YBMAPP

PRIVACY & COOKIES POLICY

Last updated: 27 July 2026

1. Introduction

YBMAPP (“YBMAPP”, “we”, “our” or “us”) is operated by YBMAPP LTD, a company registered in England and Wales under company number 12861147, whose registered office is at 20–22 Wenlock Road, London, N1 7GU, United Kingdom.

We operate a UK-focused online marketplace (the “Platform”), accessed through our website at ybmapp.com, which connects customers with Black-owned businesses selling physical products, digital products and services.

This Privacy & Cookies Policy describes how we collect, use, process, store and protect personal data when you access or use the Platform, whether as a customer, a vendor (seller) or a visitor.

For the purposes of the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations 2003 (PECR) (together, the “Data Protection Legislation”), the data controller is YBMAPP LTD.

By accessing or using the Platform, you acknowledge that you have read and understood this Policy.

2. Scope of This Policy

This Policy applies to:

Customers who browse and purchase through the Platform
Vendors who apply to sell and operate a storefront on the Platform
Visitors to the Platform
Individuals who subscribe to our newsletter
Any other users interacting with the Platform

The Platform is a web application accessed through an internet browser. We do not currently operate a mobile application, and this Policy does not cover any separate mobile application that we may release in future.

This Policy does not apply to third-party websites or services linked from the Platform, or to a vendor’s own handling of your data outside the Platform. Vendors act as independent data controllers in respect of their own use of your data — see Section 8.

3. Information We Collect

A. Account and Profile Information

When you create an account, we collect and process:

Customers: your name, email address, password (managed securely by our authentication provider and never stored by us in readable form), delivery and billing addresses, and your saved preferences.
Vendors: your name and contact details, business or trading name, business category, location, and the information you provide during vendor registration.

B. Heritage Verification Documents (Vendors)

To operate a mission-led marketplace for Black-owned businesses, vendors are asked to submit documentation supporting their eligibility during onboarding. This information may reveal racial or ethnic origin and is therefore treated as special category data — see Section 4.

Stored in a private, encrypted location, separate from general Platform data
Access is restricted to authorised reviewers and is logged
Reviewed by a human reviewer — eligibility decisions are not made by automated means
Deleted within 90 days of a final approval or rejection decision, except where we are required to retain records for legal or compliance reasons
Subject to your right to request erasure and to withdraw consent

We never publish, display or share heritage verification documents beyond the authorised reviewers involved in the approval decision.

C. Orders, Transactions and Payments

When you place an order, we process order details such as the items purchased, amounts, currency, delivery address and order history. Checkout and card payments are handled by our payment and commerce providers (see Section 8). We do not store full payment card numbers. Vendor payouts and identity verification (KYC) are handled by our payment provider on our behalf.

D. Content You Provide

We collect content you choose to submit, including product reviews and ratings, wishlist and saved-business selections, support requests, and messages relating to orders, refunds or disputes.

Please note that reviews, ratings and any display name associated with them are published publicly on the Platform. Vendor storefront details — including business name, category and general location — are also published publicly as part of the directory.

E. Information Collected Automatically

When you use the Platform, we may automatically process certain technical data, including:

IP address
Browser type and version
Device type and operating system
General geographic location (country or region level only)
Session data
Referring URLs
Error and crash reports generated by the Platform

This information is used for security monitoring, fraud prevention, abuse detection, system integrity and Platform performance.

F. Newsletter and Communications

If you voluntarily subscribe to our newsletter, we collect your email address and use it solely to send communications you have requested. You may unsubscribe at any time via the link in each email. We also send transactional communications — for example order confirmations, refund and return updates, and vendor account notices — that are necessary to operate your account and your orders. Transactional messages are not marketing and cannot be unsubscribed from while your account remains active.

4. Special Category Data — Heritage Verification

Information evidencing that a business is Black-owned may reveal racial or ethnic origin, which is “special category data” under Article 9 of the UK GDPR. Special category data requires an additional lawful condition beyond the general legal bases set out in Section 5.

