Privacy Policy

The controller of personal data processed in Banknotio is B NOTIO LTD, Office 41 Drewitt House, 865 Ringwood Rd, Bournemouth BH11 8LW, United Kingdom, company number 17403642 (Companies House), e-mail: hello@banknotio.com.

When you buy a banknote on the marketplace, the details you give in the order are also received by the seller you buy from, who from then on is a separate controller of that data, responsible for fulfilling the order. The seller's details are in the terms of sale with the listing and in the order confirmation. Likewise, when you sell, the buyer receives your seller details.

Account: name, e-mail address, password (stored only as an encrypted hash), language, chosen plan, date of your last visit to the panel. Used to run your account and contact you about it.

Collection: the banknotes you add, their descriptions, numbers, condition, purchase prices, notes and photos. Your collection is private and only you can see it. Only the banknotes you list on the marketplace become public, with their price, description and photos.

Recognising banknotes from photos: when you use this feature, the photo of the banknote is sent to Google's Gemini API, which returns a suggested identification. Your name and e-mail address are not sent. We use the paid version of the service, under which Google does not use the data sent to improve its models.

Seller details: when you list banknotes on the marketplace, you provide your name or company name, address, an e-mail address for buyers, bank account number, optionally a SWIFT code and tax ID, and whether you sell as a business. Your name and status are shown with your listings, and the buyer receives the full details with the order, so they can pay and know who they are contracting with.

Orders: the buyer's name, delivery address, e-mail, phone number (optional) and notes, and the seller's details at the time of the order. We pass them to the other party and keep them in the service so both parties can see the order and, in a dispute, its history can be established.

Messages to sellers: the name, e-mail address and question sent through the form on a listing. They go to the seller, who replies.

Technical data: your IP address is used in real time to protect forms against spam and is not stored with your account. The server keeps technical request logs for security and diagnostics.

Running your account, collection, listings, orders and banknote recognition: performance of a contract, namely these terms of service (Art. 6(1)(b) GDPR).

Keeping orders after completion, backups, security and prevention of abuse: our legitimate interest (Art. 6(1)(f) GDPR).

Complying with legal obligations, for example requests from competent authorities: Art. 6(1)(c) GDPR.

We use outside providers who process data only on our instructions: 20i (the server the service runs on, in the United Kingdom), Backblaze (encrypted backups stored in the European Union, in the Netherlands), Google (recognising banknotes from photos, Gemini API) and Resend (sending e-mails such as order confirmations).

Order details are received by the other party to the transaction (buyer or seller) and, for shipping, by the carrier the seller chooses.

On a justified request from law enforcement or a court we may disclose data to them, including the details of a seller reported for fraud.

We do not sell your data, do not use it for advertising and do not share it for any other purpose.

The controller and the server are in the United Kingdom, for which the European Commission has adopted an adequacy decision.

Google and Resend are based in the United States. Data is transferred to them under the mechanisms provided for in the GDPR, such as the European Commission's EU-US Data Privacy Framework decision or standard contractual clauses.

Account and collection data is kept until you delete your account, which you can do yourself in the settings.

When you delete your account, your collection and photos are deleted at once. They remain in backups for a while: up to 7 days on the server and up to 90 days in encrypted cloud backups, and then disappear with them.

Orders are kept after an account is deleted, to the extent needed to settle them and defend against claims, and no longer than the limitation period for those claims. The rest of the account data is deleted.

Messages to sellers are kept until the seller deletes them or deletes their account.

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on our legitimate interest. You can export your collection yourself at any time in your account settings.

For data protection matters, write to hello@banknotio.com. You also have the right to complain to a supervisory authority: in Poland the President of the Personal Data Protection Office (PUODO), in the United Kingdom the Information Commissioner's Office (ICO).

We use only technical cookies the service needs to work: the session cookie that keeps you signed in, cookies that secure sign-in, and a cookie that remembers your dark mode choice. Your basket is remembered in your browser's storage.

We do not use analytics or advertising cookies. If we ever wanted to add them, we would ask for your consent first.

If we change how we process data, we will update this policy and the date at the top of the page, and tell users about significant changes by e-mail.