YOUR DATA RIGHTS
Your information. Your choices.
This guide explains the rights available over personal information held by WE BUY BACK LTD and the practical steps for using them.
Last reviewed 1 September 2026
1. Your data rights
UK data protection law gives you rights over personal information that identifies or relates to you. The right that applies depends on why the information is used and the circumstances of your request.
1.1 The law behind these rights
We handle personal information under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. These laws work together with other duties that may require particular records to be retained.
1.2 How to make a request
You can use the dedicated form at the end of this page, write to us or make a request verbally. You do not need to quote legislation or use a particular phrase. Tell us what you want us to do and enough detail to help identify the relevant information.
The form is one available route, but it is not the only valid way to exercise a data protection right.
2. Right to be informed
You have the right to clear information about how and why your personal information is used.
2.1 Where we explain our use
Our Privacy Policy explains the categories of information we handle, the purposes and lawful bases, who may receive it, international transfers, retention, security and contact routes. Our Cookie Policy explains the website storage currently in use and how to review cookie preferences.
2.2 When something changes
A material change to the use of personal information requires the relevant notice to be updated and may require additional information under UK data protection law. Whether a separate direct notice is required depends on the change, the relationship and the law; this guide does not promise one in every case.
3. Right of access
You can ask whether we process your personal information and request a copy, together with information about how it is used. This is commonly called a subject access request.
3.1 What an access request can cover
Depending on your dealings with us, relevant records may include contact details, order and payment-destination records, parcel events, communications, inspection notes, photographs, diagnostic results, product identifiers, complaint records and website or security information linked to you.
3.2 Helping us locate the information
An order number, the email address used, an approximate date and the type of record can help us conduct a reasonable and proportionate search. A broad request is still valid, but clarification may help us respond more accurately.
3.3 Information involving other people
When responding to a request, the rights of other people and any lawful exemption must also be considered. This can mean redacting third-party information or providing an explanation instead of a particular item; sensitivity alone does not automatically exclude an entire category.
4. Right to rectification
You can ask us to correct inaccurate personal information or complete information that is materially incomplete.
4.1 Facts and professional findings
Names, contact details and order facts can be corrected when they are wrong. A disputed inspection opinion or diagnostic finding is not automatically inaccurate personal information. You can use the form below to ask for a disagreement to be recorded and for any correction or supplementary statement required by law. The form emails the request to the support team and creates a reference; review and any correction or added statement are separate staff work that was not independently verified.
4.2 Information shared with others
UK data protection law can require a correction to be communicated to another recipient where required and reasonably possible. The applicable response depends on the request and disclosure involved.
5. Right to erasure
You can ask us to delete eligible personal information. This right is sometimes called the right to be forgotten, but it is not absolute.
5.1 When deletion may apply
Deletion may be appropriate where information is no longer needed, consent has been withdrawn and no other lawful basis applies, a valid objection succeeds, or information was processed unlawfully.
5.2 Records we may need to retain
Our first accounting period ends on 30 September 2026. Core transaction and accounting records for that period are retained for six years after its end, through 30 September 2032, and become due for deletion from 1 October 2032 unless a legal hold requires longer.
Order and inspection records are held in Aevum and connected operational services rather than in a local website database. A later final order closure, complaint or legal hold can affect the applicable retention period. Retention and deletion for inspection photographs, video, diagnostics, CheckMEND results and notes must be applied in the system that holds each record.
Payment instructions submitted at checkout are handled by Aevum as part of the order and are not retained in a separate local website database. The applicable operational, accounting and payment-provider retention rules continue to apply to copies held by those systems.
This website does not keep a separate local customer or order database. Customer, order and payment information submitted during checkout is sent to Aevum, while form enquiries are delivered to the support mailbox. Removal from Aevum, communications providers, backups and operational records must be carried out in the system that holds each copy.
Companies House confirms our first accounting period; GOV.UK explains the six-year record rule. Fraud and legal-claim records may also need to remain. Our Privacy Policy explains the periods and exceptions.
6. Right to restrict processing
In some circumstances you can ask us to store personal information while limiting how it is otherwise used.
6.1 When restriction may apply
This can apply while accuracy is checked, while an objection is considered, where processing was unlawful but you prefer restriction to deletion, or where you need information for a legal claim after we no longer need it for the original purpose.
6.2 During and after restriction
Restricted information may still be stored and used in limited circumstances allowed by law. UK data protection law can require notice before a restriction is lifted.
7. Right to data portability
Where this right applies, you can receive certain information in a structured, commonly used and machine-readable format, or ask us to transfer it directly where technically feasible and secure.
