Privacy policy

1. Who controls your data

Collinghamco, trading as BuyABuild, is the data controller for the information described here. We are a UK business and we handle personal data in line with UK data protection law.

2. What we collect

• Account details: your name, email address and password (stored hashed).
• Application answers: who you are, what you do, why the niche interests you, and your supply chain or operating experience.
• Data room activity: which listings you were granted, when you opened them, how often, the name you signed the access terms with, and when that access expired.
• Purchase records: the business bought, amount, currency, and the Stripe identifiers for the payment. Card numbers never reach us.
• Technical data: IP address, browser and session information used for security and to detect scraping or credential sharing.

3. Why we use it

• To verify buyers and decide whether to grant data room access, which protects the businesses and their sellers.
• To provide access to the data room and to keep a record of who signed the access terms.
• To take payment, complete a sale, and hand over assets.
• To keep accounting and tax records, and to prevent fraud, cloning and misuse of confidential material.
• To answer your questions and tell you about a listing you applied for.

4. Our lawful bases

We rely on performance of a contract for verification, access and handover; on legitimate interests for protecting confidential business information, preventing fraud and securing the site; on legal obligation for financial records; and on consent where we send you optional updates, which you can withdraw at any time.

5. Who we share it with

• Stripe, which processes card payments as an independent controller for its own regulated purposes.
• Our hosting and database provider, which stores the app and its records on our instructions.
• Our email and cloud storage providers, used to run the accounts and assets we transfer.
• Professional advisers, insurers or a buyer of our own business, where necessary and under confidentiality.
• Law enforcement or a regulator, where the law requires it.

6. How long we keep it

Applications that are declined or go no further are kept for 24 months. Data room access and signature records are kept for 24 months after access expires. Sale and payment records are kept for six years to meet tax and accounting rules. Account records are kept while your account is open.

7. Cookies

We use only the cookies and local storage needed to keep you signed in, protect forms against abuse and remember a listing you have already viewed in this session. We do not use advertising cookies or third-party trackers.

8. Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, or ask us to transfer it. Some records must be kept for tax or to evidence a signed access agreement, and we will tell you if that applies.

To exercise a right, contact us from your buyer dashboard. If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk.

9. Security

Confidential listing assets are held in private storage and served only through short-lived signed links to verified buyers who have signed the access terms. Access is logged so we can trace any leak.

10. Changes

If we change this policy we will update the date at the top of this page. Material changes affecting an application already under way will be told to you directly.