Privacy policy

1) Who we are
Cheshire Bullion Limited TA Cheshire Gold Xchange, Company No. 16098886, 3 London Road, Stockton Heath, Warrington, WA4 6SG. We are the data controller for the personal data we process. Contact: contact@cheshiregoldxchange.co.uk / 01925387107.

2) The data we collect
a) Identity and contact details: name, address, email, phone.
b) Transaction details: descriptions of items sold to us, valuations, prices paid, bank/payment details, correspondence.
c) Verification (when required by law): ID documents (e.g., passport/driving licence), proof of address, PEP/sanctions screening results.
d) Site data: enquiry form submissions, IP address, device info, cookies/analytics (see section 7).
e) In-store security: CCTV footage (premises only).

3) Why we use your data (lawful bases)
a) To provide quotes, buy items, and pay you — contract necessity.
b) To meet our legal obligations — e.g., anti-money laundering (AML) checks, tax/VAT record-keeping, responding to lawful requests.
c) Legitimate interests — e.g., fraud prevention, security (including CCTV), and keeping basic purchase records beyond the contract period where reasonably necessary.
d) Marketing (optional) — only with your consent; you can withdraw it any time.

4) AML/KYC checks (when applicable)
If we accept or make high-value cash payments (≥ €10,000 in a single or linked transaction) we may be a High Value Dealer and must perform CDD (customer due diligence) and keep specific records. Even below that threshold, we may conduct checks based on risk. Records required by the Money Laundering Regulations are kept for 5 years from the end of the business relationship or the completion of the transaction. We delete them after that unless the law requires longer retention.

5) How long we keep data
a) AML/KYC data: 5 years from the end of the relationship/transaction.
b) VAT/tax records: generally 6 years.
c) CCTV: typically [30] days unless needed to investigate an incident.
d) Marketing data: until you opt out or we no longer need it.
If we don’t have exact periods, we apply criteria based on legal requirements and business needs and keep data no longer than necessary.

6) CCTV
We use CCTV for security and crime prevention. Signs are displayed on site. Footage is stored securely, access is restricted, and we respond to lawful requests (e.g., police). If your CCTV captures identifiable people, UK GDPR applies and you may need to pay the ICO data-protection fee.

7) Cookies and analytics
Non-essential cookies (e.g., analytics/advertising) require consent under PECR. We show a cookie banner and honour your choices. You can change settings any time via [link to cookie preferences]. Essential cookies run without consent. For details, see our Cookie Policy.

8) Who we share data with
a) Service providers acting under contract (e.g., website hosting/CDN, email, CRM/forms, payment and accounting platforms, couriers, IT/security).
b) Banks and payment processors to pay you.
c) HMRC, law enforcement or regulators where required by law.
We require processors to safeguard your data and not use it for their own purposes.

9) International transfers
Some providers may store data outside the UK. Where we make “restricted transfers,” we use approved safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, and carry out transfer risk assessments.

10) Your rights
You have rights to access, rectification, erasure, restriction, objection, data portability, and to withdraw consent (where relied upon). You also have the right to complain to the ICO (www.ico.org.uk) if you’re unhappy. Please contact us first and we’ll try to resolve it.

11) Children
Our services are for adults. We don’t knowingly collect data from children.

12) Automated decision-making
We do not conduct solely automated decisions with legal or similarly significant effects. If this changes, we’ll tell you.

13) Changes to this notice
We’ll update this policy when needed and post the latest version here. Last updated: 12th August 2025.