How Sell Any Mobile applies UK GDPR.

Compliance framework and scope

Sell Any Mobile applies the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and other applicable UK data protection requirements. We monitor relevant changes, including the Data (Use and Access) Act 2025 and updated Information Commissioner’s Office guidance, and adjust our controls where those changes apply to our processing.

This page describes our compliance framework in more formal terms than the Privacy Policy. It is not a certification, regulatory approval or claim that risk can be eliminated. It records the roles, principles and controls we use to demonstrate accountable processing.

Our role as controller

Syhtek Software Solutions Ltd is the controller for personal data collected through Sell Any Mobile’s own website usage, forms, alerts and communications. World Business Software Solutions builds and operates the platform as a specialist division of Syhtek Software Solutions Ltd rather than as an unrelated third-party controller.

As controller, we determine the purposes and essential means of our processing, provide privacy information, identify lawful bases, support individual rights, select and govern processors, manage retention, assess risk and remain accountable for compliance.

The independent recycler controller boundary

Some enquiry routes are intended to introduce a user to one or more relevant recyclers. Sell Multiple Devices and Sell Bulk Stock are examples. We are controller for collecting, reviewing and making the requested introduction.

When a recycler receives those details and decides how to use them to assess stock, contact the seller, create its own record or pursue a transaction, it ordinarily becomes a separate independent controller. It is not our processor merely because the introduction came through Sell Any Mobile. It must identify its own lawful basis, give its own privacy information and meet its own rights, retention, security and breach obligations.

We seek to limit the information passed to what the introduction requires. The controller boundary does not remove our responsibility for the lawfulness and security of the disclosure we make, and it does not make us responsible for the recycler’s later independent processing.

How we apply the UK GDPR principles

• Lawfulness, fairness and transparency: we identify a lawful basis, explain material uses at collection and avoid using information in ways a person would not reasonably expect.
• Purpose limitation: we define why information is needed, such as answering an enquiry, delivering an alert, making a requested recycler introduction or securing the service, and review any proposed new use before it begins.
• Data minimisation: forms are route-specific, no upload field is used, repeating rows are avoided and fields are limited to what the route genuinely needs.
• Accuracy: users can correct submitted information, operational records can be updated and inaccurate data is corrected or qualified when discovered.
• Storage limitation: retention is tied to purpose, relationship, risk and legal need, followed by deletion, anonymisation or a documented reason to keep the record.
• Integrity and confidentiality: access, supplier, development, monitoring and incident controls are selected in proportion to the data and risk.
• Accountability: decisions, processing purposes, contracts, incidents, requests and higher-risk assessments are documented to the level required for our operations.

Lawful bases and purpose mapping

We map processing activities to the basis that reflects their real purpose. Consent supports genuinely optional choices such as product alerts and non-essential cookies. Legitimate interests can support proportionate website security, fraud prevention, service measurement, ordinary correspondence and record keeping after balancing our need against the person’s rights.

Article 6(1)(b) may apply where processing is objectively necessary to deliver a service a person requested or to take steps at their request before an agreement. We do not use “contract” as a catch-all where legitimate interests or consent is the more accurate basis. Legal obligation applies where legislation or binding process requires the use, and legal-claims provisions may support establishing, exercising or defending rights.

Special category or criminal-offence data is not requested through ordinary forms. If unexpectedly received, we restrict access, assess necessity and identify both an Article 6 basis and any additional condition required before retaining or using it.

Accountability and records

Our accountability work includes maintaining an appropriate record of processing activities, data maps, form purposes, retention decisions, processor arrangements, transfer mechanisms, rights requests, consent evidence, security events and personal data breaches.

We review material platform or supplier changes for privacy impact. Where proposed processing is likely to result in high risk to people, we complete a data protection impact assessment before proceeding and consult the ICO if a high residual risk cannot be reduced as required.

Data protection by design and by default

Privacy is considered during planning, build, release, operation and retirement, rather than being added only after a feature is live. By default, we aim to collect the minimum information, make it available only to the roles that need it, retain it only for the necessary period and avoid public disclosure.

The platform’s structured, tag-driven design separates reusable product content from personal enquiry data. Product comparison does not require a consumer account. Full device variants are product records, not personal profiles. Forms do not offer file uploads or repeating rows, which reduces accidental collection. Price-alert data is limited to an email address and the relevant product context.

These design choices support minimisation, but they do not replace ongoing access review, secure coding, testing, supplier governance or human judgement.

Processors and service providers

Where a supplier processes personal data only on our instructions, we assess whether it provides sufficient guarantees and put in place the written terms required by Article 28. Depending on the service, processors may support hosting, security, analytics, email delivery, technical operations or communications.

