Privacy Policy

Last updated: 22/08/2026, 12:38PM

This Privacy Policy describes how We collect, use and share Your personal information when You use STAX, and tells You about Your privacy rights and how the law protects You.

1 - Who We are

STAX is operated by Hector Bridgeman, a sole trader, of Aedel House, 12 Murray Place, St Andrews, KY16 9AP ("We", "Us", "Our", "the Operator").

We are the data controller for the personal data described in this policy. That means We decide why and how it is processed, and We are responsible to You for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

STAX is not the University of St Andrews. We are independent of the University, its Students' Association, and any hall, society or club. The University is not responsible for Your data on the Service.

2 - Contact Us

If You have any question about this Privacy Policy, or want to exercise any of the rights in section 8, contact Us by email at nontechnicaltotechnical@yahoo.com.

3 - What We collect and how We use it

3.1 - Information You give Us

When You create an Account:

Your email address — which, if You want to buy or sell, must end @st-andrews.ac.uk
Your first and last name, and the display name shown to other users
Your password (stored only in hashed form by Our platform provider; We never see it)
Optionally, a profile picture and a short profile description
Optionally, Your year of study

When You list an Item: the title, description, price, photographs and details of the Item, and — for a Ticket — which Event it is for and what type of ticket it is.

When You message another user: the content of those messages.

When You buy or sell: a record of the Order, its price, its status, and who the other party was.

When You set an alert for an Event: a record that You asked to be told when a Ticket is listed for that Event.

If We offer, and You choose to use, sign-in with Google or Facebook, We may receive personal data already associated with that account, such as Your name and email address.

3.2 - Information We do not collect

Some of these are worth stating plainly, because people reasonably assume otherwise:

We never ask for, see, or store Your hall of residence or Your home address. By design, the Service does not have a field for it and never displays one.
We never see or store Your card number. Card details are entered directly with Our payments provider, Stripe.
If You sell, We never see or store Your bank details or Your identity documents. Stripe collects those directly from You, holds them, and uses them to verify You and pay You. They do not pass through Us. See section 5.

3.3 - What other people can see

Your profile and Your listings are public. Anyone visiting STAX can see them, whether or not they are signed in, and whether or not they are a St Andrews student. Search engines may index them.

Publicly visible: Your display name, Your profile picture and description, Your year of study if You gave one, whether You are marked Verified St Andrews, the number of completed sales You have made, and Your current listings.

Not visible to other users: Your email address, Your messages with other people, Your Order history, and anything held by Stripe.

"Verified St Andrews" means only that You confirmed an @st-andrews.ac.uk email address at some point. We record this as a marker on Your account that only Our server can write, so that it cannot be faked by anyone, including You.

3.4 - Information We collect automatically

When You use the Service, We and Our providers automatically collect usage information: Your IP address, browser type and version, the pages You visit, the time and date of Your visit, and similar diagnostic data. This comes from ordinary web server logs.

3.5 - Why We use it, and Our lawful basis

Create and run Your account — so You can use the Service. Performance of a contract.
Show Your profile and listings to other people — that is what the Service is. Performance of a contract.
Confirm Your email address is a St Andrews one, and mark You Verified — only St Andrews members may buy or sell, and buyers need to know who they are dealing with. Performance of a contract; legitimate interests (trust and safety).
Process Your payment and pay sellers — to complete Orders. Performance of a contract.
Send You service emails — email confirmation, Order updates, and the ticket alerts You asked for. Performance of a contract.
Resolve disputes between users — to run the marketplace fairly. Legitimate interests.
Remove spam, fraudulent or unlawful listings, and suspend accounts — trust and safety. Legitimate interests (protecting users).
Keep records of transactions — for tax, accounting, and defending legal claims. Legal obligation; legitimate interests.
Fix faults and keep the Service secure — to keep it working. Legitimate interests.

We do not use Your personal data for advertising, profiling or remarketing, and We do not sell it to anyone.

