ReBattery Privacy Policy

1. Who we are

This Privacy Policy explains how ReBattery Ltd processes personal data when you visit rebattery.io, create or use a ReBattery account, contact us, or take part in a marketplace transaction.

ReBattery Ltd is a company registered in England and Wales (company number 15961261) with its registered address at Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. ReBattery Ltd is the controller for the personal data described in this policy unless we tell you otherwise for a particular activity.

For privacy questions or to exercise your rights, email support@rebattery.io. Please do not send passwords, payment card details, or other sensitive information by email.

2. Personal data we collect

The data we collect depends on how you use the service. It may include:

Identity and contact data — name, work email address, telephone number, job title, organisation, role, and profile details.
Business and verification data — company name, registration details, business address, account role, beneficial-owner or director details, permits, licences, insurance and other information needed to approve an account or recycler profile.
Marketplace and transaction data — listings, battery specifications, locations, documents, offers, quotes, purchase or recycling agreements, delivery and collection details, payment status, payout details supplied through a payment provider, and compliance records.
Communications and support data — messages, enquiries, support requests, feedback, and records of our correspondence with you.
Account and security data — authentication records, Google OAuth identity data when you choose Google sign-in, account memberships, terms acceptance evidence, device and browser information, IP address, and security or fraud-prevention signals.
Usage and technical data — pages and features used, approximate location derived from an IP address, diagnostic logs, referral information, and analytics identifiers. See the cookies and analytics section below.

We do not ask for special category data as part of ordinary use. Please avoid including health, biometric, political, religious, or other special category data in listings or messages.

3. How and why we use personal data

We use personal data to:

provide, secure, maintain, and improve the ReBattery platform;
create and administer accounts, verify businesses and recyclers, and manage team memberships;
publish listings and profiles where you or your organisation choose to make them public;
connect marketplace participants and share the business contact information needed to respond to an enquiry or complete a transaction;
generate, issue, store, and administer purchase, recycling-service, recycler-partner, and other transaction paperwork;
process payments and payouts, reconcile transactions, and investigate disputes or suspected fraud;
send service messages, including account, security, deal, payment, compliance, and support updates;
respond to enquiries, provide support, and keep business records;
understand product use, measure site performance, diagnose faults, and improve the user experience;
meet legal, regulatory, tax, accounting, environmental, and law-enforcement obligations; and
establish, exercise, or defend legal claims and protect ReBattery, our users, and the public.

4. Lawful bases

For each use, we rely on one or more lawful bases under UK data-protection law:

Contract — to provide an account or platform feature you request, and to perform or take steps towards a transaction.
Legitimate interests — to run a secure business marketplace, communicate with business contacts, prevent misuse, improve the service, maintain records, and defend our rights. We balance these interests against your rights and expectations.
Legal obligation — where processing is needed for tax, accounting, regulatory, compliance, court, or law-enforcement requirements.
Consent — where we ask for your consent, including for communications or optional technologies where consent is required. You can withdraw consent at any time; this does not affect processing already carried out lawfully.

Where we need information to create an account, verify an organisation, or complete a transaction, not providing it may mean we cannot provide the relevant service.

We share personal data only when needed for the purposes above, with appropriate contractual, technical, and access controls. Recipients may include:

the other businesses involved in a listing, enquiry, purchase, or recycling transaction, limited to information needed for that activity;
team members and account owners you authorise;
service providers that host data and authentication, send email (including Postmark), provide security tooling (including Cloudflare Turnstile), monitor errors (including Sentry), store files, support the application (including our Discord support bridge), or help us operate the platform;
payment and payout providers, including Stripe, when a payment or payout is requested;
Google when you choose Google OAuth, and analytics providers used on the site, including Google Analytics, Microsoft Clarity, and PostHog;
professional advisers, insurers, auditors, courts, regulators, law-enforcement bodies, or other parties where disclosure is required or reasonably necessary to protect rights; and
a buyer, investor, successor, or group company in connection with a proposed or completed business transfer, subject to appropriate confidentiality and data-protection safeguards.

We appoint providers under arrangements appropriate to the service they provide and require them to handle data lawfully and securely. Providers may process data on our behalf in other countries, as described below.

6. Cookies, analytics, and similar technologies

The platform uses essential cookies to keep authentication and account sessions working, preserve security, and remember limited preferences. These are needed for the service and cannot be switched off through the site without affecting functionality.

The public site currently uses Google Analytics to understand visits and page performance, Microsoft Clarity for product and usability diagnostics, and PostHog for bounded product analytics. PostHog session replay is enabled on selected public and signed-in application routes, rather than across every route. These tools may use cookies, local storage, device information, or similar identifiers. We configure product analytics to limit event properties and avoid sending passwords, message text, or other form values.

Browser settings can block or delete cookies, and some providers offer their own opt-out controls. Blocking non-essential technology may reduce functionality. The technologies and controls available to you can depend on the page, browser, and provider involved.

7. International transfers

Some suppliers and services we use may process personal data outside the United Kingdom. When that happens, we will use a transfer arrangement and safeguards permitted by UK data-protection law and take steps appropriate to the risk. Contact us if you want more information about the safeguards for a particular transfer.

8. Retention

We keep personal data only for as long as reasonably needed for the purpose for which it was collected, including account and transaction delivery, security, legal and regulatory duties, tax and accounting records, dispute handling, and the establishment or defence of claims. Different records may therefore be kept for different periods. Signed agreements, payment, tax, audit, dispute, and some recycler or service records may need longer contractual or legal retention, including where a seven-year period applies to a particular record. When data is no longer needed, we delete it, anonymise it, or securely restrict it where a legal hold or other lawful reason requires continued storage.

Deleting an account does not automatically erase records that must be retained for an outstanding transaction, legal obligation, fraud prevention, or dispute.

9. Security

We use measures appropriate to the nature of the data and the risks of processing, including access controls, authentication protections, encryption in transit, provider security controls, logging, and procedures for handling suspected incidents. No online service can guarantee absolute security. Keep your credentials confidential and tell us promptly if you suspect unauthorised access.

10. Your rights

Subject to legal exceptions, you may ask us to:

provide a copy of your personal data;
correct inaccurate or incomplete data;
erase data that we no longer need or have no lawful reason to keep;
restrict processing in appropriate circumstances;
object to processing based on legitimate interests, including direct marketing;
provide certain data in a portable format; and
stop processing based on consent by withdrawing that consent.

You also have rights concerning solely automated decisions where applicable. ReBattery does not promise that every decision is automated or that every request will apply to every record; we will explain the position when responding.

To make a request, contact support@rebattery.io and describe the account or data concerned. We may need to verify your identity and will normally respond within one month, subject to lawful extensions for complex requests. You can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint if you think your data has not been handled lawfully. We would welcome the opportunity to address your concern first.

11. Children

ReBattery is a business-to-business service and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us so we can investigate and take appropriate steps.

12. Changes to this policy

We may update this policy when our service, providers, or legal obligations change. We will publish the current version at rebattery.io/privacy, update the date at the top of the page, and provide additional notice where a change is material or the law requires it.

Last updated: August 2026

13. Contact

For privacy questions, rights requests, or concerns, contact ReBattery Ltd at support@rebattery.io or write to Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.