Privacy policy

IsleList is operated by Manx Digital.

The data controller for IsleList is IsleList by Manx Digital, Central Promenade, Douglas, Isle of Man, IM2 4JL.

For privacy requests, access requests, or data protection questions, email support@islelist.com.

We will use that address for privacy-related correspondence unless the law requires a different route.

IsleList is committed to protecting your privacy and personal data in accordance with UK data protection laws.

This policy explains how we collect, use, store, and protect your personal information when you use our platform.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and for Isle of Man users, the Data Protection Act 2002 and related Manx legislation.

The data controller responsible for your personal data is IsleList by Manx Digital. You can contact us about data protection matters at support@islelist.com.

This policy should be read alongside our Terms of Use and Cookie Policy.

We process your personal data on the following legal bases under UK GDPR:

Contract performance: Processing necessary to provide our services and fulfill our contract with you (account management, listings, offers).

Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, provided these do not override your rights.

Legal obligation: Processing necessary to comply with legal obligations, such as tax and financial record-keeping requirements.

Consent: Where we have obtained your explicit consent for specific processing activities, such as marketing communications (you may withdraw consent at any time).

Account data: Email address, password (hashed), and basic account settings collected during signup.

Seller profile data: Title, name, date of birth, address, island, and nearest town collected when completing seller readiness for listing creation.

Listing data: Item descriptions, photos, pricing, category, location, and status information for all listings you create.

Communication data: Offer threads, messages, support requests, and moderation reports to facilitate transactions and platform safety.

Usage data: Login times, page views, search queries, and feature usage to improve the platform and provide analytics.

Payment data: Billing information processed through Stripe for Pro and Business+ subscriptions. Buy Now and accepted-offer online payments are sent through PayPal to the seller's registered IsleList email. We do not store full payment card details.

To provide core platform services including account management, listing creation, offer negotiation, and feedback systems.

To verify accounts, prevent fraud, enforce policies, and maintain trust and safety across the marketplace.

To provide customer support, respond to inquiries, and resolve disputes or moderation issues.

To process recurring Pro and Business+ subscriptions through Stripe, and to direct Buy Now and accepted-offer buyers to PayPal using the seller's registered IsleList email.

To send transactional emails about your account, offers, listings, and important platform updates.

To generate aggregated analytics for sellers showing listing performance without exposing individual viewer identities.

Public information: Your display name, bio, avatar, island location, active listings, and feedback summary are publicly visible.

With other users: Offer threads and negotiation messages are shared between buyers and sellers involved in transactions.

With service providers: We share data with trusted service providers like Stripe (payments), ManxMedia and legacy Cloudinary (media hosting), and hosting infrastructure.

For legal compliance: We may disclose information when required by law, court order, or to protect our rights and safety.

We do not sell your personal information to third parties or use it for advertising purposes outside the platform.

We use industry-standard security measures to protect your data including encryption, secure connections (HTTPS), and hashed passwords.

Access to personal data is restricted to authorized personnel who need it to operate and maintain the platform.

While we take reasonable precautions, no system is completely secure. You are responsible for maintaining the security of your account credentials.

Report any suspected security breaches or unauthorized access to your account immediately through our support channels.

Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:

Right of access: You can request a copy of the personal data we hold about you (commonly known as a "subject access request").

Right to rectification: You can request that we correct inaccurate or incomplete personal data.

Right to erasure: You can request deletion of your personal data in certain circumstances, though we may need to retain some data for legal compliance.

Right to restrict processing: You can request that we limit how we use your personal data in certain circumstances.

Right to data portability: You can request a copy of your personal data in a structured, machine-readable format to transfer to another service.

Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.

Rights related to automated decision-making: You have rights regarding automated decisions that significantly affect you (though we do not currently use such systems).

To exercise any of these rights, please email support@islelist.com. We will respond within one month, or two months for complex requests.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or the Isle of Man Information Commissioner if you believe we have not handled your data properly.

We will only send you marketing communications if you have opted in to receive them or where we have a legitimate interest and you have not opted out.

You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or updating your preferences in your account settings.

Even if you opt out of marketing, we will still send you transactional communications about your account, offers, listings, and important platform updates.

We do not sell your personal data to third parties for their marketing purposes.

We use cookies and similar technologies to maintain your session, remember preferences, and analyze platform usage.

Essential cookies are required for the platform to function properly, including authentication and security features.

Analytics cookies help us understand how users interact with the platform to improve features and performance.

You can control cookie settings through your browser, but disabling certain cookies may limit platform functionality.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations.

Account data: Retained while your account is active and for up to 2 years after account closure for fraud prevention and legal compliance.

Listing data: Active listings retained indefinitely; deleted listings archived for up to 1 year for moderation and dispute resolution.

Offer and message data: Retained for up to 3 years after the last message for dispute resolution and platform safety.

Billing records: Retained for 7 years as required by UK tax law (HMRC requirements) and Isle of Man financial regulations.

Moderation records: Retained for up to 5 years to maintain platform safety and enforce policies consistently.

Support requests: Retained for up to 3 years for quality assurance and legal compliance.

When personal data is no longer needed, we will securely delete or anonymize it in accordance with our data retention schedule.

IsleList is not intended for users under 18 years of age.

We do not knowingly collect personal information from children under 18.

If we become aware that a user is under 18, we will terminate their account and delete their information.

Parents or guardians who believe their child has created an account should contact us immediately.

IsleList is operated primarily within the UK and Isle of Man. Your personal data is stored and processed within the UK.

Some of our service providers (such as Stripe for payments, ManxMedia, and legacy Cloudinary for media hosting) may process data outside the UK.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

Standard contractual clauses approved by the UK authorities; Adequacy decisions recognizing that the destination country provides adequate data protection; or Other lawful transfer mechanisms under UK GDPR.

You can request information about the safeguards we use for international transfers by emailing support@islelist.com.

We may update this privacy policy from time to time to reflect changes in our practices, services, or legal requirements.

We will notify you of significant changes by email (where we have your email address) or by posting a notice on the platform at least 30 days before the changes take effect.

Where required by law, we will obtain your consent before making changes that materially affect how we use your personal data.

Continued use of IsleList after policy updates constitutes acceptance of the revised policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have questions about this privacy policy or how we handle your personal data, email support@islelist.com or write to IsleList by Manx Digital, Central Promenade, Douglas, Isle of Man, IM2 4JL.

If you are not satisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the relevant supervisory authority:

For UK users: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Website: ico.org.uk. Helpline: 0303 123 1113.

For Isle of Man users: Isle of Man Information Commissioner, PO Box 69, Douglas, Isle of Man IM99 1EQ. Website: inforights.im. Telephone: +44 1624 693260.

We take data protection seriously and will work with you and the relevant authorities to resolve any concerns.