Where We rely on legitimate interests, You have the right to object — see section 8.

4 - Cookies, analytics and tracking

We use no analytics service, no advertising network, and no remarketing or tracking pixels.

The Service uses cookies and similar browser storage only where they are necessary for it to work: keeping You signed in, remembering Your session, and storing small preferences in Your browser. These are strictly necessary cookies and are not used to track You across other websites.

If this changes — if We add an analytics tool, for example — We will update this policy and, where the law requires it, ask for Your consent first.

5 - Who We share it with

We use a small number of service providers, who process personal data on Our instructions. We do not share Your personal data with anyone else except as set out below.

Sharetribe provides the marketplace platform We build on. It holds Your account, profile, listings, messages and transaction records.
Stripe processes all payments and pays sellers. It holds card details; and for sellers, bank details, date of birth, address and identity documents.
Render hosts the STAX website. It holds server logs, including IP addresses.
Our email delivery provider sends the Service's emails on Our behalf. It holds Your email address and the content of those emails.

Stripe is a separate data controller for the information You give it. When You add payout details, You are dealing with Stripe directly under Stripe's own privacy policy, and We receive back only whether Your account is verified and able to receive money.

With other users: as described in section 3.3, and the messages You choose to send them.

We may also disclose personal data where We are required to do so by law, in response to a valid request by a public authority, or where it is necessary to investigate or prevent fraud, to protect the rights, property or safety of Our users or the public, or to establish, exercise or defend legal claims. Where a Ticket appears to be counterfeit or unlawfully resold, We may report it to the police and to the Event organiser.

If We are ever involved in a sale or transfer of the business, personal data may be transferred as part of it. We will give You notice before that happens.

6 - International transfers

Some of Our providers process data outside the United Kingdom, including in the United States and the European Economic Area.

Where personal data leaves the UK, We rely on the transfer mechanisms permitted under UK data protection law — an adequacy decision where one applies, or the UK International Data Transfer Agreement or Addendum together with appropriate safeguards. You may ask Us for details of the safeguards that apply.

7 - How long We keep it

We keep Your personal data only as long as We need it.

Account and profile data: while Your account is open, and for a short period afterwards so that We can deal with anything outstanding.
Messages and listings: while Your account is open. Listings You delete are removed from the Service.
Transaction records: for at least six years after the transaction, because We need them for tax and accounting and to defend legal claims. This is why closing Your account does not erase Your Order history.
Server logs: a short period, for security and fault-finding.

When We no longer need personal data and no legal obligation requires Us to keep it, We delete it.

8 - Your rights

Under UK GDPR You have the right to:

Be told what personal data We hold about You, and get a copy of it.
Have it corrected if it is wrong or incomplete. You can change most of it yourself in Your account settings.
Have it erased, where there is no good reason for Us to keep processing it. Note that We may need to keep transaction records — see section 7.
Object to processing where We rely on legitimate interests, including any direct marketing.
Restrict processing in certain circumstances.
Data portability — receive the data You gave Us in a structured, commonly used, machine-readable format.
Withdraw consent at any time, where We relied on Your consent.

To exercise any of these, email Us at nontechnicaltotechnical@yahoo.com. We may ask You to confirm Your identity first. We will respond within one month.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would rather You came to Us first so We can try to put it right, but You do not have to.

9 - Security

We take reasonable technical and organisational measures to protect Your personal data. The Service runs over HTTPS, passwords are stored hashed by Our platform provider, and payment and identity data is handled by Stripe rather than by Us.

No method of transmission over the internet or method of electronic storage is completely secure, and We cannot guarantee absolute security.

10 - Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If You believe a person under 18 has given Us personal data, contact Us at nontechnicaltotechnical@yahoo.com and We will delete it.

11 - Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date at the top. Where a change is material We will make reasonable efforts to tell You before it takes effect.

You are advised to review this page periodically for any changes.