Updated 17 May 2019
Depop’s approach to privacy
The Depop app (“App”) and website (“Site”) are run by Depop Limited a company established in England (company number 08316342) with its registered offices at 9th Floor, 107 Cheapside, London, United Kingdom, EC2V 6DN (“Depop”, "we", "our, or "us"). We are committed to protecting and respecting your privacy.
Sometimes Depop films or takes photos in public spaces to promote its Service and this Privacy Notice will apply to you if you appear in any such film footage or photographs.
This privacy notice sets out how Depop collects, uses and shares information that identifies you or is associated with you (“personal information”).
We have appointed a Data Protection Officer who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights please contact our Data Protection Officer using the details set out below:
Title: Aphaia Ltd
Email address: firstname.lastname@example.org
Postal address: Eagle House 163 City Road, London, EC1V 1NR
Personal information we collect about you and how we use it
When we film or take photos in a public place, we may capture your image (unless we have a separate contract in place with you, in which case your contract shall govern the circumstances under which we may process your personal information). We may use this personal information by posting such footage and/or images on any of Depop’s social media channels and/or using such footage and/or images in paid for advertising and/or publicity, on the basis that it is in our legitimate interests to promote the Service. We will only use such personal data where we believe it does not impact on your fundamental rights and freedoms.
Information we share with third parties
We may share your personal information with the following parties:
- Companies in the same group of companies as us – our subsidiaries (i.e. any organisation we own or control) or our ultimate holding company (i.e. any organisation that owns or controls us) and any subsidiaries it owns. These companies will only use your personal information in the same way as we can under this Privacy Notice.
- Law enforcement, regulators and other parties for legal reasons – third parties who we are under a legal obligation to disclose your personal information to or who we need to disclose your personal information to protect our rights, property or safety or the rights, property or safety of others, detect and investigate illegal activities.
- Buyers of our business – buyers of Depop Limited or any of its assets may have your personal information disclosed or transferred to them as part of the sale.
Storing and transferring your personal information
Timeframe: We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
For details of retention periods for other aspects of your personal information please contact us at email@example.com.
Transfers outside of the UK: the personal information we collect may be transferred to and stored in countries outside of the EEA including to our affiliates and our third party Service moderators. It may also be processed by staff (who work for us or for one of our suppliers) operating outside the EEA. Some of these jurisdictions offer differing levels of protection in respect of personal information and may, in certain instances, be less protective than the UK. However the transfer of your data to other countries in line with this Privacy Notice, shall only be to countries in respect of which an adequacy decision has been issued by the European Commission, or where the entity is bound an appropriate confidentiality and data transfer agreement as deemed adequate by the European Commission (details of which we are happy to share with you on request as per the ‘Contacting Us’ section below). Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal information shared between Europe and the US. We will take all reasonable steps to ensure that your personal information is treated securely and in accordance with this Privacy Notice. By submitting your personal information, you agree to this transfer, storing or processing.
Right to access your information: You are entitled to see the information held about you and to check that we are lawfully processing it, and we shall comply with our obligations under applicable data protection legislation in relation to any request by you. We may charge you a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive. We try to respond to all legitimate requests within one month (once we have been able to verify your identity). Occasionally it may take us longer than this if your request is particularly complex or you have made a number of requests.
Right to request correction of your information: You may ask us to make any necessary changes to ensure that the data we hold about you is accurate and kept up to date. Please keep us informed if your personal information changes during your relationship with us.
Right to request erasure of your information: In certain circumstances you may also ask us to erase personal information relating to you. We may not always be able to comply with your request for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Right to object to processing: You may object to use processing your personal information where we are relying on a legitimate interest where you believe it impacts on your fundamental rights and freedoms. We will consider any such objection, however in some cases we may demonstrate that our legitimate grounds override your rights and freedoms.
Right to restriction of processing: You may ask us to suspend the processing of your personal information in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Right to request the transfer of your information: You have the right to request a transfer of certain of your personal information to you or a third party of your choice, which we will provide in a structured, commonly used, machine-readable format.
Right to withdraw consent: Where we are relying on your consent to process your personal information you may withdraw this consent at any time
To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details set out in the "Contacting us" section below. We may need to request specific information from you when you exercise your rights to confirm your identity and to speed up our response. We may not be able to fulfil your request if we are not able to identify you.
Our policy towards children
We do not film or take photos of children under the age of 18 (unless we have separate consent from a legal guardian) and we do not knowingly collect personal information from children under 18. If you become aware that your child has provided us with personal information without your consent, then please contact us using the details below so that we can take steps to remove such information.
Changes to this policy
We may amend this Privacy Notice from time to time in order that it accurately reflects the regulatory environment and our own data collection and disclosure practices. When we change this Privacy Notice in a material way, we will update the “last modified” date at the top of this Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page.
Questions, comments and requests regarding this Privacy Notice are welcome and should be addressed to firstname.lastname@example.org or to our Data Protection Officer (whose contact details are stated at the beginning of this Privacy Notice).
In the event that you have a complaint about our treatment of your personal information, you have the right to lodge a complaint with the supervisory body, the Information Commissioner - https://ico.org.uk/. Details of how do to this are set out in the ‘for the public’ section. However Depop welcomes the opportunity to resolve any complaint and we would suggest you first refer your complaint to our Data Protection Officer (whose contact details are stated at the beginning of this Privacy Notice), prior to making a complaint to the Information Commissioner.