Our Article 9 condition is your explicit consent (Article 9(2)(a) UK GDPR). During vendor onboarding you will be asked to give a separate, clearly worded and affirmative consent to our processing of heritage verification information. This consent is distinct from your acceptance of this Policy or our Terms.

You may withdraw that consent at any time by contacting us using the details in Section 17. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Because verified eligibility is a condition of operating a vendor storefront on the Platform, withdrawing consent may mean we can no longer maintain your vendor account, and we will explain the consequences before acting on any withdrawal.

We have assessed the risks associated with this processing and maintain internal records, together with a policy document setting out our procedures for securing compliance and our retention and erasure policies for special category data.

5. Legal Basis for Processing

Where applicable under the Data Protection Legislation, we process personal data under the following legal bases:

Purpose	Legal basis
Creating and operating your account; processing orders, payments and payouts; handling refunds, returns and disputes	Performance of a contract (Article 6(1)(b))
Platform operation, security, fraud prevention, abuse detection and service improvement	Legitimate interests (Article 6(1)(f))
Newsletter subscriptions, non-essential cookies and any other optional processing	Consent (Article 6(1)(a))
Tax, accounting, statutory record-keeping and responding to lawful requests	Legal obligation (Article 6(1)(c))
Processing heritage verification information revealing racial or ethnic origin	Explicit consent (Article 9(2)(a)) in addition to the Article 6 basis above

Where we rely on legitimate interests, we have carried out a balancing assessment to satisfy ourselves that our interests do not override your rights and freedoms. You may request further information about that assessment using the contact details in Section 17.

We do not use personal data for automated decision-making that produces legal or similarly significant effects. Vendor eligibility decisions are reviewed by a person.

6. Cookies and Similar Technologies

Cookies are small files placed on your device that allow the Platform to recognise your browser and remember information about your visit.

We use two categories of cookie. Essential cookies are strictly necessary to deliver the Platform — keeping you signed in, maintaining your basket and completing checkout, and protecting against fraud and abuse. These do not require your consent. Analytics cookies help us understand how the Platform is used so that we can improve it. These are not strictly necessary and we set them only where you have given consent.

When you first visit the Platform you will be shown a cookie banner allowing you to accept or reject analytics cookies. You may change or withdraw your choice at any time through the cookie settings link in the Platform footer.

Rejecting analytics cookies will not affect your ability to browse, purchase or operate a vendor storefront.

The cookies we use are:

Cookie / provider	Purpose	Category	Expiry
Authentication session (our authentication provider)	Keeps you securely signed in	Essential	Session to 7 days
Security and load balancing (our hosting provider)	Protects against automated abuse; routes traffic	Essential	Session
Basket and checkout (our commerce provider)	Remembers basket contents and completes checkout	Essential	Up to 12 months
Cookie preference record	Stores your cookie choices	Essential	12 months
Google Analytics	Aggregate usage and traffic measurement	Analytics (consent)	Up to 24 months
PostHog	Product analytics and feature usage	Analytics (consent)	Up to 12 months

We do not use advertising networks, remarketing or retargeting pixels, or cross-context behavioural tracking, and we do not share personal data for behavioural advertising.

You may also block or delete cookies through your browser settings; however, disabling essential cookies will prevent signing in and checkout from working. Further information about cookies is available at allaboutcookies.org. Please note that third-party sites linked from the Platform may set their own cookies, over which we have no control.

7. How We Use Information

We use collected information to:

Operate and maintain the Platform and your account
Process orders, payments, refunds, returns and vendor payouts
Review vendor applications, including heritage verification
Facilitate delivery by sharing necessary order and address details with the relevant vendor
Display vendor storefronts, listings and published reviews within the directory
Monitor and improve performance, security and reliability
Respond to enquiries and resolve disputes
Send transactional communications and, where you have consented, marketing communications
Comply with legal and regulatory obligations, including tax and marketplace reporting requirements

8. How We Share Information

We share personal data only as necessary to operate the Platform:

