How Babsi Cards uses your information

This notice applies to people who start or complete a sell-to-us submission, people whose details are needed to complete a related purchase, delivery, return or payment, and candidates who apply for a role through Babsi Cards HQ.

We normally receive this information directly from you. We also create workflow, transaction and security records when you use the service, verify an email address, upload a CV or communicate with us.

Required fields are needed to provide the requested service or assess the application. If they are not supplied, we cannot complete that submission. Optional fields are clearly marked.

Where we rely on legitimate interests, those interests are operating a dependable seller service, recruiting suitable staff, protecting people and systems, and managing legal or business risk. We consider whether the use is necessary and balance those interests against your rights and expectations.

We do not ask for health or medical information in the initial application form. Please do not include it in your CV, portfolio, cover note or free-text answers.

If you need a reasonable adjustment, contact us after your email has been verified and share only what is necessary for us to arrange it. If health information is voluntarily provided and genuinely needed, access is restricted and we use it only to meet employment, social-protection, equality or related legal obligations and to provide the requested adjustment.

Access inside Babsi Cards is limited to staff who need the information for seller operations, recruitment, finance, security or legal support. Applicant CVs are held in private storage and are not published on the website.

We may also disclose information to professional advisers, insurers, auditors, payment or delivery providers, law-enforcement bodies, courts or regulators where necessary for the relevant service, a legal duty or a legal claim. We do not sell seller or applicant information.

International transfers

Some providers may store or access information outside the UK. Where this creates a restricted transfer, we use the UK's adequacy regulations where they apply. Otherwise, we use an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with transfer-risk assessment and supplementary measures where required.

Recruitment uses an expiring email-verification link, a secure session, rate limits, hidden anti-spam fields and Cloudflare Turnstile before a CV can be accepted. CVs are limited to plain PDF files, checked for size and file structure, stored privately, and available only through authorised administrative access. We also apply appropriate access controls to seller records.

No internet service can promise absolute security. We review our safeguards and limit access and retention to reduce the risk of loss, misuse or unauthorised disclosure.

• Applications and CVs

  Applications and CVs become eligible for deletion six months after submission, unless the information is needed for a legal dispute or the applicant gives separate consent for us to retain it for another role. For a hired applicant, the original application answers and CV are removed on the same schedule. Employment information needed after hiring must already have been moved into the separate staff record, which follows the applicable staff retention rules; the recruitment system does not keep a duplicate hired-candidate record after deletion.

• Email verification

  Recruitment email-verification request records expire after 24 hours and then become eligible for deletion in a scheduled retention batch.

• Rate-limit and security records

  Standalone recruitment rate-limit and security-event rows expire after their fixed anti-abuse window and then become eligible for deletion in a scheduled retention batch. The current hiring limits keep these records for less than three days before that eligibility point. Security metadata held as part of a submitted application, such as CV hash and review status, follows the six-month application period above.

• Seller and transaction records

  Seller information is kept only for as long as needed to manage the submission, purchase, payment, delivery or return, and then for any period required for tax, accounting, fraud prevention or legal claims. A completed transaction may therefore be retained longer than an enquiry that does not proceed.

• Marketing choices

  Marketing contact details and consent records are kept until consent is withdrawn or the information is no longer needed, subject to retaining a minimal suppression record where necessary to respect an unsubscribe request.

A protected scheduled process handles deletions in bounded batches and retries private-file deletion if storage is temporarily unavailable. A backlog or service outage may require a later scheduled run or manual intervention before deletion completes. We can place a record on a restricted hold where one of the stated exceptions applies, and delete or anonymise it when that need ends.

Depending on the circumstances, you can ask us to:

• provide a copy of your personal information;
• correct information that is inaccurate or incomplete;
• delete your information;
• restrict how we use your information;
• transfer information you provided where data portability applies;
• stop processing based on consent by withdrawing that consent;
• object to processing based on legitimate interests; and
• explain any decision-making that is subject to automated-decision rights.

These rights are not absolute and an exemption or legal duty may sometimes apply. We may ask for enough information to confirm your identity before acting on a request. Contact info@pokebabsi.com.

You also have the right to complain to the Information Commissioner's Office. You can use the ICO's complaint service or call 0303 123 1113.

The recruitment flow uses a strictly necessary, short-lived secure cookie after email confirmation so the verified applicant can reach the CV form. Turnstile and the site host also process technical data needed to deliver and protect the service. Blocking essential technology may prevent the form from working.

We may update this notice when our services, providers or legal duties change. The date at the top shows when this version was last updated. Material changes will be highlighted where appropriate.