7.1 Information covered
Portability normally covers information you provided, or information observed through your use of a service, when processing is automated and based on consent or a contract. Internally derived findings may fall outside portability even though they may be available through the right of access.
8. Right to object
You can object to certain uses of personal information based on your particular situation.
8.1 Direct marketing
You can object to direct marketing at any time. The marketing opt-out route sends that request to our support team. Newsletter signup and opt-out requests submitted through this website are emailed to the support team rather than kept in a local marketing or suppression database. The team applies each request in the responsible marketing system. We must stop using the address for direct marketing once an objection is received, while retaining only what is necessary in that system to respect the choice.
A wider erasure request is different. The form below emails the request to the support team and creates a reference; submitting it does not automatically delete order, accounting or dispute records. Any later staff review was not independently verified.
8.2 Legitimate interests
An objection to a use based on legitimate interests must be assessed against your circumstances. Processing must stop unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the use is needed for legal claims.
9. Automated decisions
You have protections where a solely automated decision produces legal or similarly significant effects.
9.1 Preliminary quotes and inspection
The website calculates a preliminary quote from product, specification and condition selections. That quote is not the final inspection outcome. The form below can record a request to challenge an automated decision and creates a reference, but the form does not itself perform the later human review.
9.2 Asking for human review
If you believe a significant decision about you was made solely by automated means, use the form below to record what happened and request human intervention where the right applies.
10. Device data and records
Personal content stored on a phone, tablet, laptop or smart watch is different from the customer and transaction records held in our business systems.
10.1 Information on a product
Before sending a product, back up anything you need, sign out, remove account locks and erase it where possible. Follow our How to Prepare Your Device guidance. Operational staff handling after receipt has not been independently verified for this guide, so preparation by the customer remains important.
10.2 When erasure is not possible
A passcode, activation lock, technical fault or safety problem can prevent normal access or erasure. We do not bypass security controls merely to reach personal content. You can use the form below to ask what return, reuse or recycling route may be available for the product. The form emails the question to the support team and creates a reference; any decision or later action is separate staff work that was not independently verified.
10.3 Business-system records
Erasing a product does not automatically delete the order, inspection or accounting records connected to it. Those records are handled under the Privacy Policy and can be addressed through the rights that apply.
Do not send passwords, account recovery codes, identity documents or payment cards inside a parcel.
11. How requests are handled
11.1 Recognising and recording a request
The dedicated web form emails the date, substance and chosen right to the support team and creates a reference. Later staff handling is separate. A verbal or other written request remains valid, although it does not use the form's automatic reference. Focused questions may be needed to understand the right being used and locate the relevant information.
11.2 Identity and authority
Proportionate evidence may be requested where there are reasonable doubts about identity or authority to act for someone else. The request should not exceed what is reasonably needed. The form warns against attaching identity documents and does not accept file uploads.
11.3 Response time
UK data protection law normally requires a response without undue delay and within one month. For a subject access request, the response period can pause while necessary clarification is awaited. A complex request, or several requests from the same person, can allow up to two additional months, with notice required within the first month.
11.4 Fees and refusals
Requests are normally free. UK data protection law can permit a reasonable fee or refusal where a request is manifestly unfounded or excessive, assessed case by case, with an explanation and information about the right to complain to the Information Commissioner’s Office.
12. Complaints and contact
12.1 Raise a concern with us
Select “Make a data protection complaint” in the form below and tell us what happened. The form emails the complaint to the support team and creates a reference. For a complaint received on or after 19 June 2026, section 164A of the Data Protection Act 2018 requires the controller to acknowledge receipt within 30 days of receiving it; without undue delay, take appropriate steps to respond, make appropriate enquiries and keep the complainant informed; and tell the complainant the outcome without undue delay. The ICO explains these duties; their legal basis and commencement appear in section 103 of the Data (Use and Access) Act 2025 and SI 2026/82.
The form does not itself acknowledge, investigate, send progress updates or issue an outcome. Those later steps require staff action, and the statutory duties above still apply.
12.2 Contact the regulator
You can complain to the Information Commissioner’s Office. Its current complaint process asks for a copy of the complaint made to the organisation, while section 165 of the Data Protection Act 2018 preserves the statutory right to complain to the Commissioner.
12.3 Company details
WE BUY BACK LTD is registered in England and Wales under company number 16713774. Its registered office is 11 The Crofts, Rotherham, England, S60 2DJ. The current director is Zohab Khan.
Companies House registration alone is not a postage instruction. Follow only the postage route and address attached to your order. The registered office is not presented as a public walk-in or general drop-off point.
12.4 Changes to this guide
This guide should be updated when the service, processing or law changes. Its current review date is shown at the beginning and the current version remains available through the Legal Hub.