privacy policy

01Who we are and how to contact us

Unify Ltd (“Unify”, “we”, “us”, or “our”) is a company incorporated under the laws of England and Wales. We operate the Unify marketplace platform, a student-exclusive digital and campus-based marketplace available via our website and mobile applications (collectively, the “Platform”).

• Registered address: Unify Ltd, 46 Marlborough Place, London NW8 0PL, United Kingdom.
• Privacy contact: hello@unifymarketplace.com
• Data controller: Unify Ltd is the data controller for all personal data processed in connection with the Platform.

A Data Protection Officer will be appointed as the business scales, and this Policy will be updated to reflect that appointment. For users located in the United States, Unify Ltd is the responsible entity for data processed in connection with your use of the Platform, subject to the additional US state-specific disclosures set out in Section 13.

02Scope of this policy

This Privacy Policy applies to all personal data collected, processed, or stored by Unify in connection with:

• Registration and use of the Unify Platform (website and mobile applications);
• All Student User accounts and associated activity;
• Partner Vendor accounts and onboarding;
• Use of the AI-assisted listing tool;
• Transactions processed through the Platform;
• Marketing and communications sent by Unify; and
• Any other interaction with Unify’s services, whether online or at a physical Exchange Point.

This Policy does not govern the privacy practices of Partner Vendors, who are independent data controllers in respect of personal data they separately collect from Student Users. We encourage you to review the relevant Vendor’s own privacy policy where applicable.

03Personal data we collect

3.1 Account and identity data. Full name; university institutional email address (used for eligibility verification and login); university or campus affiliation (derived from your institutional email domain); encrypted password (we never store your plaintext password); date of account creation; and account settings and preferences.

3.2 Transaction data. Records of items listed, purchased or exchanged; transaction amounts and timestamps; Exchange Point deposit and collection records; dispute submissions and resolution records; and commission and settlement records (for Partner Vendors).

3.3 Listing and AI tool data. When you create a listing, including via the AI-assisted listing tool, we collect item descriptions, titles and categories; images you upload; AI-generated description drafts; and your edits and final approved listing content.

How your AI listing data is used. Images and text you upload to the AI listing tool are processed on Unify’s own servers to generate listing descriptions. This content is retained for the duration the listing is active and for up to 12 months thereafter for platform integrity and dispute resolution. Your uploaded content is not used to train, fine-tune, or otherwise improve any AI or machine learning model. It is processed solely to generate your listing output.

3.4 Platform usage and analytics data. Pages and features accessed and navigation sequences; listing views, clicks, search queries and time on listings; session duration and frequency; device, operating system and browser type; IP address (used for security and fraud prevention only); and referral source. We do not collect or process device GPS or precise location data at any point. Your campus affiliation is determined solely by your institutional email at registration.

3.5 Communications data. In-platform messages; dispute submissions and supporting evidence; support and enquiry correspondence; and marketing preferences and opt-in records.

3.6 Partner Vendor data. Business registration details and legal entity information; authorised signatory name and contact details; bank account details for settlement (stored securely and used solely for payment purposes); VAT or tax identification numbers; and settlement statements and financial transaction records.

3.7 Data we do not collect. For the avoidance of doubt, we do not collect: payment card numbers, CVV codes, or full bank account details from Student Users (these are handled exclusively by Stripe and never stored on Unify’s servers); device GPS or precise location data; biometric data; or special category data under UK GDPR Article 9, unless voluntarily provided in a support context, in which case it is treated with the highest level of protection.

04How we use your personal data

The table below sets out the primary purposes for which we use personal data, the legal basis under UK GDPR, and the applicable retention period.

Where we rely on ‘legitimate interests’, we have assessed that our interests do not override your fundamental rights and freedoms. You may request a copy of our legitimate interests assessment by contacting hello@unifymarketplace.com.

05Legal bases for processing

• Contract performance (Art. 6(1)(b)): processing necessary to deliver platform services, process transactions, manage listings and operate Exchange Point logistics.
• Legal obligation (Art. 6(1)(c)): processing required to comply with applicable law, including financial record-keeping, tax reporting and lawful requests from regulators.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, platform security and analytics, where proportionate and not overriding your rights.
• Consent (Art. 6(1)(a)): used exclusively for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

06How we share your personal data

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. Data is shared only in the following circumstances:

• Other platform users: when you transact, limited information necessary to complete the transaction is shared (for example, a username and Exchange Point collection reference). Your full name, institutional email and financial details are never shared with other users.
• Partner Vendors: when you purchase from a Vendor, they receive only the minimum information necessary to fulfil the transaction, and are contractually prohibited from using it for any other purpose.
• Payment processor (Stripe): payments are processed by Stripe in their secure environment. Unify does not receive, store or process your card number, CVV or full bank details. See stripe.com/privacy.
• Technology and service providers: cloud hosting, analytics, email delivery and support tooling, acting as data processors under binding agreements that meet UK GDPR requirements.
• Legal and regulatory disclosure: where required by law, or to protect the safety of users or the public, or to detect and prevent fraud.
• University authorities: in cases of serious breach, credible safety threats, or conduct violating both our Terms and a university code of conduct, where there is a clear legal basis or overriding legitimate interest.
• Business transfer: in a merger, acquisition or sale of assets, subject to equivalent data protection obligations.

