Privacy policy

GPUsed Privacy Policy

Updated August 2026

Who controls your information

GPUSED LTD is the controller of personal information described in this policy. GPUSED LTD is registered in England and Wales under company number 14566719. Its registered office is Cheston Lodge, 40 Humber Road, North Ferriby, Hull, East Riding of Yorkshire, HU14 3DW. Contact privacy enquiries at max@gpused.co.uk.

Information GPUsed collects

Depending on how you use GPUsed, information can include your name, contact details, delivery and billing details, order and payment references, enquiry content, quote and seller details, item descriptions, serial numbers, ownership or disposal-authority evidence, marketing preferences, review or complaint information, website and device data, and records needed to prevent fraud or meet legal obligations.

Do not send full payment-card details, account passwords or identity documents unless GPUsed has specifically requested the minimum information needed through an agreed secure route.

Information is collected directly from you, from the Shopify shop and connected payment, delivery, communications or advertising services, and from devices and browsers interacting with the website. Where a business or authorised seller provides information about another person, it must have authority to do so.

If you choose to use the GPUsed AI assistant, the conversation and technical request data can be processed by GPUsed's AI and hosting providers to return and secure the response. Do not put payment details, passwords, identity documents or other unnecessary sensitive information into the assistant. The assistant does not make a solely automated decision that determines whether GPUsed accepts an order, seller quote, refund, warranty claim or payment.

Why GPUsed uses information

GPUsed uses personal information to:

  • answer enquiries and provide requested product or compatibility information;

  • prepare and administer sale, part-exchange and bulk quotes;

  • verify identity, ownership, condition, provenance and transaction security where appropriate;

  • process orders, payments, delivery, collection, returns, warranty requests and complaints;

  • keep accounting, tax, fraud-prevention and other required business records;

  • operate, secure, measure and improve the website and services;

  • send marketing only where the recipient has validly opted in or another lawful basis permits it; and

  • establish, exercise or defend legal claims.

The lawful basis depends on the purpose. It may be taking steps at your request or performing a contract, complying with a legal obligation, GPUsed's legitimate interests in running and protecting the business, or consent where consent is required.

GPUsed does not rely on marketing consent to answer an enquiry. The contact form explains that ordinary enquiry records are normally retained for up to 24 months after the enquiry closes. Submitting a form does not subscribe the person to a newsletter. GPUsed may send service messages and automated follow-up related to the enquiry. Any separate direct marketing requires a valid lawful basis, and recipients can opt out of marketing at any time.

Sharing information

GPUsed shares information only where needed with providers supporting the service, such as Shopify, payment providers, email and communications services, AI and hosting providers, delivery or collection providers, professional advisers, analytics, advertising and security providers, and public authorities where legally required. Each recipient should receive only the information needed for its role.

GPUsed does not sell a customer list as a standalone product. Where optional advertising is enabled with consent, pseudonymous identifiers and website or purchase events can be shared with advertising partners such as Meta or Google for measurement and relevant advertising. Some non-UK privacy laws can call certain advertising disclosures a "sale" or "sharing" even where no customer list is sold. The cookie controls and current privacy notice must accurately describe and control this use.

Shopify and Network Intelligence

The website, checkout and related services are hosted by Shopify. Information submitted through the shop is processed by Shopify and relevant service providers so that the store, payments, delivery, security and other requested services can operate.

When Shopify Network Intelligence is enabled, Shopify can use information from interactions with GPUsed, other Shopify merchants and Shopify to provide enhanced services such as fraud protection, personalisation, performance and advertising measurement. Shopify is responsible for its own processing for these enhanced services. Customer consent and data-sharing choices are respected through Shopify's privacy controls where they apply. More information is available in the Shopify Consumer Privacy Policy, and relevant choices can be managed through the Shopify Privacy Portal.

International transfers

Some providers may store or process information outside the UK. Where GPUsed initiates a restricted transfer, it uses an applicable UK adequacy regulation, an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer route. GPUsed also considers the protection provided after the transfer where required.

Security

GPUsed uses proportionate technical and organisational measures to protect personal information. No internet transmission or storage system can be guaranteed completely secure. Do not send payment details, passwords, identity documents or other unnecessary sensitive information through an ordinary enquiry or the AI assistant. GPUsed will identify an agreed secure route if specific evidence is needed.

Retention

GPUsed keeps information only as long as reasonably needed for the purpose, legal obligations and claims:

  • ordinary enquiries: normally up to 24 months after the enquiry closes;

  • quote, seller, order, return, warranty and complaint records: normally up to six years after the relevant transaction or closure;

  • accounting and tax records: for the period required by law;

  • fraud, ownership and security evidence: only for the proportionate period needed to protect GPUsed and affected people;

  • marketing details and consent records: until withdrawal or the record is no longer needed, with suppression information retained where necessary to respect an opt-out; and

  • website security logs: for a limited period appropriate to security and investigation needs.

GPUsed may keep information longer where law, an active dispute, fraud prevention or a regulator requires it.

Your rights

Depending on the circumstances, UK data-protection law can give you rights to access, correct, erase or restrict information, object to certain uses, receive portable information, and withdraw consent. Rights can have legal exceptions. Contact max@gpused.co.uk to make a request. GPUsed may need to verify identity proportionately.

You can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or by using the contact details published there, although GPUsed would appreciate the opportunity to address the concern first.

Data-bearing devices

Sellers are responsible for backing up and securely erasing personal or confidential information from PCs, phones, storage devices and other data-bearing hardware before handover. Removing files or performing a basic reset may not securely erase data. Contact GPUsed before sending a data-bearing device if the proposed process is unclear.

Changes

GPUsed may update this policy when services, providers or legal requirements change. The visible update date identifies the current version.