1. Who we are

Scotland's Markets ("we", "our", "us") operates the Scotland's Markets website at scotlands-markets.com, a platform that connects independent traders with market organisers across Scotland. We are the data controller for the personal information described in this policy.

Awaiting confirmation by Scotland's Markets: the full legal name of the business or person who operates Scotland's Markets, the registered address, and whether an ICO registration (data protection fee) is held and its reference.

Awaiting confirmation by Scotland's Markets: that directing privacy enquiries through the contact form is acceptable while no dedicated privacy mailbox exists, or the address to publish here once a verified one has been set up.

Privacy enquiries: use our contact form and we will reply by email.

2. The information we hold

• Account information — your name and email address, supplied when you sign in, your account role (trader or organiser) and your password, which is handled and stored in hashed form by the platform. We never see your password.
• Trader profile — business name, business type, description of products, logo, product photos, website and social media links, trading history, the town/region you choose to show, and the regions you are willing to travel to.
• Organiser profile — organisation name, contact email and phone, description of your markets and your public social media links.
• Contact details — your business email and business phone. Your full business address is held privately by default and is never published.
• Documents you upload — for example public liability insurance or a food hygiene certificate, where a market requires them. These are stored privately.
• Booking information — the market, date, pitch, application details, status, notes and any alternative pitch offered.
• Messages — messages sent between traders and organisers, including broadcast announcements to traders at a market.
• Payment records — the amount, method (bank transfer, PayPal or card), date, reference, status and any receipt you upload. Card payments are handled by Stripe; we do not receive or store card numbers or security codes.
• Notifications and email records — notifications shown in your account and a log of emails sent through the platform (recipient, subject and type).
• Technical and security information — what the hosting platform records to keep the service working and secure, such as request time and IP address.

3. Information that is public, and information that is private

Public information (shown on market and public trader listings, and intended to be visible to anyone including search engines): business name, business type, description of products, logo and product photos, public website and social media links, the town/region you have chosen to show, the regions you travel to, and whether you are an active verified trader.

Kept private: your account email address, your phone numbers, your full business address, your uploaded documents, your booking history, your messages, your payment records and any internal notes. Your contact email address is shared with a market organiser only when you apply to that organiser's market, so they can respond to you — it is never published publicly.

You can change whether your town/region is shown publicly, or hide it completely, in your profile settings. Nothing becomes public by default: a new trader account does not publish contact details, and location is shown only as town/region unless you choose otherwise.

4. Why we use it and our lawful basis

• Providing your account, profiles, bookings and messages — necessary to perform our contract with you (UK GDPR Article 6(1)(b)).
• Operating and securing the platform — preventing misuse, fraud, duplicate or fake accounts and unauthorised access — our legitimate interests in running a safe service (Article 6(1)(f)).
• Keeping financial and booking records, and responding to lawful requests — compliance with our legal obligations (Article 6(1)(c)).
• Optional analytics — your consent (Article 6(1)(a)), which you give (or withhold) through the cookie choices and can change at any time.
• News and offers by email — your consent (Article 6(1)(a)) where you have opted in, or the soft opt-in permitted for existing customers, with an unsubscribe option in every message.
• Publishing optional contact details or extra profile information — your consent, given by choosing to publish them.

Awaiting confirmation by Scotland's Markets: that these are the bases you wish to rely on, and (for the legitimate interests above) that you hold a Legitimate Interests Assessment. Service messages about your bookings, account security and password resets are sent as part of the service and never depend on marketing consent.

5. Who we share it with

• Market organisers — when you apply for a pitch we share your application, business name, description, contact email and phone, and the documents you uploaded for that market, so the organiser can assess and confirm your booking.
• Traders — where an organiser contacts traders about a market, those messages are visible only to the sender, the recipient(s) and administrators.
• Base44 — the platform provider that hosts the website, stores the database and delivers platform email.
• Stripe — card payment processing for pitch and booking payments.

Awaiting confirmation by Scotland's Markets: your full list of processors and their data processing agreements, including whether Google fonts, mapping providers or any email provider process personal data on your behalf. The decorative background image is loaded from Unsplash and maps from OpenStreetMap, both of which receive the visitor's IP address.

