What we collect, why, and what is still switched off.
This is a considered draft prepared ahead of real accounts opening. It has not yet been reviewed by a solicitor and Marketfolk has not yet completed its ICO fee self-assessment; treat it as the working basis for that review, not a finished legal document. It will be updated once that review and Marketfolk’s company formation are complete.
Who is responsible for your information
Marketfolk is currently operated directly by its founder, prior to incorporation. The registered legal entity, business address and ICO registration reference will be added here once that process is complete. Until then, contact hello@marketfolk.co.uk with any privacy question or request.
What is currently switched off
Sign-up, applications, uploads, messages and payments are disabled at the server on the current preview. Do not submit real personal, financial or insurance information until this notice is confirmed as reviewed and the relevant feature is confirmed live.
What we collect
An email address and chosen role (maker or organiser) to create an account. For makers: business name, contact name, categories, a short bio, website or shop links, and a postcode used privately to calculate distance to markets; your exact postcode and coordinates are never shown publicly. For organisers: organisation name and contact email. If you apply to a market or claim an existing one, the information that application or claim requires. Insurance certificates, once that feature is enabled, are stored as documents with restricted access, not verified or endorsed by Marketfolk.
Why we use it, and our lawful basis
To create and run your account, match makers with relevant markets, let organisers review applications, and send service messages such as sign-in links, status changes and receipts: lawful basis is performance of a contract with you. Where we ask for consent, such as sharing an insurance certificate with a specific organiser, that consent is specific to that purpose and can be withdrawn. We do not use your information for third-party advertising.
Who we share it with
Cloudflare hosts the application, database and file storage. Once connected, Resend (or an equivalent provider) sends transactional email such as sign-in links and notifications, and Stripe processes payments as a separate data controller for card and payout details, which Marketfolk never stores directly. An organiser reviewing your application can see the maker profile information relevant to that decision; makers do not see other makers’ private details. We do not sell personal information.
Cookies
The site sets exactly one cookie: a session identifier, strictly necessary to keep you signed in. It is not used for advertising, analytics or tracking, and no other cookies are currently set.
How long we keep it
While your account remains active, and for a limited period afterwards where needed for accounting, fraud prevention or legal reasons. A documented retention schedule for each data type will be published before real accounts open; this is one of the items still awaiting legal review.
Your rights
Under UK data protection law you can ask to access, correct, delete or export your information, object to or restrict certain processing, and complain to the Information Commissioner’s Office if you believe we have handled your information incorrectly. Contact hello@marketfolk.co.uk to exercise any of these.
Security
Sign-in uses single-use, short-lived, hashed tokens; we never store a plain-text password or sign-in link. Documents, once enabled, are held in a private file store with time-limited, logged access. No system is perfect; if we become aware of a data breach affecting you, we will tell you and the ICO where required by law.