Privacy policy

1. Who is responsible for your information?

PARRAGON LTD is the controller of personal information processed to operate The Perch Search. This notice describes our intended handling under the UK GDPR and Data Protection Act 2018, as amended. Independent sellers and payment providers may be separate controllers for their own activities.

2. Information we collect

• Account information: email address, account identifier, sign-in credentials handled by our authentication service and, if you choose Google sign-in, information Google supplies for that sign-in.
• Seller information: name, profile biography, seller type, location, postcode and coordinates, and the identity document you upload.
• Listing information: photographs, descriptions, species, age, sex, DNA-sexing claims, price, aviary notes and genetics information. Avoid including unnecessary personal information in these fields or photographs.
• Enquiries: your name, email address, message and the listing you contact a seller about; reviews and related account information where submitted.
• Membership and billing records: plan, subscription and payment identifiers, status, payment dates, amounts, receipts, listing credits and notifications. Stripe handles payment-card details; we do not store full card numbers or card security codes in our application database.
• Technical information: authentication storage, requests, security and error information, and information such as IP address and browser details handled by hosting and service providers. The postcode entered in Perch Finder is sent for postcode lookup; it is also included in the search URL and may appear in browser history or a link you share.

3. Why we use it and our lawful bases

• Contract: creating and maintaining accounts, publishing listings, handling enquiries, providing paid memberships and requested new-bird alerts, and managing payments.
• Legitimate interests: proportionate security, fraud prevention, investigating misuse, operating seller-document upload checks and resolving complaints. We must balance these purposes against your privacy rights.
• Legal obligation: required accounting records, lawful regulatory requests and other applicable duties.
• Consent: any optional marketing or non-essential tracking for which consent is required. Purchasing a membership does not give blanket permission for unrelated marketing.

Required account or billing information is necessary to provide the relevant service. Without it, we may be unable to create an account, publish a listing or activate membership. We do not use the uploaded identity document for facial recognition or biometric identity matching.

4. What others can see

Public listings and seller profiles show seller names, biographies, seller type, location, verification badge, listing details and photographs. Listing alerts contain selected listing and seller information. Identity documents are kept in private storage, not displayed on public listings.

Your enquiry details are made available for the relevant seller to respond. A seller’s subsequent use of those details is their responsibility under applicable data protection law. Do not include sensitive information or identity documents in an enquiry.

The current “ID Verified” badge is set automatically following an upload; it is not a manual identity-authenticity assessment.

5. Service providers and sharing

We use Lovable Cloud for hosting-related services, authentication, data and file storage, email delivery and operational diagnostics; Stripe for payments and subscription management; Google for optional sign-in and externally loaded fonts; and postcodes.io for UK postcode lookups. A postcode lookup sends the entered postcode, not your full account profile.

Providers receive the information needed for their role. Payment providers may act as independent controllers for fraud prevention, regulatory compliance and payment processing. We may also share relevant information with professional advisers, authorities where legally required, or a successor business subject to appropriate safeguards. We do not sell your personal information.

Provider processing may take place outside the UK. Where a transfer requires safeguards, we must use an applicable UK adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum. The provider locations and safeguards for this service must be confirmed before this draft is finalised; contact us for details once confirmed.

6. Retention and security

We retain information only as long as needed for the stated purposes, legal duties and legitimate dispute or security needs. Account and listing records are kept while needed to deliver the service; billing records may need to be kept after membership ends to meet accounting duties.

The retention schedule for identity documents, enquiries, deleted listings, technical logs and backups is awaiting confirmation. Uploading or deleting a listing does not mean every associated record or backup is immediately erased. Request deletion or retention information using the contact details above.

We use access controls and private document storage, but no online service can promise absolute security. Keep your credentials confidential. We do not currently use document uploads for automated legal or similarly significant decisions about you; upload status does automatically control the public badge.

7. Your rights and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. These rights are not absolute; legal record-keeping duties can limit deletion.

Write to PARRAGON LTD using the address above to make a request. We may need to verify your identity proportionately. We normally respond within one month, subject to the extensions and exceptions permitted by law. You can manage your subscription in your account; cancellation and deletion of personal information are separate requests.

You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would welcome the opportunity to resolve your concern first.

8. Children, cookies and changes

Account creation and paid services are intended for adults aged 18 and over. If you believe a child has supplied personal information, contact us so we can assess the appropriate action.

Our Cookie policy describes cookies and similar browser storage. We will update this notice when our processing changes, and provide additional notice where required for material changes.