Privacy notice

Who handles your information

Mateusz S. Cybulski trading as MateksHub operates this inquiry-led collection catalogue. Postal address: Soon to see. Privacy contact: ponderaway@proton.me.

Information collected

When you send an inquiry, we store your name, email address, message, chosen route, and any item or trade context you provide. Inquiries, Callout Offers and Trade Proposals may include up to three optional JPEG, PNG or WebP photos, no larger than 10 MB each. Cloudflare processes these privately to validate and convert them into images without location/EXIF metadata. Originals are deleted after successful processing; abandoned or failed uploads are removed by automated cleanup within seven days. Accepted photos are linked to your inquiry for private Keeper review, not added automatically to the public catalogue. Please avoid faces, addresses, identity documents and other sensitive information. We also keep the inquiry reference, correspondence timestamps, status and relevant private Keeper notes needed to answer your request.

Why it is used

Inquiry information is used to answer a request, assess a potential passage, trade, callout, or holding question, protect the service from abuse, and maintain an accurate operational record. It is not sold or used for unrelated marketing.

For steps you ask us to take towards a purchase or other agreement, the lawful basis is taking steps at your request before entering a contract, and performing that contract if agreed. For general correspondence, private operational notes and abuse prevention, we rely on our legitimate interests in answering requests and keeping the service secure; we limit the information used and consider your rights. Required tax and business evidence is retained to meet legal obligations.

Providing an inquiry is voluntary. We need contact details and enough context to answer it; without them we may be unable to help. Please do not send identity documents or sensitive personal information unless specifically requested through an agreed secure process. The Keeper reviews requests; we do not make solely automated decisions with legal or similarly significant effects.

Service providers and correspondence

Cloudflare provides website hosting and security, the private inquiry and commerce databases, and photograph storage. Turso provides the catalogue and release database. The Keeper uses a restricted interface on the operator's local PC to review inquiries and private photographs, with local privacy-request and erasure records. Manual email correspondence uses Proton Mail and the email provider of the person being contacted. Inquiry information and photographs are not public catalogue content.

The form shows a reference when your inquiry is stored. Keep it for follow-up. No automatic inquiry email receipt is sent; we review the private inbox and aim to reply manually within one week.

These providers can process information outside the UK, including through international support or infrastructure. Contact the privacy address above for information about the applicable processing locations and transfer safeguards. We must verify the provider arrangements and any required UK transfer safeguards before opening public intake.

Retention and sharing

Closed inquiries that did not result in a transaction, including their photographs and related Keeper notes, are reviewed for deletion or anonymisation 90 days after the last contact. Unnecessary correspondence and photographs relating to completed transactions receive the same review. The Keeper checks whether an active matter, legal obligation, dispute or fraud concern requires continued retention before deleting anything. Transaction and other legally required business records follow a separate reviewed retention policy: required sole-trader tax evidence is retained for at least five years after the relevant 31 January tax-return filing deadline, and longer where a legal obligation or hold applies. Hosting, database, email, and storage providers may process information only to operate the service.

Recovery copies have an approved maximum age of 90 days. Where erased information remains in a recovery copy awaiting expiry, it is restricted from operational use and must be excluded during restoration. Live legally required tax records follow the separate retention rule above. Actual recovery restrictions and expiry must be verified before launch.

Shopify checkout and customer accounts

If you use online checkout, Shopify processes your checkout, payment, delivery details, and customer order account. Pass-Over keeps the item and order identifiers, payment and fulfilment statuses, order totals, and operational timestamps needed to reconcile the sale in its private Cloudflare database. Card details are not collected or stored by Pass-Over. Temporary checkout and invoice links are held privately for their operational use; removing our stored link does not cancel a link already issued by Shopify. Transaction records are handled under the seller's reviewed retention policy.

Your choices

You can ask for access, correction, deletion, restriction, or a copy of your inquiry information. Contact the keeper with the inquiry reference where possible. Identity and legal obligations may need to be checked before a request is completed.

You can object to processing based on our legitimate interests. Rights depend on the reason for processing; necessary legal records may need to be retained. Contact the privacy address above to exercise your rights or raise a concern.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.