Vendors receive the customer information required to fulfil an order, such as name, delivery address and order contents. Once a vendor receives that information, the vendor acts as an independent data controller in respect of its own use of it, and its own privacy policy will apply. We are not responsible for a vendor’s handling of your data outside the Platform.
Service providers and processors that support commerce, payments, hosting, storage, authentication, analytics and email delivery. These include our commerce and checkout provider, our multi-vendor marketplace provider, our payments provider, our authentication and file-storage provider, our hosting provider, our analytics providers and our transactional email provider. They process data only on our documented instructions, under contract and subject to confidentiality obligations.
Authorities or third parties where required by law, including tax and marketplace reporting obligations, or to protect the rights, safety and integrity of the Platform and its users.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

9. Data Retention

We retain personal data only as long as reasonably necessary for the purposes described in this Policy:

Data	Retention period
Account and profile data	Deleted within 30 days of a verified account closure request, except where retention is required below
Order, transaction and payout records	Six years from the end of the financial year to which they relate, to meet tax and accounting obligations
Heritage verification documents	Deleted within 90 days of a final approval or rejection decision, unless longer retention is legally required
Technical and security logs	Up to 12 months
Support and dispute correspondence	Up to 24 months from resolution
Newsletter subscription data	Until you unsubscribe. We retain a minimal suppression record thereafter so that we can honour your opt-out

Where data must be retained for legal, tax or accounting reasons after you close your account, we restrict processing so that it is used only for those purposes.

10. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration or destruction. These include:

Encryption of data in transit using HTTPS with TLS certificates
Passwords managed by our authentication provider and never stored by us in readable form
Role-based access controls limiting access to personal data to authorised personnel
Restricted and logged access to heritage verification documents, which are held in a private, encrypted location separate from general Platform data
Payment card data handled entirely by our PCI DSS compliant payments provider; we do not store full card numbers
Ongoing monitoring of Platform integrity, together with security patching of the software and services we operate

We may occasionally request proof of identity before disclosing personal information to you. However, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure, and any transmission is at your own risk.

11. International Data Transfers

Some of our service providers may process personal data outside the United Kingdom. Where such transfers occur, we implement the safeguards required by the Data Protection Legislation, such as reliance on UK adequacy regulations or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You may request further information about these safeguards using the contact details in Section 17.

12. Your Rights

Under the UK GDPR you have the right to:

Be informed about our collection and use of your personal data
Access the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion (“erasure”) of your personal data
Restrict or object to processing, including objecting to processing based on legitimate interests
Data portability
Withdraw consent at any time where processing is based on consent, including consent to heritage verification processing and to analytics cookies

To exercise these rights, contact us using the details in Section 17. We will respond within one month, which may be extended by a further two months for complex requests, and we will tell you if an extension applies. We may require identity verification before acting on a request. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

It is important that your personal data is kept accurate and up to date. You can review and update your details at any time through your account settings.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would welcome the opportunity to resolve your concerns directly first, so please consider contacting us before approaching the ICO.

13. Children’s Privacy

The Platform is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will take appropriate steps to delete it.

14. Business Transfers

If we sell, transfer or reorganise all or part of our business, personal data may be transferred to an actual or prospective purchaser or successor entity as part of that transaction. Any recipient will be required to continue to protect your personal data in a manner consistent with this Policy, and we will notify you of any change in the identity of the data controller.

15. Third-Party Websites

The Platform may contain links to and from the websites of vendors, partners and affiliates. Those websites have their own privacy policies, and we do not accept responsibility or liability for them. Please check those policies before submitting any personal data to those websites.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our business activities, our service offering or the law. Any changes will be posted on the Platform with an updated “Last updated” date. Where changes are significant, we will notify you by email or through a notice on the Platform before they take effect. Continued use of the Platform after an update constitutes acceptance of the revised Policy.

17. Contact Us

If you have questions about this Policy, wish to exercise your rights, or want to make a complaint about how we handle your data, please contact us:


Email (privacy enquiries and data rights requests)	support@ybmapp.com
Email (alternative)	admin@ybmapp.com
Post	YBMAPP LTD, 20–22 Wenlock Road, London, N1 7GU, United Kingdom
Supervisory authority	Information Commissioner’s Office — ico.org.uk

This Privacy & Cookies Policy was most recently updated on 27 July 2026.

Questions about this document? Email support@ybmapp.com.