07International data transfers

Unify operates in both the United Kingdom and the United States, and data may be transferred between them. Where we transfer personal data from the UK to countries not deemed adequate by the ICO, we rely on safeguards such as UK International Data Transfer Agreements (IDTAs) or equivalent standard contractual clauses, the UK-US Data Bridge (where applicable), or another lawful transfer mechanism. You may request further information by contacting hello@unifymarketplace.com.

08Data security

We implement appropriate technical and organisational measures, including: encryption of data at rest and in transit; encrypted storage of passwords (plaintext is never stored); access controls on a need-to-know basis; regular security reviews and vulnerability assessments; data processing agreements with all processors; and incident response procedures. No method of transmission is 100% secure. In the event of a breach likely to risk your rights and freedoms, we will notify you and the ICO in accordance with UK GDPR Articles 33 and 34.

09Cookies and tracking technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary: required for the Platform to function (session management, login authentication, security tokens). These cannot be disabled.
• Analytics: to understand how users interact with the Platform, collected in pseudonymised or aggregated form. These can be disabled via your account settings or browser controls.
• Preference: to remember your settings (e.g. language or notification preferences). Optional.

The Platform itself does not use advertising or third-party tracking cookies, and we do not permit third-party advertisers to place cookies inside the Platform. Our public website and blog are partly ad-funded and do use advertising and analytics cookies — but only with your consent. Those are covered separately by our Cookie Policy, and you can change your choices at any time via the “cookie settings” link in the footer of every page.

10Marketing communications

We send marketing communications only where you have given prior opt-in consent. You may withdraw consent at any time by clicking ‘Unsubscribe’ in any marketing email, adjusting your notification preferences in the app, or contacting hello@unifymarketplace.com. Please allow up to 5 business days for opt-out requests to take effect. We retain a record of consent and withdrawal for 1 year following withdrawal, and we do not share your contact details with Partner Vendors or third parties for their own marketing.

11Data retention

• Active accounts: retained for the full duration your account is active.
• Closed accounts: transaction, dispute and compliance data retained for 6 years after closure per UK legal requirements; account profile data deleted or anonymised within 90 days of closure, subject to outstanding disputes or legal obligations.
• AI listing tool data: retained for the active listing period and up to 12 months thereafter.
• Analytics data: retained on a rolling 13-month basis, then aggregated and anonymised.
• Marketing records: consent and withdrawal records retained for 1 year following withdrawal.

12Your rights as a data subject

Under UK GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), the right to object (Art. 21), the right to withdraw consent (Art. 7(3)), and the right to lodge a complaint with the ICO. We respond to all valid requests within one calendar month, extendable by two further months for complex requests with prior notice. To exercise any right, email hello@unifymarketplace.comwith the subject line “Data Subject Request” and include verification of your identity.

13Additional rights for US users

Unify is committed to complying with applicable US state privacy legislation across all US campus locations. Users in Virginia (VCDPA), Colorado (CPA), Texas (TDPSA) and other states with comprehensive privacy legislation have rights broadly equivalent to those in Section 12, including access, correction, deletion, portability and opt-out from certain processing. Campus Addenda will be updated to reflect state-specific requirements as our operations expand. No sale of personal data: Unify does not sell personal data, in any jurisdiction. We do not share Platform personal data for cross-context behavioural advertising; advertising cookies on our public website and blog run only with your consent and are described in our Cookie Policy.

14Users under 18

The Platform is designed for individuals aged 18 and over, or those under 18 enrolled at a recognised university or higher education institution. We do not knowingly collect personal data from individuals under 18. If we become aware we have inadvertently collected such data, we will take prompt steps to delete it.

15Automated decision-making and profiling

We use automated systems for limited purposes, including fraud and abuse detection, content moderation filtering and analytics-based personalisation. None produce legally significant decisions without human review. Where an automated flag results in account suspension or listing removal, a member of the Unify team reviews the decision before any permanent action. You have the right to request human review of any automated decision affecting your account.

16Third-party links and external platforms

The Platform may contain links to Partner Vendor websites or other external resources. These third parties operate independently and are not governed by this Policy. We encourage you to review the privacy policy of any third-party site you visit via a link on the Platform.

17Changes to this policy

We may update this Policy from time to time. Where changes are material, we will notify you by email to your registered address and via in-platform notification at least 14 calendar days before the changes take effect. The current version, with its effective date, is always accessible within the Platform and on our website.

18How to contact us

For any questions, concerns or requests relating to this Policy or our data practices, contact us at the details below. We aim to respond to all privacy enquiries within 5 business days.

• Email: hello@unifymarketplace.com
• Post: Data Privacy Team, Unify Ltd, 46 Marlborough Place, London NW8 0PL, United Kingdom
• UK supervisory authority: Information Commissioner’s Office (ICO), ico.org.uk · 0303 123 1113

For urgent matters (data breach notifications, time-sensitive rights requests), please mark your communication: URGENT — DATA PRIVACY.

© 2025 Unify Ltd. All rights reserved. Published in accordance with UK GDPR Articles 13 & 14 and applicable US state privacy legislation.