Legal

Privacy Policy

Last updated: 13 September 2026

This policy explains how Westcroft & Rowe processes personal data when you use westcroftrowe.com and related services.

Who we are

Westcroft & Rowe operates an online marketplace for buyers and sellers of online businesses and websites. In this policy, “we”, “us” and “Westcroft & Rowe” mean the operator of that service.

For questions about this policy or your personal data, use the Contact page on this website.

What information we process

Depending on how you use the service, we may process:

• Account information — email address, password credentials (handled by our authentication provider), and account status such as whether your email is confirmed.
• Profile and firm information — firm name, seal, established year, and legal name you choose to store for deal completion.
• Authentication and session information — session tokens and related security data needed to keep you signed in.
• Seller and listing information — deal references, asking prices, sectors, status, and other listing fields you supply.
• Business information in a listing — business name, domain, overview, figures, documents and diligence material uploaded for a listing.
• Watchlist and activity data — listings you watch and negotiation or messaging activity on deals you take part in.
• Subscription and payment references — membership status, plan, period dates, and Stripe customer or subscription identifiers needed to administer membership. We do not receive or store your full payment-card details.
• Escrow and transaction references — deal state, agreed amounts, Escrow.com transaction identifiers, status information and payment URLs needed to operate the workflow.
• Communications — messages exchanged on the platform between parties to a deal, and any enquiry you submit through Contact.
• Technical, device, log and security data — such as IP address, user agent, timestamps and similar server or security logs generated when you use the site or our APIs.
• Cookie and local storage information — strictly necessary session storage used for authentication. See our Cookies page.

We do not currently load optional analytics or marketing trackers on the site.

Payments

Membership subscription payments are processed by Stripe. Westcroft & Rowe does not receive or store users’ full payment-card details. Stripe processes payment information under its own privacy terms. We may still store payment-related personal data such as Stripe customer IDs, subscription IDs, membership status and related metadata required to operate membership.

Escrow

Acquisition funds between buyers and sellers are handled by Escrow.com, an independent third-party escrow provider. Westcroft & Rowe does not hold buyer or seller acquisition funds. We may receive transaction identifiers and status information necessary to operate the marketplace workflow.

Infrastructure providers

We use service providers to host, authenticate and store marketplace data, including Supabase (database and authentication) and Cloudflare (hosting and delivery of the site and API). These providers process data on our instructions as needed to run the service. We do not claim that all data is stored exclusively in the United Kingdom.

Purposes

We process personal data to:

• create and operate accounts;
• provide marketplace functionality, including listing, browsing, watchlists and negotiations;
• display public and member-gated listing information according to product rules;
• administer membership and record subscription status;
• support Escrow.com transaction workflow;
• prevent fraud, abuse and security incidents;
• respond to support and Contact enquiries;
• meet legal and compliance obligations.

Lawful bases

• Performance of a contract — creating your account, providing marketplace features you request, administering membership you purchase, and supporting deal workflow.
• Legitimate interests — securing the platform, preventing abuse, improving reliability, and operating anonymised public deal flow in a way that does not override your rights.
• Legal obligation — where we must retain or disclose information to comply with law.
• Consent — only where we actually rely on consent (for example optional cookies, if introduced later). We do not currently use non-essential cookies.

Sharing

We may share personal data with:

• Stripe, for membership payments and billing portal;
• Escrow.com, when a deal uses escrow;
• Supabase and Cloudflare (and similar infrastructure or security providers);
• professional advisers where legitimately necessary;
• government, regulatory or legal authorities where legally required;
• transaction counterparties, where your use of the product requires sharing (for example firm identity on bids, or legal name when a deal is agreed).

Public and signed-out browsing intentionally withholds business identity. We do not publicly disclose buyer or seller identity as part of ordinary deal-flow browsing.

International transfers

Some providers we use may process data outside the United Kingdom. Where that happens, transfers rely on the safeguards those providers offer under applicable data-protection law (such as contractual protections). Exact hosting regions depend on the provider configuration in force at the time.

Retention

We keep personal data for as long as needed to operate your account and the marketplace features you use. Membership and payment references are retained while a subscription relationship exists and for a further period needed for billing disputes, security and legal compliance. Listing, negotiation and escrow-related records may be retained for the life of a deal and afterwards where needed for fraud prevention, disputes or legal obligations. Server logs are typically retained for shorter operational periods unless needed for security investigation. Some records may be retained longer where necessary for legal, tax, fraud, security or dispute purposes.

Your rights

Under UK data-protection law you may have the right to:

• access your personal data;
• correct inaccurate data;
• request erasure;
• restrict processing;
• object to certain processing;
• data portability, where applicable;
• withdraw consent where processing relies on consent;
• complain to the Information Commissioner’s Office (ICO).

To exercise these rights, use the Contact page, or update account details in Settings where the product allows. You can also complain to the ICO at ico.org.uk.

Security

We use technical and organisational measures appropriate to a marketplace of this kind, including access controls, encrypted transport (HTTPS), server-side membership checks and database row-level security. No method of transmission or storage is completely secure.

Children

Westcroft & Rowe is intended for adults and business users. It is not directed at children. Do not create an account if you are under 18.

Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the service after an update means the revised policy applies to that use.