We do not sell personal information, and we do not use it for advertising.

6. How long we keep it

We keep personal information only for as long as it is needed. The retention schedule below is what is currently implemented or intended; periods marked as awaiting confirmation still require a decision from us.

• Active accounts — kept while your account is open.
• Deleted accounts — personal profile and contact details are removed when an account is deleted; we keep only the minimum needed for the purposes below.
• Bookings and cancelled bookings — kept as the record of what was agreed between trader and organiser. Period awaiting confirmation.
• Payment and accounting records — kept to meet accounting and tax requirements. Period awaiting confirmation.
• Messages — kept while the related booking or account is live. Period awaiting confirmation.
• Uploaded documents (insurance, certificates) — kept while the trader's account is active and relevant to a market's requirements. Period awaiting confirmation.
• Email logs and security/audit logs — kept for service and security purposes. Period awaiting confirmation.
• Marketing consent records — kept as evidence that consent was given, for as long as we rely on it.

Awaiting confirmation by Scotland's Markets: the actual retention periods for bookings, payments, messages, documents, email logs and security logs. Once you confirm them, automatic deletion or anonymisation can be scheduled.

7. Your rights

Under data protection law you have the right to:

• ask for a copy of the personal information we hold about you (access);
• have inaccurate information corrected (rectification);
• ask us to delete information that we no longer need (erasure);
• ask us to restrict or object to processing, including objecting to any processing based on our legitimate interests;
• receive information you gave us in a portable format (data portability);
• withdraw consent at any time where processing is based on consent — for example optional analytics, or publishing optional profile details. Withdrawal does not affect processing already carried out.

To use any of these rights, send us a message through our contact form and we will respond within one month. We will never delete information we must keep for a legal or accounting obligation — where that applies we will explain what we are keeping and why.

8. Account deletion

You can delete your account yourself at any time, without giving a reason: sign in, open your Trader Profile or Organiser Profile, and use the Account & data card to delete your account. If you cannot sign in, you can ask us to delete it through our contact form; the steps for both routes are set out on our Delete your account page.

When an account is deleted we remove your personal profile information, contact details and the links to your uploaded documents, and remove you from public listings. Records that must be kept for accounting, tax or legal reasons, or that are needed to evidence a booking or dispute, are retained for their required period only, with your personal details replaced by an anonymous marker. If you organise markets, your markets stay live for your traders and other traders' bookings are unaffected; tell us when you request deletion if you would rather your market listings were removed as well.

9. Cookies and site storage

The website does not use advertising cookies. It uses strictly necessary browser storage to keep you signed in and to remember your choices, and optional analytics only if you allow it. Details of every technology used, what it does and how to change your choice are in our Cookie Policy.

10. Transfers outside the UK

Our platform and payment providers operate internationally, so personal information may be processed outside the United Kingdom. Where that happens, the provider is required to put appropriate safeguards in place for the transfer.

Awaiting confirmation by Scotland's Markets: confirmation of the countries in which Base44 and Stripe process data, and the specific safeguards relied on (for example the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), so this section can state them precisely.

11. Security

Access to personal information is restricted by role: traders see their own records, organisers see the information needed for the markets they run, and administrator functions are limited to authorised administrator accounts. Uploaded documents are held in private storage and are opened only through short-lived access links issued after an access check. We do not store card numbers or security codes.

12. How to complain

If you are unhappy with how we have handled your information, please contact us first through our contact form so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk, telephone 0303 123 1113.

13. Limitation of liability

Scotland's Markets acts solely as a platform connecting traders and market organisers. We are not responsible for any issues, disputes, cancellations, refunds, or other matters that may arise in relation to market bookings, pitch availability, payments, or any interactions between traders and organisers.

Any issues, concerns, or disputes regarding bookings, market operations, refunds, or cancellations must be resolved directly between the trader and the market organiser. Users acknowledge that Scotland's Markets is a facilitating platform only and bears no liability for the conduct, agreements, or transactions between platform users.

14. Changes to this policy

We will update this policy when what we do changes. The date below shows when it was last reviewed.