KLEKT — PRIVACY POLICY
Last updated: Oct 20, 2026
This Privacy Policy explains how Authenticated By Ltd trading as KLEKT collects, uses and shares personal data across the KLEKT website and app, for buyers, sellers (private and business), and visitors, in the UK, EU and US. Region-specific rights are in Section 11 (UK & EU) and Section 11B (United States). It should be read with our Terms of Service, Business Seller Terms and Cookie Policy.
1. Who we are
The data controller is Authenticated By Ltd trading as KLEKT (“KLEKT”, “we”, “us”, “our”), registered in England and Wales under company number 11767589, registered office Suite 15A, Stone Cross Place, Stone Cross Lane, Warrington WA3 2SH.
- Privacy contact: support@klekt.com (mark for the attention of the Privacy/Data Protection team).
- EU representative (GDPR Art. 27): Prighter Group. You can exercise your rights via https://app.prighter.com/portal/14662692828.
- EU DSA representative (DSA Art. 13): Prighter DSA, via the same portal. Our latest DSA transparency report is available on our site.
Where you sell as a business seller, and where an item ships directly from a seller to a buyer, that seller is also an independent controller of the personal data they receive from us for that order — see Section 5.2.
2. Who this policy applies to and when broader standards apply
This policy applies to all users: buyers, private sellers, business sellers and visitors. Some provisions apply only where broader statutory standards apply — in particular UK and EU data-protection law (Section 11) and US state privacy laws (Section 11B). Broader standards apply, among other cases, where we process the data of users located in the UK/EU in connection with offering goods or services to them or monitoring their behaviour.
3. The personal data we collect
3.1 Account & registration data. Full name, email, password, date of birth, and (on registration via Google/Meta single sign-on) basic profile data from that account. You must be 18+ (Section 12).
3.2 Profile data. Country, phone number, full address, email, and optional personalisation (e.g. shoe size, favourite brands/products). If you create a public profile, the information you choose to display there — username, profile details, your listings and public activity — is visible to other users and may be indexed by search engines. Your wallet, balance, payout details and payment information are never shown on your public profile.
3.3 Business seller verification & compliance data. If you register as a business seller, we collect and verify additional data to meet our legal obligations, including: legal and trading name, business type and company/registration number, registered and trading addresses, VAT/sales-tax registration numbers, a named contact, business bank/payout details, and identity, beneficial-ownership and sanctions/AML-screening information. We may collect identity documents to verify you. We also collect the transaction data we are required to report to tax authorities (Section 5.5). Private sellers. If you sell as a private seller, we may also ask you to provide and verify identity, contact and tax-identification details (for example under the EU Digital Services Act and the tax-reporting rules in Section 5.5), and we may report you and your transactions where reporting thresholds are met.
3.4 Orders, transactions & delivery data. Items bought/sold, prices and fees, order history, and delivery details (recipient name and shipping address). For direct seller-to-buyer shipments (Direct-Ship Items priced under the Authentication Threshold in a supported region), the buyer’s delivery name and address are shared with the seller solely to fulfil that order — see Section 5.1. US tax-exemption certificates. If you apply to buy without sales tax being collected under our US Tax Exemption Certificate Program, we collect the certificate you upload and the details on it (such as your name, address, organisation and exemption type, and tax-registration or exemption numbers), and we keep it with the related transaction records.
3.5 Listings & user content. Photographs and descriptions of the actual items you list (item-based listings), and content you post on your profile. Uploaded images may contain metadata (e.g. device or location data) — remove it before uploading if you do not wish to share it. We process listing images and related data to operate the marketplace, to authenticate items and detect counterfeits (including automated checks), and to promote listings.
3.6 Communications & messaging. The content of messages you send through KLEKT’s member-to-member messaging, and your communications with our support team. We process message content to deliver the service, ensure safety, moderate content and prevent prohibited off-platform solicitation, fraud and abuse. We also process the photos and other evidence you submit with a KLEKT Guarantee claim, dispute or return (including up to 12 images) to assess and resolve it.
3.7 Payment & payout data. To take payments and pay sellers we and our payment providers process payment/billing information. Depending on the method, this includes data associated with your PayPal account (e.g. linked email and billing address), Klarna, Apple Pay, Google Pay/card data, and — for seller payouts — Hyperwallet account data. Card and bank details are handled by our payment providers under their own privacy policies; we do not store full card numbers. If you choose Klarna, Klarna may carry out its own eligibility and credit checks under its own terms and privacy policy.
3.8 Device, usage & cookie data. IP address, device and browser information, unique advertising identifiers (e.g. Google Advertiser ID/IDFA), app and site interactions, and similar data collected via cookies and comparable technologies (Section 7 and the Cookie Policy).
