What we do with what you tell us

Wristly (“we”, “us”) is a dealer in new, pre-owned and vintage watches based at Hilltop, Llanelli, SA14 8DB, United Kingdom. We are the data controller for the personal information described in this policy.

Questions about this policy or about your information should go to info@wristly.co.uk or 07973 665324.

We only collect information that is needed to answer you, complete a transaction, or meet a legal obligation.

When you enquire

• Your name, email address and, if you give it, your telephone number.
• The content of your message, including any photographs or details of a watch you send us.
• Which enquiry type you selected and, where relevant, which watch you enquired about, including any details you give about a watch you want valued, exchanged, consigned, serviced or found.
• We email a short confirmation to the address you give. It does not repeat your message, so that a form filled in with someone else’s address reveals nothing to them.

If you sign up for our newsletter

• Your email address, the date you signed up, the date you confirmed, and the exact wording you agreed to. Nothing is sent to the address until its owner confirms by following the link we email (“double opt-in”).
• Every newsletter email has an unsubscribe link. After you unsubscribe we keep only your address and the date, so that we never email you again by mistake. Sign-ups that are never confirmed are deleted after 30 days.

When you buy from us

• Your name, delivery and billing addresses, email and telephone number, so the watch can be invoiced, insured and delivered.
• Online payments are processed by Stripe. We receive the payment’s status, amount and a reference, never your card number.
• The order itself: what you bought, the price, any discount code, delivery choice and the order’s progress, plus any return or refund.
• The details of the watch sold to you, which form part of its service and ownership history.

If you open an account

• Your name, email address, and optionally your phone number and saved addresses.
• Your password, which is stored only as a one-way encrypted hash by our authentication provider.
• Your order history, the pieces you save to your wishlist, and any review you write (shown publicly as your first name and initial once approved).
• Whether you have asked to hear about new stock. Order and account emails are sent regardless, because they are part of the service.

When you sell to us, part exchange or consign

• Your name, address and contact details.
• A copy of photographic identification and proof of address. We are required to verify the identity of anyone selling us goods, and to keep a record of purchases, to guard against the handling of stolen property.
• Bank details for payment, held only for as long as needed to make the transfer.
• Details of the watch, including serial numbers, provenance and any paperwork.

When you visit the website

• Standard server logs - IP address, browser type, pages requested and timestamps - which our hosting provider records for security and to keep the site running.
• Strictly necessary cookies only: one keeps you signed in, one remembers your bag, and short-lived ones let you return to an order you have just placed or opened from an emailed link. They are not used for tracking and need no consent.
• This site does not use advertising cookies or third-party tracking. If we introduce privacy- respecting analytics in future, this policy will be updated and you will be told what is collected.
• For emails we send about an order, our email provider tells us whether each one was delivered, bounced or reported as spam, so we can stop emailing an address that does not work.

We use personal information to:

• reply to enquiries and provide valuations;
• arrange viewings, complete sales and purchases, and deliver or collect watches;
• issue invoices, guarantees and service records, and keep the accounting records the law requires;
• verify identity when we buy a watch, as described above;
• arrange insurance for watches in our care or in transit;
• let you know about a watch we have found for you, if you asked us to source one; and
• protect the business and our customers against fraud.

We do not sell personal information, and we do not send marketing emails unless you have asked to hear about new stock or confirmed a newsletter subscription. Every such email has an unsubscribe link, and replying to ask us to stop works too.

Under UK GDPR we rely on the following bases:

• Contract - processing needed to respond to an enquiry you have made, or to complete a sale, purchase, consignment or service you have asked for.
• Legal obligation - keeping records of purchases and seller identification, and financial records for HMRC.
• Legitimate interests - keeping the website secure, preventing fraud, maintaining the ownership history of watches we have sold, and telling a customer who asked us to source a watch that we have found one.
• Consent - for the newsletter and any optional stock updates, which you can withdraw at any time.

We share personal information only where it is necessary to do what you have asked us to do:

• Couriers and insurers - your name, address and contact number, so a watch can be delivered, collected and insured in transit.
• Watchmakers - where a watch of yours goes for service, the job sheet carries your name and the watch details, nothing more.
• Our accountants and bank - transaction records, as required for accounting and payment.
• Service providers who process data on our behalf, under data-processing agreements: Supabase (our database, customer accounts and file storage), Stripe (card and other online payments), Resend (sending order and account emails) and Vercel (website hosting).
• The police or other authorities - where we are required to by law, or where a watch is reported stolen.

Some of these providers store or process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum in our agreement with them.

• Enquiries that do not lead to a transaction - deleted after twelve months, unless you have asked us to keep looking for a watch.
• Sales and purchase records - kept for seven years after the transaction, to meet accounting requirements and to honour guarantees.
• Seller identification - kept for as long as the purchase record, as required for stolen-goods enquiries.
• Accounts - kept while the account is open. If you ask us to delete it, we remove your profile, addresses, wishlist and saved bag and anonymise your reviews; order records are kept for the seven-year period above and then stripped of contact details.
• Bags that never become orders - removed automatically after sixty days.
• Bank details supplied for a payment - deleted once the payment has been made and reconciled.
• Watch histories - the service and ownership history of a watch we have sold is kept with the watch’s record, with personal details minimised to what the next owner legitimately needs (dates and work done, not names).

Records are held on password-protected, encrypted devices and accounts, with access limited to the people who need it. Identification documents are stored separately from day-to-day correspondence. Paper records, where they exist, are kept in the same safe as the watches.

If we ever became aware of a breach affecting your information we would tell you, and the Information Commissioner’s Office where required, without undue delay.

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that is inaccurate;
• ask us to delete information we no longer need to keep;
• object to, or ask us to restrict, processing based on legitimate interests;
• withdraw consent to optional communications at any time; and
• complain to the Information Commissioner’s Office at ico.org.uk if you think we have handled your information badly.

If you have an account you can download a copy of your data at any time from your profile page. To exercise any of these rights, email info@wristly.co.uk. We will respond within one month. We may need to confirm your identity first, for obvious reasons.

We will update this page if how we handle information changes. The date at the top shows when it was last revised. Significant changes will be flagged to customers with a live enquiry or transaction.