Privacy Policy

Last updated: 10 September 2026

1. Who we are

Scratch the Surface Ltd, a company registered in England and Wales and trading as ethy ("ethy", "we", "us"), operates the ethy marketplace at https://ethy.co.uk/marketplace (the "Marketplace").

We are the "controller" of the personal data described in this policy, which means we are responsible for deciding how and why it is used. If you have any question about this policy or about your personal data, email hello@ethy.co.uk.

2. What this policy covers

This policy explains what personal data we collect when you use the Marketplace, why we use it, who we share it with, how long we keep it and what rights you have. It applies to shoppers, to the brands that sell on the Marketplace, and to visitors who simply browse.

When you buy from a brand on the Marketplace, that brand is a separate controller of the order data it needs in order to fulfil your order. This policy does not cover what a brand does with your data after that point. See their own privacy notice for that.

3. The personal data we collect

Data you give us

  • Account data: your name, email address, password (stored only as a cryptographic hash), and your account type (shopper or seller).
  • Profile data: display name, profile picture and bio, where you choose to add them.
  • Order data: delivery address, billing details, phone number where you provide one, the items you order and any note you send with an order.
  • Seller data: brand name, business contact details, product and sustainability information, supporting evidence for ecolabel claims, and the identity and bank details our payment provider needs in order to pay you.
  • Messages: enquiries, offers, quote requests and messages you exchange with a brand (or with us) through the Marketplace.
  • Support and marketing data: the content of emails you send us, and your newsletter and marketing preferences.

Data we collect automatically

  • Technical data: IP address, device and browser type, operating system, language and the pages you view, including timestamps.
  • Usage data: how you move through the Marketplace: searches you run, filters you apply, listings you open and items you add to your basket.
  • Cookie data: see section 9.

Data we receive from others

  • Payment data from Stripe: the outcome of a payment, the card type, the last four digits and the expiry date. We never see or store your full card number.
  • Sign in data from Facebook or Google, if you choose to sign in with them: your name, email address and profile picture.
  • Seller verification data from the brands themselves and from the certification bodies and documents they provide as evidence.

We do not seek to collect special category data (such as health or political opinions), and we ask you not to send it to us through the Marketplace.

4. Why we use your data, and our lawful basis

To create and run your account: account and profile data. Lawful basis: performance of our contract with you (our Terms of Service).

To take and fulfil orders: order, payment and message data, shared with the relevant brand so it can dispatch your order and handle returns. Lawful basis: performance of a contract, and our legitimate interest in operating the Marketplace.

To take payments and pay brands: order and payment data processed through Stripe. Lawful basis: performance of a contract; compliance with legal obligations (tax and anti money laundering).

To provide customer support and handle disputes: account, order and message data. Lawful basis: performance of a contract, and our legitimate interest in resolving complaints fairly.

To verify brands and check sustainability claims: seller and verification data. Lawful basis: performance of our contract with the brand, and our legitimate interest (and shoppers' interest) in the integrity of our ecolabels.

To keep the Marketplace secure and prevent fraud and abuse: technical, account and order data, including the bot protection checks described in section 7. Lawful basis: our legitimate interest in protecting the Marketplace and its users, and compliance with legal obligations.

To send you service emails: for example order confirmations, dispatch updates, password resets and important changes to our terms. Lawful basis: performance of a contract, and compliance with legal obligations.

To send you marketing: our newsletter and similar updates, where you have signed up, or where you are an existing customer and the messages are about similar products. Lawful basis: consent, or our legitimate interest in marketing to existing customers. You can unsubscribe at any time using the link in any message or by emailing hello@ethy.co.uk.

To understand and improve the Marketplace: usage, technical and cookie data, in aggregate wherever possible. Lawful basis: consent for analytics cookies that are not essential, and our legitimate interest in improving our service.

To meet our legal obligations and to establish or defend legal claims: whatever data is relevant. Lawful basis: compliance with legal obligations, and our legitimate interest in protecting our position.

5. Who we share your data with

  • The brand you buy from, so it can fulfil, deliver and support your order.
  • Sharetribe, whose marketplace infrastructure hosts the Marketplace and stores its data.
  • Stripe, our payment provider, which processes payments and payouts and carries out its own identity and fraud checks.
  • Google, for reCAPTCHA bot protection on our sign up and log in forms, for optional Google Analytics measurement, and for Google sign in if you use it.
  • Plausible Analytics and Mapbox, where those features are enabled, for privacy friendly usage measurement and for maps respectively.
  • Facebook (Meta), if you choose to sign in with Facebook.
  • Our professional advisers and service providers (for example IT, email delivery, accounting and legal advisers), who act on our instructions.
  • Authorities and other third parties, where we are required to share data by law, or where it is necessary to establish or defend legal claims, or in connection with a sale or reorganisation of our business.

We do not sell your personal data.

6. International transfers

Some of our providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on an adequacy decision or on the UK International Data Transfer Agreement or Addendum together with appropriate safeguards, so that your data continues to be protected to UK standards.

7. Automated checks

We use Google reCAPTCHA on our sign up and log in forms to tell people apart from bots. reCAPTCHA analyses technical and behavioural signals from your device; a low score can cause a sign up or log in attempt to be blocked. Stripe also runs automated fraud checks on payments and may decline a transaction. Neither check results in a decision with legal effects that is taken solely by automated means without any human involvement, and you can contact us at hello@ethy.co.uk if you believe a check has wrongly blocked you.

8. How long we keep your data

  • Account and profile data: while your account is open, and for up to 12 months after it is closed, so that we can deal with any late queries.
  • Order, payment and invoice records: six years from the end of the financial year in which the order was placed, to meet UK tax and accounting requirements.
  • Messages between shoppers and brands: up to three years, so disputes can be investigated.
  • Marketing preferences: until you withdraw consent, and then a minimal record of that withdrawal so we do not contact you again.
  • Analytics and log data: up to 26 months, usually in aggregated or pseudonymised form.

Where we no longer need your data, we delete it or anonymise it so that it can no longer identify you.

9. Cookies and similar technologies

We use:

  • Strictly necessary cookies, to keep you signed in, remember your basket, and protect our forms from abuse. These are always on, because the Marketplace cannot work without them.
  • Analytics cookies, to understand how the Marketplace is used and where it can be improved. These are only set where you have agreed to them, and you can change your mind at any time.

You can also block or delete cookies through your browser settings, though the Marketplace may not work properly if strictly necessary cookies are blocked.

10. Your rights

Under UK data protection law you have the right to:

  • be informed about how we use your data, which is what this policy is for;
  • access a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased, where we no longer have a good reason to keep it;
  • restrict how we use your data while a concern is investigated;
  • object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time;
  • portability: receive certain data in a machine readable form, or have it sent to another provider; and
  • withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email hello@ethy.co.uk. We will respond within one month, and will tell you if we need longer (which we may, for complex requests). Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

11. Keeping your data safe

We use encryption in transit (HTTPS), hashed passwords, access controls and reputable infrastructure providers to protect your data, and we limit access to the people who need it. No online service can be completely secure, so please use a strong, unique password and tell us at hello@ethy.co.uk if you think your account has been compromised.

12. Children

The Marketplace is not intended for children, and you must be 18 or over to create an account. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy, for example when we add a feature or change a provider. The current version is always on this page, and the "Last updated" date shows when it last changed. Where a change materially affects you, we will tell you by email or through a notice on the Marketplace.

14. Contact us

Sell on ethy

Are you an independent brand that can back up its sustainability claims with evidence? Join ethy as a verified seller and reach shoppers looking for verified credentials.

Become a verified sellerVendor log in