3.9 Fraud, security & verification data. Data used to verify identity, assess risk, detect fraud and counterfeits, secure accounts, and enforce our Terms, including device/usage signals, verification checks and records of enforcement actions. This includes card verification checks and nominal pre-authorisations we may run for new buyers to prevent fraud.
3.10 Data from third parties. Single sign-on providers (Google, Meta), app stores (transaction/install data), payment and logistics providers, identity/AML-verification providers, and advertising/analytics partners.
4. How and why we use your data, and our legal bases
We use personal data to provide and improve KLEKT and to meet our legal obligations. Where UK/EU law applies, our legal bases are indicated:
- Provide the marketplace and your account, process orders, and coordinate authentication and shipping — performance of a contract.
- Direct seller-to-buyer fulfilment (sharing delivery details with the seller for that order) — performance of a contract.
- Operate profiles, listings and member-to-member messaging, and moderate content — performance of a contract and legitimate interests (safe, trustworthy marketplace).
- Take payments and pay out to sellers — performance of a contract / legal obligation.
- Verify business sellers and screen for AML/sanctions — legal obligation and legitimate interests.
- Report seller and transaction information to tax authorities (e.g. DAC7, UK digital-platform reporting, IRS Form 1099-K) — legal obligation.
- Prevent fraud, counterfeits and abuse, and ensure security and platform integrity — legitimate interests and, where applicable, legal obligation.
- Marketing communications — consent (you can opt out at any time); analytics and advertising cookies — consent where required (Section 7).
- Comply with legal obligations and respond to authorities; establish, exercise or defend legal claims — legal obligation / legitimate interests.
Under the UK Data (Use and Access) Act 2025, some processing (such as sharing personal data with regulators or authorities in defined circumstances) may rely on a recognised legitimate interest.
Automated processing and profiling. We use automated tools to assess fraud and counterfeit risk, to assign seller trust tiers (which affect fees and payout timing), to run the automated “Buy Now” matching (which matches your order to the lowest available listing) and bidding logic, and to adjust certain consignment prices over time. These do not normally produce legal or similarly significant effects on you without human involvement; where they might, we apply appropriate safeguards and you can contact us to request review. We do not use your data for advertising that produces such effects.
5. How we share your data
5.1 With other users. To operate a marketplace we share limited data between buyers and sellers: - Direct seller-to-buyer shipping: for items under the Authentication Threshold in supported regions that ship directly (without passing through a KLEKT Authentication Centre), we provide the buyer’s delivery name and address to the seller solely to fulfil that order. The seller must use it only for that purpose and in line with data-protection law. - Returns: when a Buyer returns an item, the return is routed either to the seller (for items under the Authentication Threshold) or to the KLEKT Authentication Centre (for items at or above the Threshold, or where authentication was purchased). Where a return is sent to the seller, we share the information needed to complete that return, to be used only for that purpose. - Seller information to buyers: where required (including for business/high-volume sellers under the US INFORM Consumers Act), we display or provide certain seller identity and contact information to buyers. - Public profiles and listings: information on your public profile and your listings is visible to other users. Messages you send are delivered to the recipient. We do not otherwise share your name, address, phone, email or date of birth with other users without your consent, except as needed to fulfil an order.
5.2 Sellers as independent controllers. When a seller receives a buyer’s personal data from us to fulfil a direct shipment, or when a business seller sells to you, that seller acts as an independent controller and is responsible for its own compliance. A data-sharing addendum may apply to business sellers.
5.3 Service providers (processors). We share data with vendors who process it on our behalf under contract, including hosting/IT, payment providers (PayPal, Klarna, Hyperwallet and card processors), shipping carriers and logistics partners, authentication partners, identity/AML-verification providers, our outsourced customer-support provider (Newstel, whose support agents are based in the Philippines — see Section 6), customer-communications tools (e.g. Klaviyo) and analytics providers.
5.4 Advertising & analytics partners. With your consent where required, we share limited data with analytics and advertising partners (e.g. Meta Platforms and Google) to measure and deliver advertising. In the US, some of this activity may be considered a “sale” or “sharing”/targeted advertising under state law — you can opt out (Section 11B).
5.5 Tax and regulatory authorities. As an online marketplace we are required to collect and report information about certain sellers (private and business) and their transactions to tax authorities — for example under the EU DAC7 rules, the UK digital-platform reporting rules (based on the OECD Model Reporting Rules), and US reporting such as IRS Form 1099-K where thresholds are met. We share data with regulators, courts and authorities where legally required. Where you use our US Tax Exemption Certificate Program, we may provide your certificate and related transaction records to tax authorities as required.
5.6 Legal, safety and corporate transactions. We may disclose data to comply with legal obligations, enforce our Terms, protect rights, property and safety, prevent fraud, and in connection with a merger, acquisition or sale of assets.