Processor terms address subject matter and duration, purpose, data types, confidentiality, security, documented instructions, subprocessors, assistance with rights and incidents, return or deletion, information needed to demonstrate compliance and appropriate audit rights. Authorised subprocessors must provide equivalent protection.

Using a processor does not transfer our controller accountability. A business receiving data for its own independent purposes is assessed as a controller, not labelled a processor for convenience.

Restricted international transfers

We identify whether a supplier arrangement causes a restricted transfer from the UK. Where UK adequacy regulations cover the recipient, we make proportionate checks on scope and application. Otherwise, we use an appropriate Article 46 safeguard, commonly the UK International Data Transfer Agreement or the UK Addendum to approved EU clauses.

Where a safeguard is used, we complete the required data protection test or transfer risk assessment and adopt supplementary contractual, organisational or technical measures if necessary. We do not transfer information under a safeguard where the resulting protection would be materially lower and the risk cannot be addressed.

Data subject rights

We support the rights to be informed, access personal data, rectify inaccurate data, complete incomplete data, erase data where the conditions apply, restrict processing, receive portable data where applicable, object to processing and withdraw consent.

We also recognise rights relating to decisions based solely on automated processing that produce legal or similarly significant effects. Sell Any Mobile’s ordinary comparison ordering and search tools do not make such a decision about a person. If that position changes, we will identify the applicable condition, safeguards, explanation and route for human intervention before deployment.

Rights can be limited by law and may conflict with another person’s rights or a legal requirement. Any refusal or partial response is explained, together with the right to complain.

How we handle rights requests

A request may be made in ordinary language and through any reasonable channel. We record the date, clarify scope where genuinely needed, search relevant systems and verify identity proportionately before disclosing information. We do not request excessive identity evidence by default.

We respond without undue delay and ordinarily within one month of receiving the request or the information lawfully needed to confirm identity or authority. Where a request is complex or numerous, the period may be extended by up to two further months and we explain the extension within the first month.

Requests are normally free. A reasonable fee or refusal is considered only where the law permits it, such as a manifestly unfounded or excessive request, and the decision is documented.

Security and access governance

We apply risk-based technical and organisational measures to protect confidentiality, integrity, availability and resilience. Controls can include secure transmission, access limitation, role separation, authentication, secrets management, backups, logging, monitoring, supplier due diligence, change control, vulnerability handling and recovery procedures.

Security is reviewed in context. The control appropriate for an email alert may differ from the control appropriate for a recycler business application or complaint record. Access is limited according to work need and removed or changed when that need ends.

Personal data breach response

Suspected incidents are contained, preserved for investigation, assessed and recorded. We consider the nature, volume and sensitivity of data, affected people, likely consequences and existing protections. Every confirmed personal data breach is documented, including facts, effects, risk decision and remedial action.

If a breach is likely to result in a risk to people’s rights and freedoms, we notify the ICO without undue delay and, where feasible, within 72 hours after becoming aware. If notification is late, the reason is recorded and explained. If the breach is likely to create a high risk, affected people are informed without undue delay in clear language unless a lawful exception applies.

Processors must notify us without undue delay so we can meet our controller obligations. After containment, we review root cause and corrective action.

Data Protection Officer assessment

UK GDPR requires a Data Protection Officer where an organisation is a public authority, carries out large-scale regular and systematic monitoring as a core activity, or carries out large-scale processing of special category or criminal-offence data as a core activity.

Based on Sell Any Mobile’s present documented processing, Syhtek Software Solutions Ltd is not a public authority, does not rely on large-scale special category processing as a core activity and does not currently consider the mandatory DPO criteria to be met. We therefore do not presently designate a statutory DPO.

This assessment is documented and reviewed if platform scale, tracking, services or processing risk materially changes. Responsibility for data protection governance and enquiries remains assigned even where a statutory DPO is not required. We will not call an ordinary contact a DPO unless the formal independence and role requirements are met.

Complaints and regulatory cooperation

Data protection concerns are investigated through our privacy process, with relevant records preserved and access limited. We aim to explain findings and corrective action in plain language.

Individuals may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We cooperate with lawful ICO enquiries, orders, audits and investigations and maintain evidence needed to demonstrate compliance.

Review, ownership and contact

This compliance statement is reviewed when regulation, ICO guidance, platform functions, suppliers or data flows change. It should be read with the Privacy Policy and Cookie Policy, which provide user-facing detail on specific processing.

This is a correspondence address only. Do not post devices there.