relevant financial year, or longer where the law requires. Erasure and recycling certificates are kept for as long as agreed with you or required for compliance.

8. How we protect your information

We use appropriate technical and organisational measures to protect personal information, including access controls, secure facilities with CCTV and controlled access, and processes certified to ISO 27001.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you

• ask us to correct inaccurate information

• ask us to delete your information

• ask us to restrict or object to how we use your information

• ask us to transfer your information to another organisation

To make a request, contact us using the details above. We will respond within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

10. Cookies

Our website uses cookies and similar technologies that are needed for it to work, and may use analytics to help us understand how visitors use the site. You can control cookies through your browser settings.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page.

Last updated: 26 October 2026