6. International data transfers
KLEKT operates a UK/EU logistics hub and a US warehouse, and uses service providers in the UK, EU, US and elsewhere. Where we transfer personal data outside the UK or EEA, we rely on appropriate safeguards, primarily the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, supported by transfer risk assessments. Where a US recipient is certified under the EU–US Data Privacy Framework (and its UK extension), we may also rely on that framework; because its status is subject to ongoing review, we do not rely on it alone. In particular, our outsourced customer-support provider's agents access personal data from the Philippines, which is not covered by a UK or EU adequacy decision; we rely on the EU Standard Contractual Clauses and the UK IDTA/Addendum, together with a transfer risk assessment, to safeguard that access. You can request more detail on the safeguards for a specific transfer using the contact details in Section 1.
7. Cookies, similar technologies & advertising choices
We use cookies and similar technologies for essential site functionality, analytics, preferences and advertising, as described in our Cookie Policy. Where required, we obtain consent for non-essential cookies and you can withdraw it at any time. You can also opt out of many advertising cookies via your browser/device settings and industry opt-out tools. We honour recognised opt-out preference signals such as Global Privacy Control (GPC) where required by applicable law. Because there is no common industry standard for “Do Not Track”, we respond to GPC rather than DNT.
8. Data retention
We keep personal data only as long as necessary for the purposes described here. Account and profile data is generally retained while your account is active; transaction, tax, accounting and fraud-prevention records are retained for the periods required by law (for example, financial and tax records are typically kept for at least six years, and tax-reporting data for the periods required by the applicable reporting rules). When data is no longer needed, we delete or anonymise it. Some rights (e.g. erasure) cannot be exercised in respect of data we must retain by law.
9. Security
We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption in transit and account passwords. You are responsible for keeping your password confidential and for activity under your account; tell us immediately if you suspect unauthorised use. No system is completely secure, and we cannot guarantee absolute security.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent (without affecting prior processing). You can also object to direct-marketing processing at any time.
To exercise your rights, contact us at support@klekt.com. We do not charge a fee for a subject access request (except where a request is manifestly unfounded or excessive, or for additional copies). We respond within the statutory time limit (generally one month), and — consistent with the UK Data (Use and Access) Act 2025 — we may carry out a reasonable and proportionate search and may pause the time limit where we reasonably need clarification to respond.
If you have a concern, you can complain to us first (Section 14). You also have the right to complain to your data-protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your local supervisory authority; in the US, your state authority where applicable.
11. UK & EU privacy notice
This policy is prepared in accordance with the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (which amend, and do not replace, the UK regime), the EU GDPR, and PECR/e-privacy rules. Nothing in this policy limits your mandatory rights under these laws.
- EU representative and DSA representative: Prighter (Section 1).
- Complaints to us: you can complain directly to us about how we handle your personal data; we will acknowledge your complaint promptly (within 30 days) and respond as required by law (Section 14).
11B. United States privacy notice
This section applies to residents of US states with applicable comprehensive privacy laws (including California). Subject to those laws and their exceptions, you may have the right to: - know/access the categories and specific pieces of personal information we collect, use and disclose; - delete and correct your personal information; - portability (obtain a copy); - opt out of the “sale” or “sharing” of personal information and of targeted advertising — we honour GPC signals for this; - limit the use of sensitive personal information where applicable; and - to be free from discrimination for exercising your rights, and to appeal a decision on your request.
Categories of personal information we collect are described in Section 3 (identifiers, contact and account data, commercial/transaction data, financial/payment data, internet/device activity, approximate location, and — for business sellers — professional and government-ID/verification data). We disclose these categories to the recipients in Section 5 for the purposes in Section 4. We do not sell personal information for money; some advertising/analytics activity (Section 5.4) may be treated as a “sale” or “sharing”/targeted advertising under state law, which you can opt out of. California “Shine the Light”: California residents may request information about disclosures to third parties for their direct-marketing purposes.
To exercise US privacy rights, contact us at support@klekt.com. We will verify your request and may allow an authorised agent to act for you.
12. Children
KLEKT is not intended for anyone under 18, and you must be at least 18 to hold an account. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.
13. Changes to this policy
We may update this policy from time to time and will post changes here (and, where required, notify you). Where changes affect processing based on your consent, we will seek fresh consent where required. Please review this page and note the “Last updated” date.
14. How to contact us and complain
For any privacy question or to make a complaint, contact support@klekt.com or write to the address in Section 1. If you are not satisfied with our response, you may escalate within KLEKT and, ultimately, complain to your data-protection authority (Section 10).
Definitions
Personal data — information that identifies or can identify a natural person.
Usage data — information collected automatically (e.g. IP address, device/browser data, interactions).
Controller — the party that determines the purposes and means of processing.
Processor — a party that processes personal data on a controller’s behalf.
Business seller — a seller acting in the course of a trade, business, craft or profession.
Direct-ship item — an item priced under the Authentication Threshold in supported regions and shipped directly from seller to buyer without passing through a KLEKT Authentication Centre.